[Nic-dorman]

Linear issue

Closes V2-1661

Part of V2-1659, which tracks the same move across every affected WithAutonomi lockfile.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Proposed rather than asserted. Lockfile only: 2 existing entries move by one patch release each, each with the same dependency list as the version it replaces: rustls-webpki 0.103.15 → 0.103.16 (rust-version 1.71 on both sides) and webpki-root-certs 1.0.9 → 1.0.10, whose rust-version rises from 1.70 to 1.71. Both stay below ant-node's own rust-version (1.95). The one behaviour change is that TLS certificate paths through the distrusted emSign intermediates, or the removed emSign ECC Root CA - G3 root, no longer verify. No Autonomi protocol message changes. Same tier as the earlier rustls lockfile moves (ant-client#232, ant-node#256, ant-protocol#46, saorsa-core#177, saorsa-transport#190).

Compatibility

• Wire: none for the Autonomi protocol. For TLS, chains through the distrusted emSign intermediates now fail verification.
• Storage: none.
• API: none. No manifest or source file is touched; this is the lockfile only.

Semver impact

• breaking
• feature
• fix

Test evidence

Run on this branch: one commit on top of main at b0e29c3. RustSec database at 4b587f00 (2026-10-21), cargo-audit 0.22.1, cargo 1.97.1.

• cargo audit -f <lockfile>: on main's lockfile it reports RUSTSEC-2026-0382, RUSTSEC-2026-0383; on this branch none of them, and every other finding is unchanged.
• The diff is exactly the version and checksum lines of the moved entries: Cargo.lock 8 lines. No entry is added or removed.
• cargo metadata --locked accepts every changed lockfile. Each moved release has the same dependency list as the version it replaces, checked entry by entry.
• cargo update -p <crate> --precise <version> also re-picked some unrelated multi-version edges (getrandom, windows-sys). The lockfile was reduced to the target entries, so those edges stay as main has them.
• Not run locally: builds, Clippy and tests are left to this PR's CI. No production compat smoke was run, because nothing on an Autonomi protocol path changes.

New dependency

None. Existing lockfile entries move by one patch release; none is added or removed.

ADR

n/a, Tier 1.

Mitigation / rollback

Revert the commit. It touches only lockfiles, so there is nothing to migrate either way.

---

What this is

Three RustSec advisories published on 2026-10-19 and 2026-10-20 cover one incident, CVE-2026-111943: the private keys of some emSign intermediate CAs are now well known, so certificate paths through them must stop verifying. This lockfile is affected by:

• RUSTSEC-2026-0382 (rustls-webpki, fixed in 0.103.16): rejects certificate paths that contain the distrusted emSign intermediate public keys.
• RUSTSEC-2026-0383 (webpki-root-certs, fixed in 1.0.10): drops the emSign ECC Root CA - G3 root.

Lockfile	Moves
Cargo.lock	rustls-webpki 0.103.15 → 0.103.16, webpki-root-certs 1.0.9 → 1.0.10

rustls-webpki is rustls's certificate-path verifier, compiled in through rustls, rustls-platform-verifier and rustls-post-quantum. webpki-root-certs is the bundled root store rustls-platform-verifier uses.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed head f7639dca2d1f4a4571646b4d67db837c83644422.

The only source change is the two lockfile version/checksum updates. They reach the patched releases for RUSTSEC-2026-0382 and RUSTSEC-2026-0383. I verified the published crate archive hashes, unchanged dependency declarations, and cargo metadata --locked; the exact-head Security Audit and Rust 1.95 MSRV checks pass. The Linux and Windows builds and Linux/macOS/Windows test jobs pass. I found no source-confirmed blocker.

CI caveat: Build (macos-latest) was cancelled before runner acquisition because GitHub could not obtain a hosted runner. No build step ran; the separate macOS test job passed. CI runs only on pull requests, so there is no exact-base macOS build for comparison. This is an infrastructure gap, not a source failure.

Non-blocking accuracy note: webpki-root-certs 1.0.9 declares Rust 1.70 and 1.0.10 declares Rust 1.71. The project's declared MSRV is 1.95, so this does not break supported builds, but the PR description's “same rust-version (1.71)” wording is inaccurate.

Review coverage: 1/1 independent seat reviewed (sol-1, gpt-6.1-sol, xhigh).

[grumbach]

Checked:

• Cargo.lock only. Both new checksums match the crates.io index, and neither version is yanked.
• 0.103.16 and 1.0.10 meet the patched ranges of RUSTSEC-2026-0382 and RUSTSEC-2026-0383.
• The crate source diffs contain only the fix: rustls-webpki adds the emSign SPKI distrust list (its Error is #[non_exhaustive]), and webpki-root-certs drops the one "emSign ECC Root CA - G3" root.
• cargo audit on current main (2598bcf) plus this change reports no vulnerabilities, only the 6 allowed warnings.