Bump rustls-webpki from 0.103.9 to 0.103.10 in the cargo group across 1 directory by dependabot[bot] · Pull Request #10 · hack-ink/voxit

dependabot · 2026-04-05T17:31:08Z

Bumps the cargo group with 1 update in the / directory: rustls-webpki.

Updates rustls-webpki from 0.103.9 to 0.103.10

Release notes

Sourced from rustls-webpki's releases.

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correctly provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @1seal for the report.

What's Changed

Freshen up rel-0.103 by @ctz in rustls/webpki#455

Prepare 0.103.10 by @ctz in rustls/webpki#458

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

Commits

348ce01 Prepare 0.103.10
dbde592 crl: fix authoritative_for() support for multiple URIs
9c4838e avoid std::prelude imports
009ef66 fix rust 1.94 ambiguous panic macro warnings
c41360d build(deps): bump taiki-e/cache-cargo-install-action from 2 to 3
e401d00 generate.py: reformat for black 2026.1.0
06cedec Take semver-compatible deps
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…packages workspace; pure GUI; permissions/audio fixes; cleanup","intent":"move Voxit to apps/+packages structure and remove unused CLI/root crate artifacts","impact":"improves macOS permission onboarding, fixes recording init error, updates CI/scripts/docs for workspace","breaking":false,"risk":"medium","refs":[]}

…bar UX, auth caching, launch fallback, and keychain flow hardening","intent":"align first-login auth/tray behavior with macOS conventions while reducing keychain friction and improving local dev launch reliability","impact":"adds tray menu Preferences/Quit shortcuts, async auth status refresh, keychain session cache, and robust bundle-open fallback; keeps keychain-first persistence","breaking":false,"risk":"medium","refs":[]}

…buttons based on sign-in state","intent":"avoid showing redundant sign-in/sign-out actions in the settings UI","impact":"only shows Sign out when signed in, and sign-in buttons when signed out","breaking":false,"risk":"low","refs":[]}

…heck buttons when permissions granted","intent":"let users re-validate permissions even after onboarding is complete","impact":"Accessibility and Input Monitoring re-check buttons stay enabled when permissions are already granted","breaking":false,"risk":"low","refs":[]}

…ermissions UI","intent":"remove re-check style onboarding and avoid prompting automatically","impact":"permissions are checked on startup and when opening Preferences; only missing permissions show Request buttons","breaking":false,"risk":"low","refs":[]}

…ermissions and harden mic request","intent":"show permission status without manual recheck buttons and avoid crash when requesting microphone permission","impact":"permissions are refreshed on Preferences open and before recording; Request buttons appear only when missing; mic request keeps completion handler alive","breaking":false,"risk":"medium","refs":[]}

…h when requesting permissions","intent":"make permission request paths safe and debuggable","impact":"adds structured logs for permission requests; avoids calling AVFoundation APIs when AVMediaTypeAudio symbol is unavailable","breaking":false,"risk":"medium","refs":[]}

…bundle plist injection and auth token cache","intent":"prevent permission-request restart and repeated keychain prompts","impact":"adds cargo-bundle v0.9 plist ext wiring and in-memory token caching after keychain load","breaking":false,"risk":"medium","refs":[]}

…-format use nightly rustfmt","intent":"avoid stable rustfmt diffs with nightly-only rustfmt config","impact":"overrides cargo-make built-in check-format tasks to run nightly rustfmt so fmt checks match CI","breaking":false,"risk":"low","refs":[]}

… makefile format aliases with rsnap","intent":"remove-project-specific-check-format-overrides","impact":"standardize-format-interface-to-fmt-check","breaking":false,"risk":"low","refs":[]}

…ve unused CoreFoundation aliases","intent":"drop dead type aliases from macos FFI module","impact":"no runtime behavior change; removes dead type aliases causing compile warnings","breaking":false,"risk":"low","refs":[]}

…sh permission state and drop input monitoring","intent":"poll after request until state changes and simplify permission model","impact":"permissions panel updates without manual clicks; input monitoring path removed from UI and macOS permission API","breaking":false,"risk":"low","refs":[]}

…ingleflight + audio device init","intent":"avoid duplicate keychain prompts and handle explicit mic devices","impact":"start dictation no longer fails with Invalid property; reduce repeated keychain reads; apply required lint fixes","breaking":false,"risk":"medium","refs":[]}

…th status on visible window","intent":"avoid stuck Checking auth when UI starts visible","impact":"auth status updates without requiring reopening Preferences","breaking":false,"risk":"low","refs":[]}

…ground keychain read for auth status","intent":"prevent auth status from hanging when keychain UI can\u0027t prompt","impact":"Auth label updates immediately when window is visible","breaking":false,"risk":"low","refs":[]}

