From 0d1a5c210b877f89bcb87e6f1d8584396d12f208 Mon Sep 17 00:00:00 2001
From: "ilblackdragon@gmail.com" <ilblackdragon@gmail.com>
Date: Fri, 20 Mar 2026 20:44:13 -0700
Subject: [PATCH] fix(deps): patch rustls-webpki vulnerability
 (RUSTSEC-2026-0049)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update rustls-webpki 0.103.9 → 0.103.10. Exempt 0.102.8 which is
pinned by libsql's transitive dependency on an older rustls chain.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 Cargo.lock | 14 +++++++-------
 deny.toml  |  2 ++
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2c5547e0..151edd69 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2339,7 +2339,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5575,7 +5575,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5624,7 +5624,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.9",
+ "rustls-webpki 0.103.10",
  "subtle",
  "zeroize",
 ]
@@ -5696,9 +5696,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -6479,10 +6479,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/deny.toml b/deny.toml
index 80aa2215..fddb3d43 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,6 +15,8 @@ ignore = [
     "RUSTSEC-2026-0020",
     # wasmtime wasi:http/types.fields panic — mitigated by fuel limits
     "RUSTSEC-2026-0021",
+    # rustls-webpki CRL distributionPoint matching — 0.102.8 pinned by libsql transitive dep
+    "RUSTSEC-2026-0049",
 ]
 
 [licenses]