[dependabot]

Bumps the cargo group with 4 updates in the / directory: base64, rustls, webpki-roots and rcgen.

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.44

Commits

• 64ad386 Bump version to 0.23.44
• 1efbf66 bogo: remove PostQuantum setup
• e78162f aws-lc-rs: add support for ML-DSA signatures
• d880772 bogo: extract Options::provider() helper
• 87201d6 bogo: force all callers to get provider from Options
• 93657e3 server: limit 1.2 certificate requests to 1.2-compatible signature schemes
• bbd3c9a client: avoid sending 1.3-only signature schemes if no cipher suites configured
• eb57688 tls12: require known signature algorithm
• e7a9cef tls12: send illegal_parameter alert for kx signed with wrong algorithm
• 06a546d bogo: take latest
• Additional commits viewable in compare view

Updates webpki-roots from 0.26.11 to 1.0.9

Release notes

Sourced from webpki-roots's releases.

1.0.9

Changes:

• Add "Telia EC TLS Root CA v3" and "Telia RSA TLS Root CA v3" - https://bugzilla.mozilla.org/show_bug.cgi?id=2047804
• Add "SECOM TLS ECC Root CA 2024" and "SECOM TLS RSA Root CA 2024" - https://bugzilla.mozilla.org/show_bug.cgi?id=1943001
• Remove "Atos TrustedRoot 2011" - https://bugzilla.mozilla.org/show_bug.cgi?id=2017374

What's Changed

• Take webpki-root-certs lockfile update by @​weifanglab in rustls/webpki-roots#125
• 1.0.9: upstream updates by @​ctz in rustls/webpki-roots#126

New Contributors

• @​weifanglab made their first contribution in rustls/webpki-roots#125

Full Changelog: rustls/webpki-roots@v/1.0.8...v/1.0.9

1.0.8

• Remove SecureSign Root CA12 root; see https://bugzilla.mozilla.org/show_bug.cgi?id=2031105

What's Changed

• Test MSRV with 1.70 by @​ctz in rustls/webpki-roots#122
• Take semver-compatible dependency updates by @​djc in rustls/webpki-roots#123
• 1.0.8: remove SecureSign Root CA12 root by @​ctz in rustls/webpki-roots#124

Full Changelog: rustls/webpki-roots@v/1.0.7...v/1.0.8

1.0.7

For their April 2026 root store changes, Mozilla has made more changes than usual:

These changes are part of Mozilla’s ongoing root store maintenance under the Mozilla Root Store Policy (MRSP), including §7.4 (Root CA Lifecycles) and §7.5.3 (Transition Plans). They reflect a combination of lifecycle-based transitions, CA operator requests, and alignment with intended certificate usage, including retiring older or less suitable root certificates, enforcing clear separation of trust purposes (e.g., TLS vs. S/MIME), and reducing unnecessary trust surface in the Web PKI ecosystem. Collectively, these actions help to ensure that root certificates are relied upon only for their intended and actively maintained use cases, or are retired in accordance with established distrust timelines.

This removes:

• CN=Certigna O=Dhimyotis
• CN=COMODO Certification Authority O=COMODO CA Limited
• CN=DigiCert Assured ID Root CA O=DigiCert Inc OU=www.digicert.com
• CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com
• CN=DigiCert High Assurance EV Root CA O=DigiCert Inc OU=www.digicert.com
• CN=FIRMAPROFESIONAL CA ROOT-A WEB O=Firmaprofesional SA
• CN=GTS Root R2 O=Google Trust Services LLC
• CN=QuoVadis Root CA 2 O=QuoVadis Limited
• CN=QuoVadis Root CA 3 O=QuoVadis Limited
• CN=Secure Global CA O=SecureTrust Corporation
• CN=SecureTrust CA O=SecureTrust Corporation
• CN=SwissSign Gold CA - G2 O=SwissSign AG
• CN=TeliaSonera Root CA v1 O=TeliaSonera
• CN=Trustwave Global Certification Authority O=Trustwave Holdings, Inc.
• CN=Trustwave Global ECC P256 Certification Authority O=Trustwave Holdings, Inc.
• CN=Trustwave Global ECC P384 Certification Authority O=Trustwave Holdings, Inc.

