[velocitysystems]

Closes #16

Problem

eMudhra reported eight compromised intermediate CA keys. On Android, the plugin verifies server certificates against the bundled Mozilla roots in webpki-root-certs. Version 1.0.9 contains "emSign ECC Root CA - G3". This root signs the compromised intermediates (RUSTSEC-2026-0383).

Change

• Set the minimum version of webpki-root-certs to 1.0.10. This version removes the emSign root. Host apps cannot build with an older version.
• Update the lockfiles to rustls-webpki 0.103.16. This version rejects the compromised intermediates (RUSTSEC-2026-0382). The plugin does not use rustls-webpki directly, so Cargo.toml does not set a minimum version for it.
• rustls-webpki 0.103.16 needs aws-lc-rs 1.18. The root lockfile uses 1.18.1, the same version as the example app.
• Correct the plugin version in the example app lockfile from 0.2.0 to 0.1.0. Before this change, cargo metadata --locked failed in the example app.

silvermine/tauri-plugin-media-parser#27 makes the same change in the media parser plugin.

Tests

• All 277 Rust tests and 7 doctests pass with --locked.
• cargo clippy --all-targets shows no warnings.
• The Android build was not tested.