Skip to content

build(deps): bump rustls-webpki from 0.103.9 to 0.103.11 in /ai in the cargo group across 1 directory#6

Open
dependabot[bot] wants to merge 221 commits into
mainfrom
dependabot/cargo/ai/cargo-2368e972e4
Open

build(deps): bump rustls-webpki from 0.103.9 to 0.103.11 in /ai in the cargo group across 1 directory#6
dependabot[bot] wants to merge 221 commits into
mainfrom
dependabot/cargo/ai/cargo-2368e972e4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown

Bumps the cargo group with 1 update in the /ai directory: rustls-webpki.

Updates rustls-webpki from 0.103.9 to 0.103.11

Release notes

Sourced from rustls-webpki's releases.

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correctly provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @​1seal for the report.

What's Changed

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

Commits
  • 57bc62c Bump version to 0.103.11
  • d0fa01e Allow parsing trust anchors with unknown criticial extensions
  • 348ce01 Prepare 0.103.10
  • dbde592 crl: fix authoritative_for() support for multiple URIs
  • 9c4838e avoid std::prelude imports
  • 009ef66 fix rust 1.94 ambiguous panic macro warnings
  • c41360d build(deps): bump taiki-e/cache-cargo-install-action from 2 to 3
  • e401d00 generate.py: reformat for black 2026.1.0
  • 06cedec Take semver-compatible deps
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

- Rename package from "@user_name/module_name" to "lenix"
- Remove keywords "fivem" from package.json
- Correct README filename capitalization from "README.md" to "Readme.md"
- Remove unused devDependencies including esbuild, @citizenfx, @Trippler libraries, and rimraf
- Simplify devDependencies to only keep typescript version 5.0.0
- Update rebuild script by removing reinstall command line commented out code
…guration

- Remove individual client, server, shared, and web source folders and build targets
- Replace multiple build scripts with a single build command using unified tsconfig
- Change output directory to 'dist' and set main entry points to files in 'dist'
- Update .gitignore and .npmignore to match new lock file patterns and remove old source folders
- Simplify package.json exports and files for npm packaging
- Remove redundant tsconfig files from subdirectories and update root tsconfig settings
- Export a default object from new src/index.ts as entry point
- Upgrade TypeScript and add @types/node dependency
- Changed repository URL from HTTP to git+HTTPS protocol
- Added .git suffix to the repository URL for proper cloning
- Ensured URL matches standard npm package.json repository syntax
- Add fxmanifest.json with version, game, client and server scripts configuration
- Implement index.ts to generate fxmanifest.lua from fxmanifest.json content
- Support arrays and strings to format Lua manifest file content
- Add tsconfig.json with bundler module resolution and JSON module support for fxmanifest folder
- Added module name and brief description
- Included npm download and version badges
- Provided installation commands for npm, pnpm, bun, and yarn
- Added documentation status section
- Added GitHub repository link with badge
- Included roadmap placeholder
- Added license badge
- Provided Discord support link with badge
- Added badges for TypeScript and Node.js usage
- Create bin/lua_modules.sh to set up Lua module paths in shell config
- Support bash (.bashrc) and zsh (.zshrc) configuration files
- Check for existing setup to avoid duplicate additions
- Prompt user for confirmation before modifying shell config
- Append necessary export and eval lines for LuaRocks paths
- Provide usage instructions and undo information after setup completion
- Add executable script `lenix-lua_modules` to auto-configure Lua modules path
- Update package.json to include bin entry and related keywords
- Add README with install instructions, usage examples, and description
- Modify .npmignore to include the new bin directory and exclude LICENSE file
- Updated command name from lenix-lua_modules to lenix-lua-modules in package.json
- Changed references in Readme.md to use the new command name
- Modified script path format for consistency in package.json bin field
- Rename lua_modules.sh to mac-lua_modules.sh for clarity
- Update package.json to reflect new script name
- Add shell config file touch command to ensure file existence before use
- Change installation command from npx lenix-lua-modules to npx mac-lua-modules
- Specify environment variable setup is for mac users in shell configs
- Adjust formatting and clarifications in README instructions
- Detect actual user shell to select correct config file (.zshrc or .bashrc)
- Add support for .bash_profile sourcing .bashrc in Bash environments
- Create shell config file if it does not exist before appending
- Append end marker comment for Lua module setup in shell config
- Provide clearer instructions to restart terminal for changes to take effect
- Simplify completion message about modifications made to shell config
- Use shell-specific variables for more reliable shell detection
- Set default shell config to ~/.profile when other shells are undetected
- Simplify checks for existing installations in shell config
- Ensure .bash_profile sources .bashrc only if not already configured
- Remove emoji characters from terminal messages for clarity
- Adjust script messages for consistent formatting and readability
- Deleted unnecessary "# Lua local modules setup" echo statement
- Cleaned up script output for better readability
- Retained environment variable exports without changes
- Rename class properties from dataX to propertyX for clearer semantics
- Add new properties with nil values to test syntax error handling
- Change function properties to methodX naming for better distinction
- Reorder properties and methods for improved readability
- Update getter and setter names to match new property names
- Move example files to _dev directory to separate development code
… property flags

- Added <const> annotations to local variables for better immutability guarantees
- Updated property7, property8, property9, property12, and method3 flags from booleans to named constants
- Improved code readability and maintainability by replacing magic booleans with descriptive keywords
- Ensured consistency in property and method declarations within the class annotation tests section
- Added .DS_Store pattern to .gitignore to exclude macOS system files
- Retained existing ignore patterns for node modules and lock files
- Introduce wait function to delay execution by given milliseconds
- Export wait function from main index for external usage
- Change createFxmanifest export to named export for consistency
- Enhance tsconfig with moduleResolution, baseUrl, and path mappings
- Maintain strict mode and output directory configuration unchanged
- Add project description in package.json
- Expand keywords list for better discoverability
- Change export statement to explicitly export 'wait' from './wait' in index.ts
jonahmr1 and others added 24 commits April 3, 2026 17:32
Bumps the cargo group with 1 update in the /ai directory: [rustls-webpki](https://github.com/rustls/webpki).


Updates `rustls-webpki` from 0.103.9 to 0.103.11
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.9...v/0.103.11)

---
updated-dependencies:
- dependency-name: rustls-webpki
  dependency-version: 0.103.11
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Apr 13, 2026
@jonahmr1
jonahmr1 force-pushed the main branch 2 times, most recently from 89257d5 to 7270e50 Compare July 24, 2026 16:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant