[dependabot]

Bumps the tendermint group with 5 updates in the / directory:

Package	From	To
tendermint	0.40.4	0.41.0
tendermint-proto	0.40.4	0.41.0
tendermint-light-client	0.40.4	0.41.0
tendermint-rpc	0.40.4	0.41.0
tendermint-testgen	0.40.4	0.41.0

Updates tendermint from 0.40.4 to 0.41.0

Release notes

Sourced from tendermint's releases.

v0.41.0

[!WARNING] This is a breaking release.

• It changes a public trait in tendermint, the voting-power API in tendermint-light-client-verifier, and upgrades several major dependencies (prost/tonic 0.14, MSRV 1.82).
• All tendermint-* crates move from 0.40.x to 0.41.0 together.
• Downstream crates must update their requirements to pick up this release, including its TLS security fix.

⚠️ Breaking changes

Verifier::verify now takes &self (#1512, closes #1511)

tendermint::crypto::signature::Verifier::verify is now an instance method rather than a static one, so signature verifiers can carry state.

• Custom Verifier implementations must add &self to verify.
• validator::Info::verify_signature now takes a verifier: &V argument.
• ProvidedVotingPowerCalculator<V> (light-client-verifier) now owns a verifier: V. Construct it with ProvidedVotingPowerCalculator::new(verifier); Default is only available when V: Default. Its Send/Sync bounds now follow V, and the trait impl requires V: Send + Sync.

Migration:

// Before
impl Verifier for MyVerifier {
    fn verify(pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
MyVerifier::verify(pubkey, msg, &sig)?;
// After
impl Verifier for MyVerifier {
fn verify(&self, pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
my_verifier.verify(pubkey, msg, &sig)?;

Dependency upgrades (#1522)

• prost 0.14 (0.14.3) and tonic 0.14. Generated protobuf types in tendermint-proto now target prost 0.14; mixing them with prost 0.13 types will not compile.
• reqwest 0.12, async-tungstenite 0.28, k256 0.14, rustls 0.23.
• Minimum supported Rust version is now 1.82.

🔒 Security

Reject certificate chains through distrusted eMudhra intermediates (#1521)

• tendermint-rpc's http-client and websocket-client features now require rustls-webpki >= 0.103.16, which rejects chains through the distrusted eMudhra intermediate CA keys.
• http-client now also requires rustls >= 0.23.46 (ring provider, the same one reqwest's rustls-tls-native-roots already uses, so no new crypto backend).
• Minimum reqwest raised to 0.12.5, the first release on rustls 0.23.
• tools/rpc-probe moves to a rustls 0.23-based async-tungstenite with the same verifier floor.

No code or API changes come from this fix. Existing lockfiles with an older rustls-webpki will be bumped when you upgrade tendermint-rpc.

... (truncated)

Changelog

Sourced from tendermint's changelog.

v0.41.0

October 23rd, 2026

This release updates the TLS stack used by the tendermint-rpc HTTP and WebSocket clients to rustls 0.23, with rustls-webpki 0.103.16 or later, so that certificate chains through distrusted CA keys are rejected. All users of the RPC clients are advised to update.

It also makes Verifier::verify take &self, allowing stateful signature verifiers. See the breaking changes below for details.

BREAKING CHANGES

• [tendermint] The Verifier::verify method now takes &self, allowing stateful signature verifiers (#1511)
• [tendermint-rpc]: Update reqwest to v0.12 and async-tungstenite to v0.28 to pull in patched versions of h2, rustls and rustls-webpki (RUSTSEC-2026-0258, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382). HttpClient::builder().client(...) and HttpClient::new_from_parts now take a reqwest v0.12 Client, and the re-exported WebSocketConfig comes from tungstenite v0.24. The websocket-client feature now enables the ring crypto provider for rustls. (#1522)
• [tendermint-light-client-js]: Relax the js-sys pin from =0.3.70 to 0.3.70 so that reqwest can resolve to a version without the vulnerable quinn-proto. (#1522)
• [tendermint]: Update k256 to v0.14 and signature to v3 to pull in a patched version of crypto-bigint (RUSTSEC-2026-0387). The re-exported secp256k1 types (public_key::Secp256k1, signature::Secp256k1Signature, private_key::Secp256k1 and crypto::default::ecdsa_secp256k1) now come from k256 v0.14. The signature dependency is now only pulled in by the secp256k1 feature. Enabling the secp256k1 feature now requires Rust 1.87 (required by the patched crypto-bigint v0.7.6+ pulled in through k256 v0.14). (#1522)
• [tendermint-proto]: Update prost to v0.14 and tonic to v0.14. The grpc-server feature now also depends on tonic-prost. Generated message types now derive Eq and Hash where possible, and google::protobuf::Duration now implements Hash. The minimum supported Rust version for all crates is now 1.82 (required by prost v0.14), and is now declared via rust-version in each crate's manifest. (#1522)

