Outdated transitive deps on rustls-webpki crates (RUSTSEC-2026-0098, RUSTSEC-2026-0099)
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 56.8k
- Forks
- 2.9k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 5
Description
Blocked by:
tendermind-rpc: Not sure if this is even maintained anymore. Bump PR has been open for a long time.smithy-rs: No PR yet but is actively maintained.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the two upstream blockers: the tendermint-rs bump PR 1487 and the smithy-rs dependency status. Confirm whether those projects have released updates addressing RUSTSEC-2026-0098 and RUSTSEC-2026-0099; done means fuel-core no longer carries the affected rustls-webpki versions and the advisories are resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100