[hermes-alby]

Summary

• Update only rustls-webpki 0.103.15 → 0.103.16 in the committed lockfile. Upstream release notes and implementation/regression tests confirm explicit distrust of the affected intermediate SPKIs (including cross-signs), rather than just changing root certificates.
• Add --locked to the shared Cargo/Cross native-library build so the six platform builds feeding getAlby/ldk-node-go use the reviewed lockfile and fail rather than silently resolve a different graph.

Scope and dependency audit

cargo tree --locked --features uniffi --target all -e normal,build confirms the shipped graph uses rustls 0.23.45 → rustls-webpki 0.103.16 for Electrum, Esplora/reqwest, and VSS. No production native-tls/OpenSSL or older rustls-webpki path was found, so no native-TLS switch or unrelated dependency upgrade is included.

The lockfile still contains test-only rustls-webpki 0.101.7: test-binary downloaders (minreq via electrsd/corepc-node) and the legacy ldk-node 0.6.2 VSS migration-test dependency. OpenSSL is confined to the optional LND integration-test dependency. These paths are not remediated by this update and are not included in shipped binding libraries. The registry currently has no newer 0.101 patch; 0.103.16 is not semver-compatible with 0.101.7. Upstream also released the mitigation as 0.104.0-alpha.8, which is not used here.

This lockfile controls this repository's builds, not independent downstream Rust consumers' lockfiles. Existing published Go native binaries remain unchanged until rebuilt and published.

Verification

• cargo +stable fmt --all -- --check passed (Rust 1.99.1; existing nightly-only rustfmt-option warnings).
• CARGO_BUILD_JOBS=2 CARGO_PROFILE_DEV_DEBUG=0 cargo +stable check --locked --features uniffi passed; existing generated UniFFI FeeRate deprecation warning only.
• The same locked UniFFI check also passed with Rust 1.91.1, the exact toolchain pinned by the Go-binding workflow (same existing generated-code warning).
• In a separate upstream v/0.103.16 checkout, cargo +stable test --locked --lib --features ring distrusted_spki passed, then the complete upstream library suite passed: 117 tests. The security implementation and all eight distrusted SPKI files were byte-compared with the registry crate used here. This is upstream verifier testing, not the node's integration suite.
• All-target production dependency graph assertions passed: fixed verifier present, older verifier/native TLS absent. Parsed lockfile comparison confirms only one package version changed.
• git diff --check passed; workflow YAML parsed successfully.

The declared Rust 1.85 check fails because existing locked ICU/textwrap dependencies require Rust 1.88 (and idna_adapter requires 1.86); this PR does not change those packages. Full node integration tests, release linking, and the cross-platform artifact matrix have not been run locally.

Follow-up (not performed here)

After maintainer review/merge, the existing main-branch workflow must build and publish the updated native libraries to getAlby/ldk-node-go. Verify all target artifacts and record the resulting Go repository commit/version; then update Hub to consume that version, rebuild, and test/release it. No merge, publish, or release is requested by this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2d707f7c-94d1-404e-974e-e01b0cc6b83c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}