[zoeyrose]

Summary

Fix the default-branch security CI failure for RUSTSEC-2026-0382 by updating the locked rustls-webpki dependency from 0.103.15 to 0.103.16.

Implementation / behavior

Intent: restore passing security validation and consume the upstream fix that rejects certificate paths containing distrusted intermediate public keys. The change is limited to the compatible dependency version and checksum in Cargo.lock; it does not change manifests, advisory policy, or CI.

The affected chain remains atrinik-client → atrinik-directory → ureq 3.5.0 → rustls 0.23.46 → rustls-webpki 0.103.16.

Validation

• Verified the original failure in default-branch run 41198246373 and the official RustSec patched-version range.
• Generated with cargo update -p rustls-webpki --precise 0.103.16; verified the resolved chain with cargo tree --locked -i rustls-webpki.
• Full tools/validate.sh passed in the immutable Linux build image with isolated caches, 2 CPUs, and 4 GiB memory: 82 Python tests, 71 Rust tests, doc tests, strict Clippy/formatting, architecture checks, licenses/bans/sources, advisories without a base-revision exemption, headless and SDL dummy-window smoke, reproducible packages, and SBOM checks.
• git diff --check passed. Fresh-context independent review of the exact head found no P0–P3 findings; its receipt is posted.
• Current-head dependency-review logs report only the intended dependency update and no detected vulnerabilities or denied packages.

Limitations / follow-up

Application changes, advisory exceptions, releases, deployments, and merge are outside this PR. The dependency-review job-summary body was not exposed through the available API/public workflow page; the current-head job logs and check result were inspected.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• Cargo.lock

[zoeyrose]

Independent fresh-context review (GPT-6.1 Sol, high reasoning) covered the complete diff from ebdda65 to 5c4aace and affected Cargo graph, upstream implementation, and client TLS/error paths.

No P0–P3 findings. The reviewer verified the only changes are rustls-webpki 0.103.15 to 0.103.16 and its checksum; checked compatible dependency constraints, Rust/MSRV and licensing; matched the downloaded crate checksum and all 36 unpacked files; inspected upstream distrust enforcement and regression tests; and verified TLS failures remain failures without verification bypasses or new concurrency state. The official RustSec advisory identifies 0.103.16 as patched. Local and live PR heads were verified.

No fixes or declined findings were required. git diff --check passed and the working tree was clean. The reviewer did not independently run the aggregate suite or live certificate handshakes; the owning session is running the repository aggregate in the pinned isolated worker, and CI remains a separate readiness requirement.