Update Rust crate boring to v5

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
boring	workspace.dependencies	major	4.22.0 → 5.0.0

---

Release Notes

cloudflare/boring (boring)

v5.2.0: 5.2.0

Compare Source

What's Changed

• CI improvements by @​kornelski in #​490
• unsafe_op_in_unsafe_fn by @​kornelski in #​493
• ci: add Semgrep OSS scanning workflow by @​hrushikeshdeshpande in #​501
• Expose DTLS version constants in SslVersion by @​vynious in #​503
• Let crates detect boring-sys version by @​kornelski in #​506
• Bump BoringSSL to latest and update patches by @​cjpatton in #​499
• boring-sys: Bump BoringSSL to e2a57cf by @​cjpatton in #​509
• Fix dangling pointer in X509StoreContextRef::set_verify_param by @​TheJokr in #​508
• Pingora's patch disabling cert version validation for extensions by @​kornelski in #​495
• Expose TLS signature algorithm and per-connection sigalg preferences by @​lukevalenta in #​513
• MLDSA for Pingora by @​kornelski in #​497
• ci,mac: bew trust messense/macos-cross-toolchains by @​bwesterb in #​516
• ML-DSA: add private->public and public key marshalling by @​bwesterb in #​515
• Avoid panicking methods by @​kornelski in #​483
• boring-sys: add tvOS target support by @​gengjiawen in #​519

New Contributors

• @​vynious made their first contribution in #​503
• @​lukevalenta made their first contribution in #​513
• @​gengjiawen made their first contribution in #​519

Full Changelog: cloudflare/boring@v5.1.0...v5.1.1

What's Changed

• CI improvements by @​kornelski in #​490
• unsafe_op_in_unsafe_fn by @​kornelski in #​493
• ci: add Semgrep OSS scanning workflow by @​hrushikeshdeshpande in #​501
• Expose DTLS version constants in SslVersion by @​vynious in #​503
• Let crates detect boring-sys version by @​kornelski in #​506
• Bump BoringSSL to latest and update patches by @​cjpatton in #​499
• boring-sys: Bump BoringSSL to e2a57cf by @​cjpatton in #​509
• Fix dangling pointer in X509StoreContextRef::set_verify_param by @​TheJokr in #​508
• Pingora's patch disabling cert version validation for extensions by @​kornelski in #​495
• Expose TLS signature algorithm and per-connection sigalg preferences by @​lukevalenta in #​513
• MLDSA for Pingora by @​kornelski in #​497
• ci,mac: bew trust messense/macos-cross-toolchains by @​bwesterb in #​516
• ML-DSA: add private->public and public key marshalling by @​bwesterb in #​515
• Avoid panicking methods by @​kornelski in #​483
• boring-sys: add tvOS target support by @​gengjiawen in #​519
• Add relax-rsa-key-usage feature to restore historical RSA keyUsage by @​johnhurt in #​512

New Contributors

• @​vynious made their first contribution in #​503
• @​lukevalenta made their first contribution in #​513
• @​gengjiawen made their first contribution in #​519

Full Changelog: cloudflare/boring@v5.1.0...v5.2.0

v5.1.0: 5.1.0

Compare Source

What's Changed

• Added used_hello_retry_request function by @​icrutche in #​481
• Export pre-built libraries for packaging by @​kornelski in #​485
• Add TLS 1.2 PRF module and bindings by @​janrueth in #​487
• Add generic PKey private key generation API by @​janrueth in #​488
• Add EVP_AEAD-based detached AEAD module by @​janrueth in #​486

New Contributors

• @​icrutche made their first contribution in #​481
• @​janrueth made their first contribution in #​487

Full Changelog: cloudflare/boring@v5.0.2...v5.1.0

v5.0.2

Compare Source

What's Changed

• boring-sys: Support static MSVC runtime by @​jrose-signal in #​475
• Sync methods with rust-openssl by @​kornelski in #​477
• Don't add build/ to non-FIPS pre-built path + v4 compat alias by @​kornelski in #​474

For major changes in v5 see: https://github.com/cloudflare/boring/releases/tag/v5.0.0

Full Changelog: cloudflare/boring@v5.0.1...v5.0.2

v5.0.1

Compare Source

• Improved building with older versions of upstream BoringSSL C headers #​469
• Added mlkem and credential Cargo features for new BoringSSL APIs.

