nextest-rs/nextest cargo-nextest-0.9.149

cargo-nextest 0.9.149

on GitHub

Security

• cargo nextest self update no longer trusts the eMudhra intermediate certificate authorities whose private keys were disclosed on 2026-10-20. Previously, an attacker able to intercept network traffic could have used these keys to make cargo nextest self update download and install a malicious binary.

  Nextest's self-updater uses a bundled set of root certificates, so operating system and browser updates do not protect it. This release updates webpki-roots to 1.0.10 and rustls-webpki to 0.103.16, both of which distrust the compromised certificates.

  Running tests does not involve network access and is not affected. Builds without the self-update feature, including most distribution packages, are also not affected.

  Updating from an earlier version with cargo nextest self update would go through the affected code one last time. If you're concerned about your network being compromised, use one of the other installation methods instead.

Fixed

• On riscv64 Linux, cargo nextest self update no longer panics. (#3649)