Skip to content

build(deps): Bump rustls-webpki from 0.103.9 to 0.103.10#2346

Merged
mkroening merged 1 commit intomainfrom
dependabot/cargo/rustls-webpki-0.103.10
Mar 22, 2026
Merged

build(deps): Bump rustls-webpki from 0.103.9 to 0.103.10#2346
mkroening merged 1 commit intomainfrom
dependabot/cargo/rustls-webpki-0.103.10

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 21, 2026

Bumps rustls-webpki from 0.103.9 to 0.103.10.

Release notes

Sourced from rustls-webpki's releases.

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correct provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @​1seal for the report.

What's Changed

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

Commits
  • 348ce01 Prepare 0.103.10
  • dbde592 crl: fix authoritative_for() support for multiple URIs
  • 9c4838e avoid std::prelude imports
  • 009ef66 fix rust 1.94 ambiguous panic macro warnings
  • c41360d build(deps): bump taiki-e/cache-cargo-install-action from 2 to 3
  • e401d00 generate.py: reformat for black 2026.1.0
  • 06cedec Take semver-compatible deps
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [rustls-webpki](https://github.com/rustls/webpki) from 0.103.9 to 0.103.10.
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.9...v/0.103.10)

---
updated-dependencies:
- dependency-name: rustls-webpki
  dependency-version: 0.103.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Mar 21, 2026
@mkroening mkroening added this pull request to the merge queue Mar 22, 2026
Copy link
Copy Markdown

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark Results

Details
Benchmark Current: 3f4f194 Previous: 586154c Performance Ratio
startup_benchmark Build Time 89.15 s 89.93 s 0.99
startup_benchmark File Size 0.75 MB 0.75 MB 1.00
Startup Time - 1 core 0.93 s (±0.04 s) 0.94 s (±0.04 s) 0.98
Startup Time - 2 cores 0.95 s (±0.03 s) 0.95 s (±0.04 s) 1.00
Startup Time - 4 cores 0.96 s (±0.04 s) 0.97 s (±0.05 s) 0.99
multithreaded_benchmark Build Time 89.49 s 91.25 s 0.98
multithreaded_benchmark File Size 0.86 MB 0.86 MB 1
Multithreaded Pi Efficiency - 2 Threads 90.92 % (±7.80 %) 85.40 % (±9.54 %) 1.06
Multithreaded Pi Efficiency - 4 Threads 45.12 % (±3.82 %) 42.56 % (±3.61 %) 1.06
Multithreaded Pi Efficiency - 8 Threads 25.65 % (±1.81 %) 24.76 % (±2.25 %) 1.04
micro_benchmarks Build Time 94.90 s 91.46 s 1.04
micro_benchmarks File Size 0.86 MB 0.86 MB 1.00
Scheduling time - 1 thread 66.41 ticks (±3.99 ticks) 68.80 ticks (±4.10 ticks) 0.97
Scheduling time - 2 threads 36.01 ticks (±3.63 ticks) 39.47 ticks (±5.25 ticks) 0.91
Micro - Time for syscall (getpid) 2.97 ticks (±0.26 ticks) 3.20 ticks (±0.41 ticks) 0.93
Memcpy speed - (built_in) block size 4096 63884.77 MByte/s (±45825.25 MByte/s) 64814.90 MByte/s (±46327.32 MByte/s) 0.99
Memcpy speed - (built_in) block size 1048576 29520.92 MByte/s (±24398.79 MByte/s) 28856.45 MByte/s (±23828.37 MByte/s) 1.02
Memcpy speed - (built_in) block size 16777216 28067.75 MByte/s (±23383.14 MByte/s) 24426.65 MByte/s (±20483.76 MByte/s) 1.15
Memset speed - (built_in) block size 4096 64489.55 MByte/s (±46217.82 MByte/s) 65294.78 MByte/s (±46620.95 MByte/s) 0.99
Memset speed - (built_in) block size 1048576 30319.45 MByte/s (±24856.36 MByte/s) 29630.99 MByte/s (±24277.37 MByte/s) 1.02
Memset speed - (built_in) block size 16777216 28844.92 MByte/s (±23831.78 MByte/s) 25220.81 MByte/s (±21019.40 MByte/s) 1.14
Memcpy speed - (rust) block size 4096 58400.83 MByte/s (±43338.67 MByte/s) 57218.35 MByte/s (±42018.32 MByte/s) 1.02
Memcpy speed - (rust) block size 1048576 29449.52 MByte/s (±24303.83 MByte/s) 28891.93 MByte/s (±23988.24 MByte/s) 1.02
Memcpy speed - (rust) block size 16777216 28446.12 MByte/s (±23741.48 MByte/s) 23888.73 MByte/s (±19985.80 MByte/s) 1.19
Memset speed - (rust) block size 4096 59416.70 MByte/s (±44095.38 MByte/s) 58087.99 MByte/s (±42592.24 MByte/s) 1.02
Memset speed - (rust) block size 1048576 30223.37 MByte/s (±24750.52 MByte/s) 29667.29 MByte/s (±24457.42 MByte/s) 1.02
Memset speed - (rust) block size 16777216 29211.56 MByte/s (±24174.08 MByte/s) 24699.31 MByte/s (±20554.40 MByte/s) 1.18
alloc_benchmarks Build Time 92.73 s 87.19 s 1.06
alloc_benchmarks File Size 0.82 MB 0.82 MB 1.00
Allocations - Allocation success 100.00 % 100.00 % 1
Allocations - Deallocation success 100.00 % 100.00 % 1
Allocations - Pre-fail Allocations 100.00 % 100.00 % 1
Allocations - Average Allocation time 6014.76 Ticks (±66.40 Ticks) 5428.49 Ticks (±409.44 Ticks) 1.11
Allocations - Average Allocation time (no fail) 6014.76 Ticks (±66.40 Ticks) 5428.49 Ticks (±409.44 Ticks) 1.11
Allocations - Average Deallocation time 851.89 Ticks (±91.70 Ticks) 781.28 Ticks (±109.49 Ticks) 1.09
mutex_benchmark Build Time 91.82 s 84.78 s 1.08
mutex_benchmark File Size 0.86 MB 0.86 MB 1.00
Mutex Stress Test Average Time per Iteration - 1 Threads 13.08 ns (±0.87 ns) 13.22 ns (±0.94 ns) 0.99
Mutex Stress Test Average Time per Iteration - 2 Threads 20.00 ns (±11.16 ns) 90.56 ns (±4.80 ns) 0.22

This comment was automatically generated by workflow using github-action-benchmark.

Merged via the queue into main with commit 4c22c31 Mar 22, 2026
35 of 38 checks passed
@dependabot dependabot bot deleted the dependabot/cargo/rustls-webpki-0.103.10 branch March 22, 2026 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RUSTSEC-2026-0049: CRLs not considered authorative by Distribution Point due to faulty matching logic

1 participant