SECURITY

• [tendermint-rpc] Update the HTTP and WebSocket clients to rustls 0.23.46 or later (and reqwest 0.12.5 or later), and require rustls-webpki 0.103.16 or later, which rejects certificate chains through the eMudhra intermediate CA keys distrusted by rustls-webpki

... (truncated)

Commits

• 729247b fix: bump dependencies to address untrusted certs (#1521)
• 910a34a chore: upgrade prost to 0.14.3 (#1522)
• a2aa5bf imp(tendermint)!: add &self to Verifier::verify for stateful verifiers (#1512)
• 86f8d07 fix(ci): remove no mangle from test panic handler (#1513)
• See full diff in compare view

Updates tendermint-proto from 0.40.4 to 0.41.0

Release notes

Sourced from tendermint-proto's releases.

v0.41.0

[!WARNING] This is a breaking release.

• It changes a public trait in tendermint, the voting-power API in tendermint-light-client-verifier, and upgrades several major dependencies (prost/tonic 0.14, MSRV 1.82).
• All tendermint-* crates move from 0.40.x to 0.41.0 together.
• Downstream crates must update their requirements to pick up this release, including its TLS security fix.

⚠️ Breaking changes

Verifier::verify now takes &self (#1512, closes #1511)

tendermint::crypto::signature::Verifier::verify is now an instance method rather than a static one, so signature verifiers can carry state.

• Custom Verifier implementations must add &self to verify.
• validator::Info::verify_signature now takes a verifier: &V argument.
• ProvidedVotingPowerCalculator<V> (light-client-verifier) now owns a verifier: V. Construct it with ProvidedVotingPowerCalculator::new(verifier); Default is only available when V: Default. Its Send/Sync bounds now follow V, and the trait impl requires V: Send + Sync.

Migration:

// Before
impl Verifier for MyVerifier {
    fn verify(pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
MyVerifier::verify(pubkey, msg, &sig)?;
// After
impl Verifier for MyVerifier {
fn verify(&self, pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
my_verifier.verify(pubkey, msg, &sig)?;

Dependency upgrades (#1522)

• prost 0.14 (0.14.3) and tonic 0.14. Generated protobuf types in tendermint-proto now target prost 0.14; mixing them with prost 0.13 types will not compile.
• reqwest 0.12, async-tungstenite 0.28, k256 0.14, rustls 0.23.
• Minimum supported Rust version is now 1.82.

🔒 Security

Reject certificate chains through distrusted eMudhra intermediates (#1521)

• tendermint-rpc's http-client and websocket-client features now require rustls-webpki >= 0.103.16, which rejects chains through the distrusted eMudhra intermediate CA keys.
• http-client now also requires rustls >= 0.23.46 (ring provider, the same one reqwest's rustls-tls-native-roots already uses, so no new crypto backend).
• Minimum reqwest raised to 0.12.5, the first release on rustls 0.23.
• tools/rpc-probe moves to a rustls 0.23-based async-tungstenite with the same verifier floor.

No code or API changes come from this fix. Existing lockfiles with an older rustls-webpki will be bumped when you upgrade tendermint-rpc.

... (truncated)

Changelog

Sourced from tendermint-proto's changelog.

v0.41.0

October 23rd, 2026

This release updates the TLS stack used by the tendermint-rpc HTTP and WebSocket clients to rustls 0.23, with rustls-webpki 0.103.16 or later, so that certificate chains through distrusted CA keys are rejected. All users of the RPC clients are advised to update.

It also makes Verifier::verify take &self, allowing stateful signature verifiers. See the breaking changes below for details.

