chore(deps): bump the root-deps group with 2 updates

[dependabot]

Bumps the root-deps group with 2 updates: bitflags and rustls-webpki.

Updates bitflags from 2.11.0 to 2.11.1

Release notes

Sourced from bitflags's releases.

2.11.1

What's Changed

• Bless compile-fail tests for current beta by @​DanielEScherzer in bitflags/bitflags#478
• example_generated.rs: add missing third slash for doc comment by @​DanielEScherzer in bitflags/bitflags#477
• Clarify self and other in method docs by @​KodrAus in bitflags/bitflags#481
• Prepare for 2.11.1 release by @​KodrAus in bitflags/bitflags#482

New Contributors

• @​DanielEScherzer made their first contribution in bitflags/bitflags#478

Full Changelog: bitflags/bitflags@2.11.0...2.11.1

Changelog

Sourced from bitflags's changelog.

2.11.1

What's Changed

• Bless compile-fail tests for current beta by @​DanielEScherzer in bitflags/bitflags#478
• example_generated.rs: add missing third slash for doc comment by @​DanielEScherzer in bitflags/bitflags#477
• Clarify self and other in method docs by @​KodrAus in bitflags/bitflags#481

New Contributors

• @​DanielEScherzer made their first contribution in bitflags/bitflags#478

Full Changelog: bitflags/bitflags@2.11.0...2.11.1

Commits

• 4ed9ffa Merge pull request #482 from KodrAus/cargo/2.11.1
• c53cd57 prepare for 2.11.1 release
• a44410a Merge pull request #481 from KodrAus/docs/clarifications
• 3d671b9 update more compile error messages
• 5f3adad fix up compile error messages
• 780765d fix up contains and intersection docs
• 97b7607 clarify self and other in method docs
• 88a7a18 Merge pull request #477 from DanielEScherzer/patch-1
• f0e4646 example_generated.rs: add missing third slash for doc comment
• a31c96f Merge pull request #478 from DanielEScherzer/beta-bless
• Additional commits viewable in compare view

Updates rustls-webpki from 0.103.11 to 0.103.12

Release notes

Sourced from rustls-webpki's releases.

0.103.12

This release fixes two bugs in name constraint enforcement:

• GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
• GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

• Prepare 0.103.12 by @​djc in rustls/webpki#470

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

Commits

• 27131d4 Bump version to 0.103.12
• 6ecb876 Clean up stuttery enum variant names
• 318b3e6 Ignore wildcard labels when matching name constraints
• 1219622 Rewrite constraint matching to avoid permissive catch-all branch
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.