Skip to content

Bump the crates group with 3 updates - #17

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/cargo/develop/crates-2b0ffb0a5e
Open

Bump the crates group with 3 updates#17
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/cargo/develop/crates-2b0ffb0a5e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the crates group with 3 updates: aws-lc-rs, rustix and zip.

Updates aws-lc-rs from 1.18.2 to 1.19.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

  • Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
    • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
  • Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
    • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
  • Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
    • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
  • Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
    • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
  • Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
    • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
    • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

  • aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
  • aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

  • Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
    • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
    • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
  • Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
    • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

Other Merged PRs

New Contributors

... (truncated)

Commits

Updates rustix from 1.1.5 to 1.1.6

Commits
  • 4a563ad chore: Release rustix version 1.1.6
  • 8e6aaa6 Merge commit from fork
  • 4686873 fix: expose additional termios output mode flags (#1709)
  • c9ad9d3 fix(net): don't trust cmsg_len past the end of a truncated control buffer (...
  • 98358af Avoid constructing a zero Pid in tcgetpgrp on non-Linux targets (#1710)
  • 664aeae fix(net): use IPPROTO_IPV6 for IPV6_MULTICAST_HOPS (#1692)
  • bf78ee6 freebsd: Fix cfg gates for FreeBSD 12 (#1707)
  • b3d81bd Fix fallocate on Apple platforms. (#1708)
  • 915ab6f fix(fs): Set proper inotify WatchFlags values on libc backend (#1714)
  • 52d5db7 Use 32-bit UID/GID syscalls on arm, sparc, and x86 (#1716)
  • Additional commits viewable in compare view

Updates zip from 9.0.5 to 9.1.3

Release notes

Sourced from zip's releases.

v9.1.3

🚀 Features

  • (extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

  • (format) record correct 32-bit EOCD offset in ZIP64 archives (#1205)
  • (aes) wipe AES round keys when the cipher is dropped (#1204)
  • (fuzz) treat a comment change in a merged sub-writer as non-streamable (#1188)
  • (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#1196)
  • (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#1195)
  • (write) drop a stale Unicode Path extra field when copying an entry (#1187)
  • (write) don't leave a stale tail that completes a fake EOCD in the comment (#1186)
  • (write) reject deflate levels below 10 when only zopfli is enabled (#1182)

⚡ Performance

  • (read) accelerate extraction with 64 KiB reusable buffer (#1206)
  • (aes) encrypt AES-CTR counter blocks in batches (#1203)
  • (read) eliminate double allocation by populating IndexMap directly (#1200)
  • (read) preallocate files vector in read_central_header (#1199)

v9.1.1

🐛 Bug Fixes

  • store the raw count instead of a bool (#1174)
  • preserve extra fields in raw_copy_file_touch (#1172)
  • (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
  • (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

v9.1.0

🚀 Features

  • (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
  • Add borrowing inner method to reader wrappers (#1050)
  • add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
  • add file_names_raw iterator (#1082)

🐛 Bug Fixes

  • raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
  • (write) prevent seek panic on streaming writer with comment (#1151)
  • Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
  • apply unix permissions at creation (#1104)
  • raw_copy_file should work with any extra fields (#1120)
  • (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
  • don't enable typed-path's default std feature (#1112)
  • ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
  • resolve decoded CP437 member names (#1080) (#1085)

... (truncated)

Changelog

Sourced from zip's changelog.

9.1.3 - 2026-10-27

🚀 Features

  • (extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

  • (format) record correct 32-bit EOCD offset in ZIP64 archives (#1205)
  • (aes) wipe AES round keys when the cipher is dropped (#1204)
  • (fuzz) treat a comment change in a merged sub-writer as non-streamable (#1188)
  • (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#1196)
  • (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#1195)
  • (write) drop a stale Unicode Path extra field when copying an entry (#1187)
  • (write) don't leave a stale tail that completes a fake EOCD in the comment (#1186)
  • (write) reject deflate levels below 10 when only zopfli is enabled (#1182)

⚡ Performance

  • (read) accelerate extraction with 64 KiB reusable buffer (#1206)
  • (aes) encrypt AES-CTR counter blocks in batches (#1203)
  • (read) eliminate double allocation by populating IndexMap directly (#1200)
  • (read) preallocate files vector in read_central_header (#1199)

9.1.2 - 2026-10-26

🐛 Bug Fixes

  • preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
  • (write) reject a Unicode Path extra field that would rename the entry (#1177)
  • (extract) prevent following symbolic links during file creation (#1116)

9.1.1 - 2026-10-25

🐛 Bug Fixes

  • store the raw count instead of a bool (#1174)
  • preserve extra fields in raw_copy_file_touch (#1172)
  • (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
  • (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

  • (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
  • Add borrowing inner method to reader wrappers (#1050)
  • add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
  • add file_names_raw iterator (#1082)

... (truncated)

Commits
  • af2ed2a chore: release v9.1.3 (#1185)
  • 019776a perf(read): accelerate extraction with 64 KiB reusable buffer (#1206)
  • 5b5c4a0 fix(format): record correct 32-bit EOCD offset in ZIP64 archives (#1205)
  • 20e809a perf(aes): encrypt AES-CTR counter blocks in batches (#1203)
  • 9865299 fix(aes): wipe AES round keys when the cipher is dropped (#1204)
  • e656c5d perf(read): eliminate double allocation by populating IndexMap directly (#1200)
  • 2431276 perf(read): preallocate files vector in read_central_header (#1199)
  • 09d6a8b ci: Manually update version to 9.1.3 (#1202)
  • f2fe6c4 feat(extra_fields): support 0xd935 Android ZIP alignment extra field (#928) (...
  • 5125442 test(fuzz): tolerate reopen failures once the comment holds an EOCD signature...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the crates group with 3 updates
e2227b3 
Bumps the crates group with 3 updates: [aws-lc-rs](https://github.com/aws/aws-lc-rs), [rustix](https://github.com/bytecodealliance/rustix) and [zip](https://github.com/zip-rs/zip2).


Updates `aws-lc-rs` from 1.18.2 to 1.19.0
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@v1.18.2...v1.19.0)

Updates `rustix` from 1.1.5 to 1.1.6
- [Release notes](https://github.com/bytecodealliance/rustix/releases)
- [Changelog](https://github.com/bytecodealliance/rustix/blob/main/CHANGES.md)
- [Commits](bytecodealliance/rustix@v1.1.5...v1.1.6)

Updates `zip` from 9.0.5 to 9.1.3
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v9.0.5...v9.1.3)

---
updated-dependencies:
- dependency-name: aws-lc-rs
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crates
- dependency-name: rustix
  dependency-version: 1.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crates
- dependency-name: zip
  dependency-version: 9.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants