Repository navigation
fix(deps): bump rustls-webpki to 0.103.16 (RUSTSEC-2026-0382) - #283
Conversation
Refs #282. Lockfile-only; patched range is >=0.103.16.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
tonibergholm
left a comment
tonibergholm
left a comment
There was a problem hiding this comment.
Approved: lockfile-only patch bump to the advisory's patched release; audit, tests and TLS demos green.
* docs: final sync with the implementation (pass 3) Audit of the living docs against the code at origin/main (through #283): ROADMAP Done/Deferred now match the open issues (#281 only), the #278/#280 file/directory collision guard replaces the stale open-hazard text, the DirBucket OS lock, compact --dry-run cost, ws run lock release and a single downgrade-hazard list are written down, demo count and ws/refresh/signature index/index lock/ADR status lines are corrected, and the sc-cli-reference skill is verified against sc --help. * docs: address review findings (reindex recovery, abort wording, CAS attempts, dry-run cost, author, identity default) * docs: scope the working-tree guarantees to public branches (review)
Closes #282
RUSTSEC-2026-0382: rustls-webpki may accept certificate paths with distrusted emSign intermediates. Patched in >=0.103.16.
Lockfile-only:
cargo update -p rustls-webpkitook 0.103.15 to 0.103.16. No Cargo.toml change, no audit ignore.Checked locally: fmt, clippy -D warnings, tests for scl-repo/cli/tlsio/objio (1223 passed, 0 failed), demo/run_tls_demo.sh, demo/run_http_auth_demo.sh, and cargo audit with the workflow's ignore list (no findings).