[storopoli]

Description

Update three TLS crates in Cargo.lock to fix open RustSec advisories:

Crate	Change	Advisories
rustls-webpki	0.103.15 → 0.103.16	RUSTSEC-2026-0382
webpki-root-certs	1.0.9 → 1.0.10	RUSTSEC-2026-0383
rustls	0.23.45 → 0.23.46	RUSTSEC-2026-0346, -0347, -0348, -0349

RUSTSEC-2026-0382 and -0383 come from the same incident: the private keys of some distrusted emSign intermediates are now public, and the old versions can still accept certificate paths through them. The rustls advisories are separate. They are why the cargo-audit job on main has been failing since Oct 19.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature/Enhancement (non-breaking change which adds functionality or enhances an existing one)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor
• New or updated tests
• Dependency update
• Security fix

Notes to Reviewers

Only the three package versions and checksums in Cargo.lock change. No transitive dependencies were added or removed. All three crates come in through jsonrpsee in strata-rpc-tracing, so no manifest changes are needed. Downstream repos have to update their own lockfiles to pick up the fixes.

The patched versions are less than 14 days old, so the update used the documented urgent cooldown override:

CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p rustls-webpki@0.103.15 --precise 0.103.16
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p webpki-root-certs@1.0.9 --precise 1.0.10
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p rustls@0.23.45 --precise 0.23.46

Validation used the pinned nightly-2026-07-01 toolchain:

• cargo audit (cargo-audit 0.22.2, current RustSec database) reports all six advisories on main and no vulnerabilities with this lockfile. Both scans report the same four warnings for ansi_term, bincode, paste, and scc.
• cargo clippy --examples --tests --benches --all-features --all-targets --locked passed.
• cargo nextest run --workspace --all-features --locked passed 674 of 674 tests.
• cargo test --doc --all-features --locked passed.
• Not run: cargo hack --each-feature (not installed locally; strata-rpc-tracing has no features), cargo fmt, and taplo, since no Rust or TOML sources changed.

No new tests were added for these upstream dependency fixes. The before/after audit shows the vulnerable versions are gone.

Checklist

• I have performed a self-review of my code.
• I have commented my code where necessary.
• I have updated the documentation if needed.
• My changes do not introduce new warnings.
• I have added tests that prove my changes are effective or that my feature works.
• New and existing tests pass with my changes.

Related Issues

RUSTSEC-2026-0382, RUSTSEC-2026-0383, RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349

Same fix in alpen: alpenlabs/alpen#2410

[github-actions]

🔒 AI Security Review (claude-opus-5-5)

✅ No security issues found.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T15:28:47.334953Z	c051b19	PR opened
🔒 Security Review	✅ Completed 2026-10-21T15:30:34.657687Z	c051b19	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[storopoli]

Force-merging this