security: lockfile updates for the October advisories (TLS roots, QUIC, wasmtime) #2
2026-10-22
deps: patched rustls, webpki, quinn-proto, ammonia and wasmtime 36 (lockfile only)
Lockfile-only updates within each crate's semver line, for the RustSec advisories as of 2026-10-22: - rustls 0.23.43 -> 0.23.46: RUSTSEC-2026-0285, 0346, 0348, 0349 - rustls-webpki 0.103.15 -> 0.103.16, webpki-roots and webpki-root-certs 1.0.9 -> 1.0.10: RUSTSEC-2026-0381/0382/0383 (CVE-2026-111943, distrusted emSign intermediates accepted) - quinn-proto 0.11.17 -> 0.11.19: RUSTSEC-2026-0338, 0340, 0343 - ammonia 4.1.4 -> 4.1.8: RUSTSEC-2021-0157, 2021-0158, 2026-0373 - wasmtime, wasmtime-wasi and the 36.x family 36.0.14 -> 36.0.19: RUSTSEC-2026-0314, 0316, 0321, 0322, 0323, 0352, 0363, 0379, 0380 Verified on the build host: cargo metadata --locked, and cargo check --locked --workspace (finished, exit 0). Left for a manifest change: rustls 0.21 / rustls-webpki 0.101 / h2 0.3 come from aws-smithy-http-client 1.4 (hyper 0.14) under aws-config; wasmtime 43.0.2 comes from the open-standards sandbox-exec-wasm git dependency; zip 0.6/1.1 and quick-xml 0.36 need major bumps. Co-Authored-By: Claude Opus 5.5 <[email protected]>