[bsletten]

Lock-only security update (ledger #2050). Eight eMudhra intermediate CA certificates have recoverable private keys (https://emudhra.we-have-a-problem.com/). rustls-webpki below 0.103.16 may accept certificate paths through them: RUSTSEC-2026-0382, CVE-2026-111943 (rustls/webpki#546). webpki-roots and webpki-root-certs 1.0.10 carry the updated roots. This moves the lock to the fixed versions; it changes what ships, so the installed binary should be rebuilt after merge.

just lock-diff:

lock-diff  ikigai-gonk: Cargo.lock at HEAD → working file
packages
  ~ rustls-webpki 0.103.15 → 0.103.16
edges  — packages at the SAME version whose dependency set changed
  rustls 0.23.45
      rustls-webpki 0.103.15 → 0.103.16
  tempfile 3.27.0
      getrandom 0.4.3 → 0.3.4

lock-diff: the name/version map shows 1 change(s); the edges show 2 on 2 package(s) that did not move — a grep of name/version lines would have missed those

shipped  — what the artifacts link (normal + build edges; dev-dependencies left out)
  artifacts: ikigai-gonk
  ~ rustls-webpki 0.103.15 → 0.103.16
lock-diff: ⚠ this lock move CHANGES WHAT SHIPS (1 package(s), 0 edge(s) under ikigai-gonk): describe it as a deploy change and test the artifact, even when the PR only touched a dev-dependency (ledger #360)

🤖 Generated with Claude Code