BREAKING CHANGES

• [tendermint] The Verifier::verify method now takes &self, allowing stateful signature verifiers (#1511)
• [tendermint-rpc]: Update reqwest to v0.12 and async-tungstenite to v0.28 to pull in patched versions of h2, rustls and rustls-webpki (RUSTSEC-2026-0258, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382). HttpClient::builder().client(...) and HttpClient::new_from_parts now take a reqwest v0.12 Client, and the re-exported WebSocketConfig comes from tungstenite v0.24. The websocket-client feature now enables the ring crypto provider for rustls. (#1522)
• [tendermint-light-client-js]: Relax the js-sys pin from =0.3.70 to 0.3.70 so that reqwest can resolve to a version without the vulnerable quinn-proto. (#1522)
• [tendermint]: Update k256 to v0.14 and signature to v3 to pull in a patched version of crypto-bigint (RUSTSEC-2026-0387). The re-exported secp256k1 types (public_key::Secp256k1, signature::Secp256k1Signature, private_key::Secp256k1 and crypto::default::ecdsa_secp256k1) now come from k256 v0.14. The signature dependency is now only pulled in by the secp256k1 feature. Enabling the secp256k1 feature now requires Rust 1.87 (required by the patched crypto-bigint v0.7.6+ pulled in through k256 v0.14). (#1522)
• [tendermint-proto]: Update prost to v0.14 and tonic to v0.14. The grpc-server feature now also depends on tonic-prost. Generated message types now derive Eq and Hash where possible, and google::protobuf::Duration now implements Hash. The minimum supported Rust version for all crates is now 1.82 (required by prost v0.14), and is now declared via rust-version in each crate's manifest. (#1522)

SECURITY

• [tendermint-rpc] Update the HTTP and WebSocket clients to rustls 0.23.46 or later (and reqwest 0.12.5 or later), and require rustls-webpki 0.103.16 or later, which rejects certificate chains through the eMudhra intermediate CA keys distrusted by rustls-webpki

... (truncated)

Commits

• 729247b fix: bump dependencies to address untrusted certs (#1521)
• 910a34a chore: upgrade prost to 0.14.3 (#1522)
• a2aa5bf imp(tendermint)!: add &self to Verifier::verify for stateful verifiers (#1512)
• 86f8d07 fix(ci): remove no mangle from test panic handler (#1513)
• See full diff in compare view

Updates tendermint-light-client from 0.40.4 to 0.41.0

Release notes

Sourced from tendermint-light-client's releases.

v0.41.0

[!WARNING] This is a breaking release.

• It changes a public trait in tendermint, the voting-power API in tendermint-light-client-verifier, and upgrades several major dependencies (prost/tonic 0.14, MSRV 1.82).
• All tendermint-* crates move from 0.40.x to 0.41.0 together.
• Downstream crates must update their requirements to pick up this release, including its TLS security fix.

⚠️ Breaking changes

Verifier::verify now takes &self (#1512, closes #1511)

tendermint::crypto::signature::Verifier::verify is now an instance method rather than a static one, so signature verifiers can carry state.

• Custom Verifier implementations must add &self to verify.
• validator::Info::verify_signature now takes a verifier: &V argument.
• ProvidedVotingPowerCalculator<V> (light-client-verifier) now owns a verifier: V. Construct it with ProvidedVotingPowerCalculator::new(verifier); Default is only available when V: Default. Its Send/Sync bounds now follow V, and the trait impl requires V: Send + Sync.

Migration:

// Before
impl Verifier for MyVerifier {
    fn verify(pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
MyVerifier::verify(pubkey, msg, &sig)?;
// After
impl Verifier for MyVerifier {
fn verify(&self, pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
my_verifier.verify(pubkey, msg, &sig)?;

Dependency upgrades (#1522)

• prost 0.14 (0.14.3) and tonic 0.14. Generated protobuf types in tendermint-proto now target prost 0.14; mixing them with prost 0.13 types will not compile.
• reqwest 0.12, async-tungstenite 0.28, k256 0.14, rustls 0.23.
• Minimum supported Rust version is now 1.82.

🔒 Security

Reject certificate chains through distrusted eMudhra intermediates (#1521)

• tendermint-rpc's http-client and websocket-client features now require rustls-webpki >= 0.103.16, which rejects chains through the distrusted eMudhra intermediate CA keys.
• http-client now also requires rustls >= 0.23.46 (ring provider, the same one reqwest's rustls-tls-native-roots already uses, so no new crypto backend).
• Minimum reqwest raised to 0.12.5, the first release on rustls 0.23.
• tools/rpc-probe moves to a rustls 0.23-based async-tungstenite with the same verifier floor.

No code or API changes come from this fix. Existing lockfiles with an older rustls-webpki will be bumped when you upgrade tendermint-rpc.

... (truncated)

Changelog

Sourced from tendermint-light-client's changelog.

v0.41.0

October 23rd, 2026

This release updates the TLS stack used by the tendermint-rpc HTTP and WebSocket clients to rustls 0.23, with rustls-webpki 0.103.16 or later, so that certificate chains through distrusted CA keys are rejected. All users of the RPC clients are advised to update.

