chore(deps): bump the root-deps group across 1 directory with 4 updates

[dependabot]

Bumps the root-deps group with 3 updates in the / directory: ecdsa, bitflags and rustls-webpki.

Updates ecdsa from 0.17.0-rc.16 to 0.17.0-rc.17

Commits

• f467f70 ecdsa v0.17.0-rc.17 (#1304)
• a39b93d ecdsa: bump spki to v0.8 (#1303)
• 6752ba4 ecdsa: use mul_by_generator_and_mul_add_vartime for verification (#1302)
• ecaf359 ml-dsa: zeroize NTT-domain derived values in ExpandedSigningKey Drop (#1300)
• 66de36e xmss: delete Cargo.lock (#1301)
• a9b8056 Cargo.lock: bump deps (#1299)
• 8cb1795 build(deps): bump elliptic-curve from 0.14.0-rc.29 to 0.14.0-rc.30 (#1292)
• 66473ec xmss: bump format dependencies (#1290)
• 37f9be5 build(deps): bump actions/checkout from 5.0.1 to 6.0.2 (#1289)
• a031db9 build(deps): bump crate-ci/typos from 1.44.0 to 1.45.0 (#1288)
• Additional commits viewable in compare view

Updates bitflags from 2.11.0 to 2.11.1

Release notes

Sourced from bitflags's releases.

2.11.1

What's Changed

• Bless compile-fail tests for current beta by @​DanielEScherzer in bitflags/bitflags#478
• example_generated.rs: add missing third slash for doc comment by @​DanielEScherzer in bitflags/bitflags#477
• Clarify self and other in method docs by @​KodrAus in bitflags/bitflags#481
• Prepare for 2.11.1 release by @​KodrAus in bitflags/bitflags#482

New Contributors

• @​DanielEScherzer made their first contribution in bitflags/bitflags#478

Full Changelog: bitflags/bitflags@2.11.0...2.11.1

Changelog

Sourced from bitflags's changelog.

2.11.1

What's Changed

• Bless compile-fail tests for current beta by @​DanielEScherzer in bitflags/bitflags#478
• example_generated.rs: add missing third slash for doc comment by @​DanielEScherzer in bitflags/bitflags#477
• Clarify self and other in method docs by @​KodrAus in bitflags/bitflags#481

New Contributors

• @​DanielEScherzer made their first contribution in bitflags/bitflags#478

Full Changelog: bitflags/bitflags@2.11.0...2.11.1

Commits

• 4ed9ffa Merge pull request #482 from KodrAus/cargo/2.11.1
• c53cd57 prepare for 2.11.1 release
• a44410a Merge pull request #481 from KodrAus/docs/clarifications
• 3d671b9 update more compile error messages
• 5f3adad fix up compile error messages
• 780765d fix up contains and intersection docs
• 97b7607 clarify self and other in method docs
• 88a7a18 Merge pull request #477 from DanielEScherzer/patch-1
• f0e4646 example_generated.rs: add missing third slash for doc comment
• a31c96f Merge pull request #478 from DanielEScherzer/beta-bless
• Additional commits viewable in compare view

Updates elliptic-curve from 0.14.0-rc.30 to 0.14.0-rc.31

Commits

• b397bd3 elliptic-curve v0.14.0-rc.31 (#2386)
• 4aa20fa elliptic-curve: shorten name of mul_by_generator_and_mul_add_vartime (#2385)
• ac069b2 elliptic-curve: add MulByGeneratorVartime to bounds (#2384)
• 403d4d1 build(deps): bump the all-deps group with 3 updates (#2383)
• 45489da elliptic-curve: add MulByGeneratorVartime trait (#2381)
• b48dd1e elliptic-curve: MulVartime fixups (#2380)
• d4c0d46 elliptic-curve: add ops::MulVartime trait and bound Scalar (#2379)
• 4f084d3 elliptic-curve: use *Vartime as a suffix (#2378)
• caa9638 elliptic-curve: add VartimeBasepointTable (#2374)
• ac67970 elliptic-curve: add PointWithBasepointTable trait (#2376)
• See full diff in compare view

Updates rustls-webpki from 0.103.11 to 0.103.12

Release notes

Sourced from rustls-webpki's releases.

0.103.12

This release fixes two bugs in name constraint enforcement:

• GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
• GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

• Prepare 0.103.12 by @​djc in rustls/webpki#470

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

Commits

• 27131d4 Bump version to 0.103.12
• 6ecb876 Clean up stuttery enum variant names
• 318b3e6 Ignore wildcard labels when matching name constraints
• 1219622 Rewrite constraint matching to avoid permissive catch-all branch
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions