[dependabot]

Bumps ic-agent from 0.49.2 to 0.49.3.

Changelog

Sourced from ic-agent's changelog.

[0.49.3] - 2026-10-22

Fixed

• ic-agent: Malformed data in a validly signed certificate now returns an error instead of panicking. A subnet could previously crash the agent by certifying a node ID longer than 29 bytes under /subnet/<id>/node, or a bare leaf at /canister_ranges/<subnet_id> or /api_boundary_nodes. This affected Agent::fetch_subnet_by_id, Agent::fetch_subnet_by_canister and Agent::fetch_api_boundary_nodes_by_{canister,subnet}_id. An oversized subnet_id in a delegation is now rejected the same way.
• ic-agent: Canister-to-subnet resolution now only uses canister ranges that came from an NNS-root-signed delegation. Agent::fetch_subnet_by_id previously cached the ranges from the certificate's outer tree, which the subnet signs itself, and those ranges are not authoritative for deciding which subnet may answer for a given canister. Resolution now stays with Agent::fetch_subnet_by_canister, which validates ranges against the delegation and enforces containment. Subnets fetched by ID are still cached by ID for their node keys, and still report their self-declared ranges via Subnet::iter_canister_ranges and Subnet::contains_canister; those are now documented as non-authoritative on that path. Update calls and read_state are unchanged — they re-derive ranges from the delegation on every call.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)