It also makes Verifier::verify take &self, allowing stateful signature verifiers. See the breaking changes below for details.

BREAKING CHANGES

• [tendermint] The Verifier::verify method now takes &self, allowing stateful signature verifiers (#1511)
• [tendermint-rpc]: Update reqwest to v0.12 and async-tungstenite to v0.28 to pull in patched versions of h2, rustls and rustls-webpki (RUSTSEC-2026-0258, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382). HttpClient::builder().client(...) and HttpClient::new_from_parts now take a reqwest v0.12 Client, and the re-exported WebSocketConfig comes from tungstenite v0.24. The websocket-client feature now enables the ring crypto provider for rustls. (#1522)
• [tendermint-light-client-js]: Relax the js-sys pin from =0.3.70 to 0.3.70 so that reqwest can resolve to a version without the vulnerable quinn-proto. (#1522)
• [tendermint]: Update k256 to v0.14 and signature to v3 to pull in a patched version of crypto-bigint (RUSTSEC-2026-0387). The re-exported secp256k1 types (public_key::Secp256k1, signature::Secp256k1Signature, private_key::Secp256k1 and crypto::default::ecdsa_secp256k1) now come from k256 v0.14. The signature dependency is now only pulled in by the secp256k1 feature. Enabling the secp256k1 feature now requires Rust 1.87 (required by the patched crypto-bigint v0.7.6+ pulled in through k256 v0.14). (#1522)
• [tendermint-proto]: Update prost to v0.14 and tonic to v0.14. The grpc-server feature now also depends on tonic-prost. Generated message types now derive Eq and Hash where possible, and google::protobuf::Duration now implements Hash. The minimum supported Rust version for all crates is now 1.82 (required by prost v0.14), and is now declared via rust-version in each crate's manifest. (#1522)

SECURITY

• [tendermint-rpc] Update the HTTP and WebSocket clients to rustls 0.23.46 or later (and reqwest 0.12.5 or later), and require rustls-webpki 0.103.16 or later, which rejects certificate chains through the eMudhra intermediate CA keys distrusted by rustls-webpki

... (truncated)

Commits

• 729247b fix: bump dependencies to address untrusted certs (#1521)
• 910a34a chore: upgrade prost to 0.14.3 (#1522)
• a2aa5bf imp(tendermint)!: add &self to Verifier::verify for stateful verifiers (#1512)
• 86f8d07 fix(ci): remove no mangle from test panic handler (#1513)
• See full diff in compare view

Updates tendermint-rpc from 0.40.4 to 0.41.0

Release notes

Sourced from tendermint-rpc's releases.

v0.41.0

[!WARNING] This is a breaking release.

• It changes a public trait in tendermint, the voting-power API in tendermint-light-client-verifier, and upgrades several major dependencies (prost/tonic 0.14, MSRV 1.82).
• All tendermint-* crates move from 0.40.x to 0.41.0 together.
• Downstream crates must update their requirements to pick up this release, including its TLS security fix.

⚠️ Breaking changes

Verifier::verify now takes &self (#1512, closes #1511)

tendermint::crypto::signature::Verifier::verify is now an instance method rather than a static one, so signature verifiers can carry state.

• Custom Verifier implementations must add &self to verify.
• validator::Info::verify_signature now takes a verifier: &V argument.
• ProvidedVotingPowerCalculator<V> (light-client-verifier) now owns a verifier: V. Construct it with ProvidedVotingPowerCalculator::new(verifier); Default is only available when V: Default. Its Send/Sync bounds now follow V, and the trait impl requires V: Send + Sync.

Migration:

// Before
impl Verifier for MyVerifier {
    fn verify(pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
MyVerifier::verify(pubkey, msg, &sig)?;
// After
impl Verifier for MyVerifier {
fn verify(&self, pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
my_verifier.verify(pubkey, msg, &sig)?;

Dependency upgrades (#1522)

• prost 0.14 (0.14.3) and tonic 0.14. Generated protobuf types in tendermint-proto now target prost 0.14; mixing them with prost 0.13 types will not compile.
• reqwest 0.12, async-tungstenite 0.28, k256 0.14, rustls 0.23.
• Minimum supported Rust version is now 1.82.

