From fa7a496dcf2630134e28c7e8149a0b9db3814d73 Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Sat, 25 Apr 2026 10:01:40 -0400
Subject: [PATCH] chore(deps): bump rustls-webpki to 0.103.13

Patches GHSA-82j2-j2ch-gfr8: a malformed CRL BIT STRING can panic
bit_string_flags() in rustls-webpki via BorrowedCertRevocationList::from_der().
Reachable when applications opt into CRL checking and load CRL bytes from an
attacker-influenced source.

Resolves Dependabot alert #25.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 05ca3101b..405c4d48a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5740,9 +5740,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.12"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",