chore(deps): bump rustls-webpki to 0.103.13 - #12
Merged
Conversation
Patches GHSA-82j2-j2ch-gfr8 (reachable panic during CRL parsing) and the URI name-constraint inversion bug (a missing case from the GHSA-965h-392x-2mh5 fix). Both findings are in the native rustls path, not the wasm32 worker build, so production CF traffic isn't affected. We don't consume CRLs or validate URI SANs, so our concrete exposure is theoretical — taking the bump anyway, because "theoretical only" isn't a good answer when a clean patch is available. Cherry-picked out of dependabot PR #10 to avoid the grouped rand 0.9 → 0.10 major bump, which is breaking with no upside for us. 49/49 tests pass. No source changes; lockfile-only update. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rustls-webpkifrom 0.103.9 → 0.103.13 (lockfile only)rand 0.9 → 0.10major bump, which is breaking with no upsideAdvisories addressed
Both findings live in the native rustls TLS path. The wasm32 worker build doesn't depend on rustls. We don't consume CRLs and don't validate URI SANs in our cert handling, so concrete exposure is theoretical — taking the patch anyway because "theoretical only" isn't a reputable answer when a clean fix is available.
Test plan
cargo build— clean (one pre-existing dead-code warning, unrelated)cargo test— 49 passed, 0 failedWhy not just merge PR #10?
Dependabot grouped this with
rand 0.9 → 0.10, which is a major version bump.rand 0.10renamesRng→RngExt,OsRng→SysRng, and several other types we use acrossauth.rs,api_key.rs, andworker_oauth.rs. The breakage cost is non-trivial and the benefit is zero — we userandfor argon2 salts and HMAC nonces, neither of which improves under 0.10. PR #10 will be closed with an@dependabot ignore rand major versionto stop the cycle.🤖 Generated with Claude Code