Repository navigation
fix(security): update GraphQL connector TLS verifier and roots - #25
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Regenerate Cargo.lock with rustls-webpki 0.103.16 and webpki-roots 1.0.10; preserve unrelated dependency pins.
Validation and remaining gaps
cargo +1.98.1 metadata --locked and cargo +1.98.1 check --locked -p ndc-graphql passed. All locked rustls-webpki and webpki-roots versions are fixed. Repository-toolchain CI and actual image certificate tests remain required.
Release boundary
This PR changes source/build inputs only. No image publication, merge, deployment, rollout, or CI polling was performed. Build fresh immutable image versions and update running, future, derived, and hibernated connector references. Validate the actual images against all 12 direct/cross-signed TLS chains and an unrelated valid control; network failure alone is not evidence of distrust.
Incident: https://emudhra.we-have-a-problem.com/