[bsod90]

eMudhra (emSign) intermediate CA keys were compromised; the rustls stack now refuses them. webpki-roots 1.0.10 drops the emSign roots (rustls/webpki-roots@c644e3e) and rustls-webpki 0.103.16 rejects any chain containing the distrusted intermediate keys (rustls/webpki#546). The Node side was fixed by the Node 24.22.1 bump in v1.8.10; the Rust lockfiles were not touched there.

Lockfile-only. webpki-roots 0.26.11 is the compatibility shim that re-exports 1.x, so moving the 0.26 copies to it pulls 1.0.10 without bumping reqwest/hyper-rustls.

Lockfile	webpki-roots	rustls-webpki
rust/cubestore	0.26.1 → 0.26.11 + 1.0.10	0.103.15 → 0.103.16
rust/cubesql	0.26.3 → 0.26.11 + 1.0.10	0.103.15 → 0.103.16
packages/cubejs-backend-native	0.26.3 → 0.26.11 + 1.0.10	0.103.15 → 0.103.16
rust/cube	1.0.7 → 1.0.10	0.103.13 → 0.103.16
rust/cube-cli	—	0.103.13 → 0.103.16

No other packages move. webpki-root-certs is not in any tree. Cube Store's S3/GCS remote FS uses native-tls (the image's system CA store), so it is unaffected by this change. cargo check --locked passes in rust/cubesql (--all-targets), rust/cube, rust/cube-cli and packages/cubejs-backend-native. In rust/cubestore the TLS crates compile locally, but the full check stops at a macOS-only librdkafka link error, so CI is the check there.

Check List

• Tests have been run in packages where changes have been made if available
• Linter has been run for changed code
• Tests for the changes have been added if not covered yet
• Docs have been added / updated if required

🤖 Generated with Claude Code

[claude]

Claude finished @bsod90's task in 1m 12s —— View job

---

LGTM, no issues found (0 high, 0 medium, 0 low)

Review details

• Read diff
• Check other lockfiles / dependency compatibility
• Review threads
• Post review

What I checked

• Every lockfile is covered. The repo has exactly five Cargo.lock files, and the PR updates all of them. After the PR, every tree resolves to a single rustls-webpki 0.103.16. Wherever webpki-roots appears, it resolves to 1.0.10: either directly (rust/cube) or through the 0.26.11 shim (rust/cubesql, rust/cubestore, packages/cubejs-backend-native). No tree has a leftover rustls-webpki 0.101/0.102 or the legacy webpki crate that the update would miss.
• The shim approach is correct. webpki-roots 0.26.11 only re-exports 1.x. That lets reqwest/hyper-rustls, which ask for ^0.26, pick up the new roots without any manifest changes. The disambiguated "webpki-roots 0.26.11" dependency entries are what cargo writes when two versions of a crate are in the tree.
• Checksums are consistent. Each crate version has the same checksum in every lockfile, e.g. rustls-webpki 0.103.16 = 4443b1b6… and webpki-roots 1.0.10 = 1c1c8e20….
• rustls-pki-types stays put. rust/cube is still on 1.14.1 and the other trees on 1.15.x. I couldn't verify this myself: running cargo and reading the registry are both blocked in this run. I'm relying on the author's report that cargo check --locked passes in all five trees. CI hadn't started when I checked, so watch it there.
• Commit prefix is right. chore(deps): fits CLAUDE.md for a dependency bump. The trust-store change is visible at runtime, but it's a lockfile bump, so chore is fine.

Review threads

The listing returned 0 of my own threads, so there was nothing to resolve or re-affirm.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.75%. Comparing base (00bec14) to head (0eb8ea0).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #12378   +/-   ##
=======================================
  Coverage   82.75%   82.75%           
=======================================
  Files         525      525           
  Lines      121408   121408           
  Branches     5136     5136           
=======================================
  Hits       100476   100476           
  Misses      20163    20163           
  Partials      769      769           

Flag	Coverage Δ
cube-backend	65.21% <ø> (ø)
cubesql	86.50% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.