Summary

• Updates the Rustls dependency stack so rustls-webpki resolves to patched 0.103.13.
• Migrates certificate, key, root store, and server-name usage to Rustls 0.23 APIs.
• Covers Dependabot alerts:
  • https://github.com/warpdotdev/async-tls/security/dependabot/1
  • https://github.com/warpdotdev/async-tls/security/dependabot/2
  • https://github.com/warpdotdev/async-tls/security/dependabot/3

Vulnerabilities

• GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104: rustls-webpki denial of service via panic on malformed CRL BIT STRING
  • Advisory: GHSA-82j2-j2ch-gfr8
  • Severity: high
  • Patched version: 0.103.13
• GHSA-965h-392x-2mh5 / RUSTSEC-2026-0098: webpki URI name constraints incorrectly accepted
  • Advisory: GHSA-965h-392x-2mh5
  • Severity: low
  • Patched version: 0.103.12
• GHSA-xgp8-3hg3-c2mh / RUSTSEC-2026-0099: webpki wildcard name constraints incorrectly accepted
  • Advisory: GHSA-xgp8-3hg3-c2mh
  • Severity: low
  • Patched version: 0.103.12

Changes

• rustls: 0.21 -> 0.23
• rustls-pemfile: 1.0 -> 2.2
• rustls-webpki: 0.101.4 -> 0.103.13
• webpki-roots: 0.22.3 -> 1.0
• Updated direct and transitive Rustls usage so cargo tree --all-features -i rustls-webpki resolves only rustls-webpki v0.103.13.

Verification

• cargo fmt --check
• cargo build --all-features
• cargo test --all-features
• cargo audit (no rustls-webpki vulnerability reported; existing allowed warnings remain for async-std and rustls-pemfile unmaintained advisories)

Conversation: https://staging.warp.dev/conversation/4c886604-4fe8-423f-b872-ee47b09f53d0
Run: https://oz.staging.warp.dev/runs/019e3184-23a2-70e5-b795-0116e7119a7f
This PR was generated with Oz.