Thank you for the help here.

I am not deeply familiar with webpki and rustls-webpki history. In case there are any resources you can point me to, that would be much appreciated.

I'm not that familiar myself, but the report at https://rustsec.org/advisories/RUSTSEC%2D2023%2D0052.html suggests that it is a maintained version, while from the looks of it the original webpki is indeed unmaintained - last commit was 2 years ago.

See https://github.com/rustls/webpki and https://github.com/briansmith/webpki.

I think this is ready to merge now; I'm afraid this is the last low-hanging fruit here, and the rest requires going to webrtc and other upstreams and fixing it there.

It's unlikely I'll be going that myself in the near future, but hey there are plenty of other people who might be willing to fix it there, so I suggest just keeping an eye on the rest of the deps for now and waiting a bit to see if maybe they ship a new, fixed version.