... (truncated)

Commits

• 0a553db 1.0.9: upstream updates (#126)
• 1ce667b Take webpki-root-certs lockfile update (#125)
• 50729cd 1.0.8: remove SecureSign Root CA12 root (#124)
• c965c54 Take semver-compatible dependency updates (#123)
• a83a3c9 Move MSRV to 1.70 (#122)
• be94846 Update dependencies (#119)
• 76476f9 Prepare 1.0.7 (#120)
• ed392f4 Take semver-compatible updates (#118)
• ec8b744 Take semver-compatible dependency updates (#117)
• 84a0c23 Take semver-compatible dependency updates (#116)
• Additional commits viewable in compare view

Updates rcgen from 0.13.2 to 0.14.7

Release notes

Sourced from rcgen's releases.

0.14.7

What's Changed

• Implement From<KeyPair> for PrivateKeyDer<'static> by @​LebedevRI in rustls/rcgen#403
• update copyright year in LICENSE by @​jasmyhigh in rustls/rcgen#407
• Add P521-SHA256 and P521-SHA384 signing algorithms by @​djc in rustls/rcgen#408

0.14.6

What's Changed

• Use private cfg for docs.rs-like builds by @​ctz in rustls/rcgen#384
• Expand rustdoc for CertificateSigningRequestParams::from_der by @​dwhjames in rustls/rcgen#386
• Group imports by @​iamjpotts in rustls/rcgen#381
• examples: add signing new cert using existing ca pem files by @​iamjpotts in rustls/rcgen#379
• Tweak CSR parsing errors/documentation by @​djc in rustls/rcgen#390
• Rename invalid CSR signature error variant by @​djc in rustls/rcgen#393
• chore: fix some typos in comments by @​black5box in rustls/rcgen#395
• ci: sync cargo-check-external-types nightly by @​cpu in rustls/rcgen#399
• Forward selected crypto backend to x509-parser by @​djc in rustls/rcgen#398

0.14.5

Implement SigningKey for &impl SigningKey to make Issuer more broadly useful.

What's Changed

• Forward signing and public key data through references by @​djc in rustls/rcgen#380

0.14.4

What's Changed

• Upgrade botan to 0.12 by @​djc in rustls/rcgen#377
• Upgrade x509-parser to 0.18 by @​djc in rustls/rcgen#376
• Add unstable support for ML-DSA algorithms by @​djc in rustls/rcgen#374

0.14.3

What's Changed

• docs: fix typo in PKCS_RSA_SHA384 doc comment by @​Bravo555 in rustls/rcgen#367
• Fix regression in key usage purpose encoding by @​djc in rustls/rcgen#369

0.14.2

• Add a CertifiedIssuer type (see #363)

What's changed

• Add a CertifiedIssuer by @​djc in rustls/rcgen#363
• Provide a non-owning constructor for Issuer by @​p-avital in rustls/rcgen#362
• Allow access to the CertifiedIssuer's Certificate by @​djc in rustls/rcgen#364

0.14.1

... (truncated)

Commits

• ee434c5 Bump version to 0.14.7
• b370764 Add P521-SHA256 and P521-SHA384 signing algorithms
• 851c56c update copyright year in LICENSE
• 26aad71 Implement From\<KeyPair> for PrivateKeyDer\<'static>
• b250fa3 Bump actions/cache from 4 to 5
• 5693362 rcgen: bump version to 0.14.6
• e347b76 Forward selected crypto backend to x509-parser
• 0f9f5a9 ci: sync cargo-check-external-types nightly
• 24bd69a Bump actions/checkout from 5 to 6
• e3f6b5f chore: fix some typos in comments
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vbasky]

Closing this Dependabot group bump. It updates rustls only to 0.23.44 (RUSTSEC-2026-0285 needs >=0.23.45) and includes breaking major bumps (base64 0.23, webpki-roots 1.x, rcgen 0.14) that fail CI. The rustls advisory will be patched on main instead.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml