From 9b11ccd4a04a470af2a5adb286c781f9d90938ba Mon Sep 17 00:00:00 2001
From: Tam Tran <tamtranthien@gmail.com>
Date: Mon, 7 Sep 2026 16:36:54 -0500
Subject: [PATCH] fix(deps): bump openssl and rustls-webpki to resolve
 high-severity Dependabot alerts

openssl 0.10.75 -> 0.10.81 (>= 0.10.79 required): fixes an OCSP-URL UB
bug, an AES key-wrap bounds assertion, a digest_final buffer overrun,
and a PSK/cookie callback memory leak (alerts #132-134, #136, #138).
Pulled in transitively via native-tls -> reqwest/tauri, always active.

rustls-webpki 0.103.9 -> 0.103.15 (>= 0.103.13 required): fixes a
panic-based DoS on malformed CRL BIT STRINGs (alert #137). Pulled in
via ureq -> velopack, behind the optional velopack-updates feature
that release builds enable.

Both are `cargo update -p` bumps with no direct dependency or code
changes. Verified with `cargo build --release --features
velopack-updates` (exercises the rustls-webpki path) and `cargo test
--release` (968/968 passing).
---
 src-tauri/Cargo.lock | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index d168ab61..25bee3be 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -3293,15 +3293,14 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.75"
+version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
  "bitflags 2.13.1",
  "cfg-if",
  "foreign-types 0.3.2",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -3325,9 +3324,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.111"
+version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
@@ -4290,9 +4289,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",