security(deps): bump rustls-webpki->0.103.13 (GHSA-82j2-j2ch-gfr8, HIGH)

[hyperpolymath]

What

Lockfile-only bump of rustls-webpki from 0.103.12 -> 0.103.13 in Cargo.lock. No Cargo.toml changes, no parent-crate major/breaking bumps.

Why

Resolves GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104 — a denial-of-service in rustls-webpki triggered by a malformed CRL BIT STRING. CVSS 7.5 (HIGH). Vulnerable: < 0.103.13; fixed in 0.103.13.

This resolves the repo's open Dependabot alert for this advisory. Dependabot did not auto-open a PR because rustls-webpki is a transitive / lockfile-only dependency (pulled in via reqwest/rustls), so the fix is a pure Cargo.lock update with no manifest constraint to bump.

Residual

None. After the bump there are no remaining rustls-webpki copies < 0.103.13 in the lockfile (single copy, now 0.103.13).

Provenance / safety

• The commit is ssh-signed with the maintainer's signing key.
• Branch cut from fresh origin/main via a new clone (not a local working copy).
• Only Cargo.lock is changed.

Security PR -> manual review, do not auto-merge.

Generated with Claude Code.

[github-actions]

🔍 Hypatia Security Scan

Findings: 50 issues detected

Severity	Count
🔴 Critical	1
🟠 High	11
🟡 Medium	38

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "No test directory or test files found",
    "type": "no_tests",
    "file": "/home/runner/work/formatrix-docs/formatrix-docs",
    "action": "flag",
    "rule_module": "honest_completion",
    "severity": "high",
    "deduction": 20
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence