fix(deps): resolve RUSTSEC-2026-0098 and RUSTSEC-2026-0099 — bump rustls-webpki and rumqttc#5786
Conversation
… ignore RUSTSEC-2026-0098/0099 - rumqttc 0.24 → 0.25.1: removes rustls 0.22.4 and tokio-rustls 0.25.0 from the dependency tree - rustls-webpki 0.103.10 → 0.103.12: resolves RUSTSEC-2026-0098 and RUSTSEC-2026-0099 for the 0.103.x chain - audit.toml: ignore RUSTSEC-2026-0098 and RUSTSEC-2026-0099 for the 0.102.x chain (rumqttc 0.25.1 still pins rustls-webpki ^0.102; no upstream release with fix available)
singlerider
requested review from
JordanTheJet and
theonlyhennygod
as code owners
github-actions
bot
added
the
dependencies
singlerider
added
risk: low
There was a problem hiding this comment.
Review — PR #5786 fix(deps): resolve RUSTSEC-2026-0098 and RUSTSEC-2026-0099
Reviewer: WareWolf-MoonWall
RFC authority: RFC #5653 (Zero Compromise in Practice)
✅ Commendation
This PR immediately unblocked every open PR in the repository that had been held by the ambient Security Audit failure. That's the right prioritization — fixing the repo-wide blocker before it accumulates more PRs behind it.
The approach is also well-scoped. Two distinct dep chains were affected by the same advisory batch:
- The 0.103.x chain (
rustls-webpki 0.103.10 → 0.103.12) — fully resolved with acargo update. Clean, no trade-offs. - The 0.102.x chain (
rustls-webpki ^0.102pinned byrumqttc) —rumqttc 0.24 → 0.25.1removes the oldrustls 0.22.4/tokio-rustls 0.25.0shadow dep tree entirely, and adds RUSTSEC-2026-0098/0099 toaudit.tomlwith explicit justification and upstream issue reference. That is the correct response when the fix exists upstream but the upstream maintainer hasn't shipped a release yet.
The lockfile deduplication is a side benefit worth naming: bumping rumqttc eliminated duplicate versions of core-foundation, openssl-probe, security-framework, rustls-native-certs, and tokio-rustls — 5 crates that previously resolved to two versions each. 118 lines removed from the lockfile, all noise.
The audit.toml comments are well-structured: each advisory has a reason and an upstream tracking reference. Future maintainers can confirm RUSTSEC-2026-0049/0098/0099 are still justified or remove them when the rumqttc fix ships.
CI summary
| Gate | Result |
|---|---|
| Security Audit | ✅ SUCCESS — 0 vulnerabilities |
| Security Required Gate | ✅ SUCCESS |
| Lint / Strict Delta Lint | ✅ SUCCESS |
| Docs Quality | ✅ SUCCESS |
| Check (32-bit / all features) | ✅ SUCCESS |
| Test | ✅ SUCCESS |
| Verify Benchmarks Compile | ✅ SUCCESS |
| Build (linux/mac completed) | ✅ SUCCESS |
| Build (win/aarch64) | ⏳ in-progress |
| Validate Release Readiness | ❌ FAILURE — see note below |
⚙️ Team Decision — Validate Release Readiness workflow design gap
The failure is in the Check required secrets exist step of .github/workflows/pre-release-validate.yml. The step checks for CARGO_REGISTRY_TOKEN, AUR_SSH_KEY, and Homebrew tokens unconditionally, but those secrets are not available to PR-triggered runs — only to workflow_dispatch. The workflow triggers on pull_request: paths: ["Cargo.toml"], so every dep bump PR that touches the root Cargo.toml will trip this check.
The Check crates.io publishability step already has the right guard:
if: github.event_name == 'workflow_dispatch'The Check required secrets exist and Check PAT access to downstream repos steps need the same condition. This is a pre-existing design gap not introduced by this PR. It should be fixed in a follow-up chore(ci) patch so future Cargo.toml-touching PRs don't need to explain the same false failure.
This failure does not block merging this PR.
MQTT API compatibility
The MQTT surface in zeroclaw uses MqttOptions, AsyncClient, Event, Packet, QoS, and Transport — all stable core API in rumqttc. The async client interface is unchanged in 0.25.1. The PR description's claim of "no breaking API changes" is consistent with what's in source.
Summary
Clean security dep bump. Both advisory chains are resolved or correctly documented with justification. The lockfile is cleaner as a result. Security Audit is now green for the first time since RUSTSEC-2026-0098/0099 were published, unblocking the rest of the open PRs in the queue.