🔒 Security

Reject certificate chains through distrusted eMudhra intermediates (#1521)

• tendermint-rpc's http-client and websocket-client features now require rustls-webpki >= 0.103.16, which rejects chains through the distrusted eMudhra intermediate CA keys.
• http-client now also requires rustls >= 0.23.46 (ring provider, the same one reqwest's rustls-tls-native-roots already uses, so no new crypto backend).
• Minimum reqwest raised to 0.12.5, the first release on rustls 0.23.
• tools/rpc-probe moves to a rustls 0.23-based async-tungstenite with the same verifier floor.

No code or API changes come from this fix. Existing lockfiles with an older rustls-webpki will be bumped when you upgrade tendermint-rpc.

... (truncated)

Changelog

Sourced from tendermint-rpc's changelog.

v0.41.0

October 23rd, 2026

This release updates the TLS stack used by the tendermint-rpc HTTP and WebSocket clients to rustls 0.23, with rustls-webpki 0.103.16 or later, so that certificate chains through distrusted CA keys are rejected. All users of the RPC clients are advised to update.

It also makes Verifier::verify take &self, allowing stateful signature verifiers. See the breaking changes below for details.

BREAKING CHANGES

• [tendermint] The Verifier::verify method now takes &self, allowing stateful signature verifiers (#1511)
• [tendermint-rpc]: Update reqwest to v0.12 and async-tungstenite to v0.28 to pull in patched versions of h2, rustls and rustls-webpki (RUSTSEC-2026-0258, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382). HttpClient::builder().client(...) and HttpClient::new_from_parts now take a reqwest v0.12 Client, and the re-exported WebSocketConfig comes from tungstenite v0.24. The websocket-client feature now enables the ring crypto provider for rustls. (#1522)
• [tendermint-light-client-js]: Relax the js-sys pin from =0.3.70 to 0.3.70 so that reqwest can resolve to a version without the vulnerable quinn-proto. (#1522)
• [tendermint]: Update k256 to v0.14 and signature to v3 to pull in a patched version of crypto-bigint (RUSTSEC-2026-0387). The re-exported secp256k1 types (public_key::Secp256k1, signature::Secp256k1Signature, private_key::Secp256k1 and crypto::default::ecdsa_secp256k1) now come from k256 v0.14. The signature dependency is now only pulled in by the secp256k1 feature. Enabling the secp256k1 feature now requires Rust 1.87 (required by the patched crypto-bigint v0.7.6+ pulled in through k256 v0.14). (#1522)
• [tendermint-proto]: Update prost to v0.14 and tonic to v0.14. The grpc-server feature now also depends on tonic-prost. Generated message types now derive Eq and Hash where possible, and google::protobuf::Duration now implements Hash. The minimum supported Rust version for all crates is now 1.82 (required by prost v0.14), and is now declared via rust-version in each crate's manifest. (#1522)

SECURITY

• [tendermint-rpc] Update the HTTP and WebSocket clients to rustls 0.23.46 or later (and reqwest 0.12.5 or later), and require rustls-webpki 0.103.16 or later, which rejects certificate chains through the eMudhra intermediate CA keys distrusted by rustls-webpki

... (truncated)

Commits

• 729247b fix: bump dependencies to address untrusted certs (#1521)
• 910a34a chore: upgrade prost to 0.14.3 (#1522)
• a2aa5bf imp(tendermint)!: add &self to Verifier::verify for stateful verifiers (#1512)
• 86f8d07 fix(ci): remove no mangle from test panic handler (#1513)
• See full diff in compare view

Updates tendermint-testgen from 0.40.4 to 0.41.0

Release notes

Sourced from tendermint-testgen's releases.

v0.41.0

[!WARNING] This is a breaking release.

• It changes a public trait in tendermint, the voting-power API in tendermint-light-client-verifier, and upgrades several major dependencies (prost/tonic 0.14, MSRV 1.82).
• All tendermint-* crates move from 0.40.x to 0.41.0 together.
• Downstream crates must update their requirements to pick up this release, including its TLS security fix.

⚠️ Breaking changes

Verifier::verify now takes &self (#1512, closes #1511)

tendermint::crypto::signature::Verifier::verify is now an instance method rather than a static one, so signature verifiers can carry state.

• Custom Verifier implementations must add &self to verify.
• validator::Info::verify_signature now takes a verifier: &V argument.
• ProvidedVotingPowerCalculator<V> (light-client-verifier) now owns a verifier: V. Construct it with ProvidedVotingPowerCalculator::new(verifier); Default is only available when V: Default. Its Send/Sync bounds now follow V, and the trait impl requires V: Send + Sync.

