[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aws-lc-rs	workspace.dependencies	minor	1.18.2 → 1.19.0

---

Release Notes

aws/aws-lc-rs (aws-lc-rs)

v1.19.0: aws-lc-rs v1.19.0

Compare Source

What's Changed

• Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in #​1259
  • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
• Add an on-demand AWS-LC self-test API by @​Elvrarin in #​1262
  • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
• Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in #​1266
  • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
• Add configurable RSA-PSS salt lengths by @​PaulDance in #​1267
  • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
• Implement Clone for signing key pairs by @​JakeHuneau in #​1277
  • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
  • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

• aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
• aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

• Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in #​1268
  • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
  • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
• Share cc compiler detection across builds by @​johncarmack1984 in #​1273
  • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

• Implement Clone for rsa::KeyPair -- #​1260
• Expose AWS-LC FIPS on-demand self-test -- #​1261
• Add a way to specify the RSA-PSS salt length -- #​1263

Other Merged PRs

• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in #​1264
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in #​1265
• fix: satisfy Clippy deprecated-since lint and lint legacy-des in CI by @​justsmth in #​1269
• ci: keep upstream Cargo.lock in rustls integration by @​justsmth in #​1270
• ci: use dynamic musl CRT for ARM FIPS tests by @​justsmth in #​1271
• Prepare aws-lc-fips-sys v0.14.4 by @​justsmth in #​1275
• Prepare aws-lc-sys v0.47.0 by @​justsmth in #​1274
• Prepare aws-lc-rs v1.19.0 by @​justsmth in #​1278

New Contributors

• @​lokeswarivejju made their first contribution in #​1259
• @​johncarmack1984 made their first contribution in #​1273
• @​JakeHuneau made their first contribution in #​1277
• @​PaulDance made their first contribution in #​1267

Full Changelog: aws/aws-lc-rs@v1.18.2...v1.19.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.