The only open item is the Validate Release Readiness workflow design gap — a chore-level CI fix that should be tracked separately.
Approved. ✅
URI name constraint bypass — affects every HTTPS client in the tree (LLM providers via reqwest, wecom_ws WebSocket via tokio-tungstenite, email via lettre). Lockfile-only bump; no Cargo.toml change. Also shifts prost-build's transitive heck from 0.5.0 to 0.4.1 (both versions remain resolved for different consumers; benign resolver share-the-lock). Related upstream: 1f24cbd (zeroclaw-labs#5786) — we skip the rumqttc bump and audit.toml edits since master_wecom has no MQTT.
2 participants
Summary
masterfor all contributions):masterrustls-webpkifor incorrectly accepting URI name constraints in certificate validation. Two dep chains were affected:rustls-webpki 0.103.10(viarustls 0.23) andrustls-webpki 0.102.8(viarumqttc). Both were blocking CI Security Audit and Security Required Gate on every open PR.rustls-webpki 0.103.10 → 0.103.12viacargo update— fully resolves both advisories for the0.103.xchain. (2)rumqttc 0.24 → 0.25.1— removesrustls 0.22.4andtokio-rustls 0.25.0from the dep tree, reduces overall dep count. (3)audit.toml: added RUSTSEC-2026-0098 and -0099 to the ignore list for the0.102.xchain —rumqttc 0.25.1still directly pinsrustls-webpki ^0.102with no upstream fix yet (RUSTSEC-2026-0098 and RUSTSEC-2026-0099 are being triggered bycargo-denyfor this crate bytebeamio/rumqtt#1046, filed 2026-04-15, no maintainer response; existing rustls bump PR chore(deps): bump rustls-webpki and tokio-rustls bytebeamio/rumqtt#1037 has been stalled for 3+ weeks); updated comment from "via rumqttc 0.24" to "via rumqttc 0.25.1".Cargo.tomlversion declarations only.Label Snapshot (required)
risk: low|medium|high):risk: lowsize: XS|S|M|L|XL, auto-managed/read-only): autodependencies,securityChange Metadata
bug|feature|refactor|docs|security|chore):securityruntime|provider|channel|memory|security|ci|docs|multi):securityLinked Issue
cargo-denyfor this crate bytebeamio/rumqtt#1046 — upstream issue tracking rumqttc'srustls-webpki ^0.102pinSupersede Attribution (required when
Supersedes #is used)N/A
Validation Evidence (required)
Security Impact (required)
Yes/No): NoYes/No): NoYes/No): NoYes/No): NoYes, describe risk and mitigation: N/APrivacy and Data Hygiene (required)
pass|needs-follow-up): passCompatibility / Migration
Yes/No): YesYes/No): NoYes/No): Noi18n Follow-Through (required when docs or user-facing wording changes)
Yes/No): NoHuman Verification (required)
cargo auditpasses with 0 vulnerabilities locally.cargo clippy,cargo fmt,cargo testall clean on the bumped dep set.rumqttc 0.25.1still pinsrustls-webpki ^0.102(checked lockfile and RUSTSEC-2026-0098 and RUSTSEC-2026-0099 are being triggered bycargo-denyfor this crate bytebeamio/rumqtt#1046) — theaudit.tomlignore is necessary and documented.rumqttc 0.25.1vs 0.24 — the changelog shows no breaking API changes for the async client interface used here.Side Effects / Blast Radius (required)
zeroclaw-channels,zeroclaw-runtime) picks up rumqttc 0.25.1. No API changes.Agent Collaboration Notes (recommended)
cargo update(fixed 0.103.x chain) → attempted rumqttc upgrade (removed old rustls 0.22 chain but 0.102.8 remains) → confirmed no upstream fix available (RUSTSEC-2026-0098 and RUSTSEC-2026-0099 are being triggered bycargo-denyfor this crate bytebeamio/rumqtt#1046 filed yesterday, PR fix(channel): avoid false 300s timeout during multi-turn tool loops #1037 stalled 3+ weeks) → added to audit ignore list with justificationcargo auditclean andcargo clippyclean after the rumqttc bumpAGENTS.md+CONTRIBUTING.md): YesRollback Plan (required)
git revert 474751c1— reverts all five files atomicallyRisks and Mitigations
rumqttc 0.25.1introduces a behavior regression in the MQTT client path.0.102.xdep chain.audit.tomlwith upstream issue link. The MQTT broker connection uses server certificate validation; URI name constraint bypass requires a malicious certificate — not a realistic attack vector in the zeroclaw MQTT use case. Will remove from ignore list when rumqttc releases a fix.