Migration:

// Before
impl Verifier for MyVerifier {
    fn verify(pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
MyVerifier::verify(pubkey, msg, &sig)?;
// After
impl Verifier for MyVerifier {
fn verify(&self, pubkey: PublicKey, msg: &[u8], signature: &Signature) -> Result<(), Error> { /* ... */ }
}
my_verifier.verify(pubkey, msg, &sig)?;

Dependency upgrades (#1522)

• prost 0.14 (0.14.3) and tonic 0.14. Generated protobuf types in tendermint-proto now target prost 0.14; mixing them with prost 0.13 types will not compile.
• reqwest 0.12, async-tungstenite 0.28, k256 0.14, rustls 0.23.
• Minimum supported Rust version is now 1.82.

🔒 Security

Reject certificate chains through distrusted eMudhra intermediates (#1521)

• tendermint-rpc's http-client and websocket-client features now require rustls-webpki >= 0.103.16, which rejects chains through the distrusted eMudhra intermediate CA keys.
• http-client now also requires rustls >= 0.23.46 (ring provider, the same one reqwest's rustls-tls-native-roots already uses, so no new crypto backend).
• Minimum reqwest raised to 0.12.5, the first release on rustls 0.23.
• tools/rpc-probe moves to a rustls 0.23-based async-tungstenite with the same verifier floor.

No code or API changes come from this fix. Existing lockfiles with an older rustls-webpki will be bumped when you upgrade tendermint-rpc.

... (truncated)

Changelog

Sourced from tendermint-testgen's changelog.

v0.41.0

October 23rd, 2026

This release updates the TLS stack used by the tendermint-rpc HTTP and WebSocket clients to rustls 0.23, with rustls-webpki 0.103.16 or later, so that certificate chains through distrusted CA keys are rejected. All users of the RPC clients are advised to update.

It also makes Verifier::verify take &self, allowing stateful signature verifiers. See the breaking changes below for details.

BREAKING CHANGES

• [tendermint] The Verifier::verify method now takes &self, allowing stateful signature verifiers (#1511)
• [tendermint-rpc]: Update reqwest to v0.12 and async-tungstenite to v0.28 to pull in patched versions of h2, rustls and rustls-webpki (RUSTSEC-2026-0258, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382). HttpClient::builder().client(...) and HttpClient::new_from_parts now take a reqwest v0.12 Client, and the re-exported WebSocketConfig comes from tungstenite v0.24. The websocket-client feature now enables the ring crypto provider for rustls. (#1522)
• [tendermint-light-client-js]: Relax the js-sys pin from =0.3.70 to 0.3.70 so that reqwest can resolve to a version without the vulnerable quinn-proto. (#1522)
• [tendermint]: Update k256 to v0.14 and signature to v3 to pull in a patched version of crypto-bigint (RUSTSEC-2026-0387). The re-exported secp256k1 types (public_key::Secp256k1, signature::Secp256k1Signature, private_key::Secp256k1 and crypto::default::ecdsa_secp256k1) now come from k256 v0.14. The signature dependency is now only pulled in by the secp256k1 feature. Enabling the secp256k1 feature now requires Rust 1.87 (required by the patched crypto-bigint v0.7.6+ pulled in through k256 v0.14). (#1522)
• [tendermint-proto]: Update prost to v0.14 and tonic to v0.14. The grpc-server feature now also depends on tonic-prost. Generated message types now derive Eq and Hash where possible, and google::protobuf::Duration now implements Hash. The minimum supported Rust version for all crates is now 1.82 (required by prost v0.14), and is now declared via rust-version in each crate's manifest. (#1522)

SECURITY

• [tendermint-rpc] Update the HTTP and WebSocket clients to rustls 0.23.46 or later (and reqwest 0.12.5 or later), and require rustls-webpki 0.103.16 or later, which rejects certificate chains through the eMudhra intermediate CA keys distrusted by rustls-webpki

... (truncated)

Commits

• 729247b fix: bump dependencies to address untrusted certs (#1521)
• 910a34a chore: upgrade prost to 0.14.3 (#1522)
• a2aa5bf imp(tendermint)!: add &self to Verifier::verify for stateful verifiers (#1512)
• 86f8d07 fix(ci): remove no mangle from test panic handler (#1513)
• See full diff in compare view

[netlify]

✅ Deploy Preview for oasisprotocol-oasis-core canceled.

Name	Link
🔨 Latest commit	3d090c8
🔍 Latest deploy log	https://app.netlify.com/projects/oasisprotocol-oasis-core/deploys/6af32505594c102f98a0a700