Transaction-Science/agent-joule

Watch

Fork 0

security: lockfile updates for the October advisories (TLS roots, QUIC, wasmtime) #2

Open

dcharlot wants to merge 1 commit from sec/rust-advisories-2026-10 into main

dcharlot commented

2026-10-22 13:04:43 -04:00

Owner

Lockfile-only security updates, from the 2026-10-22 security sweep.

rustls, rustls-webpki, webpki-roots, webpki-root-certs: the fixed releases for the CA key compromise disclosed on 17 October (rustls-webpki >= 0.103.16, webpki-roots >= 1.0.10).
quinn-proto 0.11.19: the October memory-limit and panic advisories.
ammonia 4.1.8.
wasmtime and wasmtime-wasi 36.x: moved to 36.0.19.

Checks: cargo metadata --locked and cargo check --locked --workspace pass on the build host. No source changed.

🤖 Generated with Claude Code

Lockfile-only security updates, from the 2026-10-22 security sweep. - rustls, rustls-webpki, webpki-roots, webpki-root-certs: the fixed releases for the CA key compromise disclosed on 17 October (rustls-webpki >= 0.103.16, webpki-roots >= 1.0.10). - quinn-proto 0.11.19: the October memory-limit and panic advisories. - ammonia 4.1.8. - wasmtime and wasmtime-wasi 36.x: moved to 36.0.19. **Checks:** `cargo metadata --locked` and `cargo check --locked --workspace` pass on the build host. No source changed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit

2026-10-22 13:04:43 -04:00

deps: patched rustls, webpki, quinn-proto, ammonia and wasmtime 36 (lockfile only) 900b680a60

Lockfile-only updates within each crate's semver line, for the RustSec
advisories as of 2026-10-22:

- rustls 0.23.43 -> 0.23.46: RUSTSEC-2026-0285, 0346, 0348, 0349
- rustls-webpki 0.103.15 -> 0.103.16, webpki-roots and webpki-root-certs
  1.0.9 -> 1.0.10: RUSTSEC-2026-0381/0382/0383 (CVE-2026-111943,
  distrusted emSign intermediates accepted)
- quinn-proto 0.11.17 -> 0.11.19: RUSTSEC-2026-0338, 0340, 0343
- ammonia 4.1.4 -> 4.1.8: RUSTSEC-2021-0157, 2021-0158, 2026-0373
- wasmtime, wasmtime-wasi and the 36.x family 36.0.14 -> 36.0.19:
  RUSTSEC-2026-0314, 0316, 0321, 0322, 0323, 0352, 0363, 0379, 0380

Verified on the build host: cargo metadata --locked, and
cargo check --locked --workspace (finished, exit 0).

Left for a manifest change: rustls 0.21 / rustls-webpki 0.101 / h2 0.3
come from aws-smithy-http-client 1.4 (hyper 0.14) under aws-config;
wasmtime 43.0.2 comes from the open-standards sandbox-exec-wasm git
dependency; zip 0.6/1.1 and quick-xml 0.36 need major bumps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin sec/rust-advisories-2026-10:sec/rust-advisories-2026-10

git switch sec/rust-advisories-2026-10

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff sec/rust-advisories-2026-10

git switch sec/rust-advisories-2026-10

git rebase main

git switch main

git merge --ff-only sec/rust-advisories-2026-10

git switch sec/rust-advisories-2026-10

git rebase main

git switch main

git merge --no-ff sec/rust-advisories-2026-10

git switch main

git merge --squash sec/rust-advisories-2026-10

git switch main

git merge --ff-only sec/rust-advisories-2026-10

git switch main

git merge sec/rust-advisories-2026-10

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/agent-joule!2

No description provided.

Rows
Columns