[TechnoFinch]

What changed

Cargo.lock only (minimal targeted update, no blanket cargo update):

• webpki-roots: 1.0.2 -> 1.0.10 (the 0.26.11 entry is a wrapper around 1.x, so it now picks up 1.0.10)
• rustls-webpki: 0.103.4 -> 0.103.16

Why

CVE-2026-111943 / RUSTSEC-2026-0383: the compromised eMudhra emSign ECC Root CA - G3 is removed in webpki-roots >= 1.0.10, and rustls-webpki 0.103.16 is the patched verifier.

• https://osv.dev/vulnerability/RUSTSEC-2026-0383

Verification

• cargo check --locked passes locally. Tests run in CI.

Deploy note

This only takes effect after a rebuild and redeploy of anything built from this repo.

Needs owning-team verification

• All affected crates in Cargo.lock are at fixed versions; no EOL rustls-webpki 0.101/0.102 and no aws-lc-sys in the tree.
• reqwest 0.12 is used with default features, so HTTPS goes through native-tls (OpenSSL / OS trust store), not webpki-roots. The owning team should make sure the runtime/base image has an updated ca-certificates package without the eMudhra emSign ECC Root CA - G3, then rebuild and redeploy.

[broly-code-security-scanner]

Broly Security Scan

Note

Summary

3 actionable finding(s) in this PR

• 🟡 3 medium

Main table: 3 shown, 0 omitted of 3 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟡 MEDIUM	SCA	RUSTSEC-2024-0436: paste@1.0.15	Cargo.lock:1	d7	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	RUSTSEC-2025-0119: number_prefix@0.4.0	Cargo.lock:1	d6	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	RUSTSEC-2026-0204: crossbeam-epoch@0.9.18 → >= 0.9.20	Cargo.lock:1	d4	🔺 TRUE_POSITIVE · Confidence: MEDIUM

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d4 · 🟡 MEDIUM   · Cargo.lock:1 · RUSTSEC-2026-0204: crossbeam-epoch@0.9.18
• d6 · 🟡 MEDIUM   · Cargo.lock:1 · RUSTSEC-2025-0119: number_prefix@0.4.0
• d7 · 🟡 MEDIUM   · Cargo.lock:1 · RUSTSEC-2024-0436: paste@1.0.15

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

 

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.