See v5.0.0 for major changes.

v5.0.0

Compare Source

Breaking changes

Upgrade to 4.21.1 first and fix any deprecation warnings.

Cargo features removed/simplified

• FIPS only needs the fips Cargo feature, and the rest is customized via env vars (like BORING_BSSL_FIPS_PATH): #​383
• Removed the "kx-*" features #​393
• Post-quantum is enabled by default (X25519MLKEM768 and P256Kyber768Draft00) and the "pq-experimental" Cargo feature flag is not used any more.

Other semver changes

• Updated BoringSSL to a newer version with updated patches by @​nox in #​419
• Removed SslCurve API. Identifying curves by name is more reliable across different builds of BoringSSL. Use SslRef::curve_name() instead #​390 #​396
• Removed deprecated X509CheckFlags #​425
• X509Store is now cheaply cloneable, but immutable. SslContextBuilder.cert_store_mut() can't be used after .set_cert_store(). If you need .cert_store_mut(), either don't overwrite the default store, or use .set_cert_store_builder() #​426
• X509StoreBuilder::add_cert takes a reference.
• Hyper version upgraded from v0 to v1
• set_ex_data() will always Drop previous values #​424
• Removed blanket Eq from FFI types
• BIO_set_retry_write on WouldBlock @​ihciah in #​118

Added

• Added ML-KEM-768 and ML-KEM-1024 support #​455 #​456 #​462
• Added init-update-finalize API for HMAC #​459
• set_strict_cipher_list by @​abernardeau-wallix in #​416
• Added set_ticket_key_callback by @​toidiu in #​330
• SslCipherRef::protocol_id by @​nox in #​409

Full Changelog: cloudflare/boring@v4.20.0...v5.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace
    Updating crates.io index
error: failed to select a version for `boring-sys`.
    ... required by package `boring v5.0.1`
    ... which satisfies dependency `boring = "^5.0.0"` of package `usque-masque v0.1.0 (/tmp/renovate/repos/github/FireMasterK/usque-rs/crates/usque-masque)`
    ... which satisfies path dependency `usque-masque` (locked to 0.1.0) of package `usque-cli v0.1.0 (/tmp/renovate/repos/github/FireMasterK/usque-rs/crates/usque-cli)`
versions that meet the requirements `^5.0.1` are: 5.2.0, 5.1.0, 5.0.2, 5.0.1

package `boring-sys` links to the native library `boringssl`, but it conflicts with a previous package which links to `boringssl` as well:
package `boring-sys v4.3.0`
    ... which satisfies dependency `boring-sys = "^4.3.0"` of package `boring v4.3.0`
    ... which satisfies dependency `boring = "^4.3"` of package `tokio-quiche v0.19.0`
    ... which satisfies dependency `tokio-quiche = "^0.19"` of package `usque-masque v0.1.0 (/tmp/renovate/repos/github/FireMasterK/usque-rs/crates/usque-masque)`
    ... which satisfies path dependency `usque-masque` (locked to 0.1.0) of package `usque-cli v0.1.0 (/tmp/renovate/repos/github/FireMasterK/usque-rs/crates/usque-cli)`
note: only one package in the dependency graph may specify the same links value to ensure that only one copy of a native library is linked in the final binary
for more information, see https://doc.rust-lang.org/cargo/reference/resolver.html#links
help: try to adjust your dependencies so that only one package uses the `links = "boringssl"` value

failed to select a version for `boring-sys` which could resolve this conflict