Uh oh!
There was an error while loading. Please reload this page.
chore(deps): bump rustls-webpki to 0.103.13 for RUSTSEC-2026-0104 - #263
Merged
Conversation
The CI Security Audit step started failing on RUSTSEC-2026-0104, a reachable panic in `rustls-webpki` 0.103.12 when parsing certificate revocation lists (`BorrowedCertRevocationList::from_der` / `OwnedCertRevocationList::from_der`). Patched in 0.103.13. `rustls-webpki` is a transitive dep, so `cargo update -p rustls-webpki` is the only change — Cargo.lock only. Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
sachiniyertemporarily deployed
to
integration-tests
April 22, 2026 23:01 — with 
GitHub Actions
Inactive
Uh oh!
There was an error while loading. Please reload this page.
2 tasks
sachiniyer added a commit
that referenced
this pull request
Apr 23, 2026
## Summary Patch release rolling up the seven fixes merged since 0.2.1: - fix(bugs): print empty-results hint when `--vulns` alone yields no matches (#264) - fix(datetime): floor sub-second negative timestamps instead of snapping to epoch (#262) - chore(deps): bump rustls-webpki to 0.103.13 for RUSTSEC-2026-0104 (#263) - fix(repos): normalize whitespace in repo identifiers before lookup (#261) - fix(git): parse GitHub remotes with embedded http(s) credentials (#260) - fix(auth): redirect browser and surface OAuth errors on PKCE callback failure (#258) - refactor(config): rewrite `update_config` through the locked handle (#257) On merge, the release workflow will tag `v0.2.2` and publish platform artifacts via cargo-dist. ## Test plan - [x] `cargo build` succeeds with version 0.2.2 - [ ] Tag `v0.2.2` is created on merge and release workflow publishes artifacts 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- devin-review-badge-begin --> --- <a href="https://app.devin.ai/review/usedetail/cli/pull/265" target="_blank"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1"> <img src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1" alt="Open in Devin Review"> </picture> </a> <!-- devin-review-badge-end --> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The CI Security Audit step started failing on RUSTSEC-2026-0104 — a reachable panic in
rustls-webpki0.103.12 when parsing certificate revocation lists (BorrowedCertRevocationList::from_der/OwnedCertRevocationList::from_der). Patched in 0.103.13.rustls-webpkiis a transitive dep pulled in via the TLS stack, so the only change needed iscargo update -p rustls-webpki. Cargo.lock only; no source code touched.Test plan
cargo update -p rustls-webpki→ 0.103.12 → 0.103.13cargo buildcleanSecurity AuditCI check passes🤖 Generated with Claude Code