Repository navigation
fix: update rustls-webpki and webpki-roots for emSign advisories - #3496
Merged
kevinjqliu merged 2 commits intoOct 20, 2026
Merged
Conversation
Bump rustls-webpki to 0.103.16 and webpki-roots / webpki-root-certs to 1.0.10 to address RUSTSEC-2026-0382, RUSTSEC-2026-0381 and RUSTSEC-2026-0383. Ignore RUSTSEC-2026-0381 for the webpki-roots 0.26.11 shim pulled in by sqlx-core 0.8.6, which re-exports the fixed 1.0.10. Co-authored-by: Isaac <no-reply@databricks.com>
kevinjqliu
approved these changes
Oct 20, 2026
kevinjqliu
left a comment
Contributor
There was a problem hiding this comment.
ty, another day another advisory 😭
Contributor
Author
|
dhruvarya-db
marked this pull request as ready for review
October 20, 2026 21:00
…6-0381 The SQL catalog tests only use SQLite, so the tls-rustls feature on the sqlx dev-dependency is unused. Removing it drops webpki-roots from the lockfile, so the audit ignore is no longer needed. Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
@dhruvarya-db - it's a published PR limit, instead of closing you also can move some of PR-s back to "Draft" mode |
kevinjqliu
pushed a commit
to kevinjqliu/iceberg-rust
that referenced
this pull request
Oct 20, 2026
…che#3496) * fix: update rustls-webpki and webpki-roots for emSign advisories Bump rustls-webpki to 0.103.16 and webpki-roots / webpki-root-certs to 1.0.10 to address RUSTSEC-2026-0382, RUSTSEC-2026-0381 and RUSTSEC-2026-0383. Ignore RUSTSEC-2026-0381 for the webpki-roots 0.26.11 shim pulled in by sqlx-core 0.8.6, which re-exports the fixed 1.0.10. Co-authored-by: Isaac <no-reply@databricks.com> * fix: drop unused sqlx TLS dev feature instead of ignoring RUSTSEC-2026-0381 The SQL catalog tests only use SQLite, so the tls-rustls feature on the sqlx dev-dependency is unused. Removing it drops webpki-roots from the lockfile, so the audit ignore is no longer needed. Co-authored-by: Isaac <no-reply@databricks.com> --------- Co-authored-by: Dhruv Arya <aryadhruv@gmail.com> Co-authored-by: Isaac <no-reply@databricks.com>
kevinjqliu
added a commit
to dannycjones/iceberg-rust
that referenced
this pull request
Oct 27, 2026
… advisories Lockfile bumps from main, at main's versions: - quinn-proto 0.11.19 (apache#3425) - rustls 0.23.46, with aws-lc-rs 1.18.1 and aws-lc-sys 0.45.0 (apache#3455) - rustls-webpki 0.103.16, webpki-roots and webpki-root-certs 1.0.10 (apache#3496) - ctutils 0.4.5 (apache#3519) Co-authored-by: Danny C Jones <djonesoa@amazon.com> Co-authored-by: Kevin Liu <kevin.jq.liu@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
N/A.
security_auditstarted failing onmainand on open PRs after RustSec published three advisories for the distrusted emSign certificates (CVE-2026-111943).What changes are included in this PR?
Updates
rustls-webpkito 0.103.16 andwebpki-root-certsto 1.0.10, which addresses RUSTSEC-2026-0382 and RUSTSEC-2026-0383.RUSTSEC-2026-0381 flags
webpki-roots, including the 0.26.11 release pulled in bysqlx-core0.8.6. A lockfile bump can't clear that one: 0.26.11 is the final 0.26.x release.webpki-rootswas only enabled by thetls-rustlsfeature on thesqlxdev-dependency oficeberg-catalog-sql, and the SQL catalog tests only use SQLite, which doesn't use TLS. This PR removes that feature, which dropswebpki-rootsfrom the lockfile entirely, so no audit ignore is needed.Are these changes tested?
Validated with
cargo audit(no findings, no new ignores),cargo metadata --locked --format-version 1,cargo check --workspace --all-targets --locked, and theiceberg-catalog-sqltests plus the SQL catalog cases oficeberg-catalog-loader.AI Disclosure
Written with Claude Opus 5.5 and reviewed by me. Worth a reviewer's check: that no test or local workflow relies on the
sqlxdev-dependency having TLS enabled (for example, running the SQL catalog tests against a TLS-enabled Postgres or MySQL).