… check until window visible","intent":"avoid keychain auth check starting while UI hidden","impact":"Auth status should no longer stick on Checking auth after opening Preferences","breaking":false,"risk":"low","refs":[]}

…ychain auth reads","intent":"avoid indefinite auth status hang when keychain prompts","impact":"auth status check returns within bounded time instead of sticking on Checking auth","breaking":false,"risk":"medium","refs":[]}

…ile async auth runs","intent":"Prevent UI from stalling on Checking auth when window is shown","impact":"Auth status and async tasks update without user interaction","breaking":false,"risk":"low","refs":[]}

…ychain prompt for auth","intent":"Run stored-auth keychain reads on UI thread so macOS prompts appear","impact":"Auth no longer stalls silently; keychain prompt can be approved and status updates","breaking":false,"risk":"medium","refs":[]}

…cs and clippy standards","intent":"Transfer the vibe-mono docs routing and clippy policy into voxit and remove the redundant Dependabot labels comment","impact":"Docs routing, docs/plans semantics, centralized clippy policy, and Dependabot config wording are standardized","breaking":false,"risk":"medium","refs":[]}

…header contract","intent":"Bring the Voxit v1 spec header into the current spec document contract without changing the plan docs","impact":"The normative spec now advertises the required routing header fields expected by the repository docs standard","breaking":false,"risk":"low","refs":[]}

… vibe-mono ignore baselines","intent":"Align the root gitignore and taplo exclusions with the current vibe-mono baseline","impact":"Ignore ordering and workspace exclusion rules now match vibe-mono for this repo","breaking":false,"risk":"low","authority":"linear","delivery_mode":"status-only","refs":[]}

…y lint-fix fallout cleanup","intent":"Keep the repo consistent with cargo make lint-fix output after the config sync","impact":"Import ordering derive order and dependency metadata are normalized across the workspace","breaking":false,"risk":"medium","authority":"linear","delivery_mode":"status-only","refs":[]}

… taplo exclusions with vibe-mono","intent":"Align voxit taplo excludes with the current vibe-mono ignore surface","impact":"Taplo formatting skips the same generated and ignored paths that vibe-mono excludes","breaking":false,"risk":"low","authority":"linear","delivery_mode":"status-only","refs":[]}

… unused multipart import","intent":"Keep voxit-core aligned with cargo make lint-fix after the taplo sync","impact":"OpenAI client code no longer keeps an unused multipart self import","breaking":false,"risk":"low","authority":"linear","delivery_mode":"status-only","refs":[]}

Bumps the cargo group with 1 update in the / directory: [rustls-webpki](https://github.com/rustls/webpki). Updates `rustls-webpki` from 0.103.9 to 0.103.10 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.9...v/0.103.10) --- updated-dependencies: - dependency-name: rustls-webpki dependency-version: 0.103.10 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-05T17:37:13Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

yvette-carlisle and others added 27 commits February 27, 2026 22:47

Initial commit

415506a

{"schema":"cmsg/1","type":"chore","scope":"makefile","summary":"Align…

3c19a4b

… makefile format aliases with rsnap","intent":"remove-project-specific-check-format-overrides","impact":"standardize-format-interface-to-fmt-check","breaking":false,"risk":"low","refs":[]}

{"schema":"cmsg/1","type":"fix","scope":"voxit","summary":"refresh au…

4bdc2b0

…th status on visible window","intent":"avoid stuck Checking auth when UI starts visible","impact":"auth status updates without requiring reopening Preferences","breaking":false,"risk":"low","refs":[]}

{"schema":"cmsg/1","type":"fix","scope":"voxit","summary":"repaint wh…

333fce2

…ile async auth runs","intent":"Prevent UI from stalling on Checking auth when window is shown","impact":"Auth status and async tasks update without user interaction","breaking":false,"risk":"low","refs":[]}

dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Apr 5, 2026

dependabot bot added the rust Pull requests that update rust code label Apr 5, 2026

aurexav closed this Apr 5, 2026

aurexav force-pushed the main branch from b667c59 to b9d6b44 Compare April 5, 2026 17:37

dependabot bot deleted the dependabot/cargo/cargo-64b2a50fd2 branch April 5, 2026 17:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump rustls-webpki from 0.103.9 to 0.103.10 in the cargo group across 1 directory#10

Bump rustls-webpki from 0.103.9 to 0.103.10 in the cargo group across 1 directory#10
dependabot[bot] wants to merge 27 commits intomainfrom
dependabot/cargo/cargo-64b2a50fd2

dependabot bot commented on behalf of github Apr 5, 2026

Uh oh!

dependabot bot commented on behalf of github Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot bot commented on behalf of github Apr 5, 2026

0.103.10

What's Changed

Uh oh!

dependabot bot commented on behalf of github Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants