Skip to content

fix: update aws-lc-rs to resolve 5 security advisories#687

Merged
bnusunny merged 1 commit intomainfrom
fix/update-aws-lc-sys-security-audit
Mar 26, 2026
Merged

fix: update aws-lc-rs to resolve 5 security advisories#687
bnusunny merged 1 commit intomainfrom
fix/update-aws-lc-sys-security-audit

Conversation

@bnusunny
Copy link
Copy Markdown
Contributor

Summary

Update aws-lc-rs 1.15.4 → 1.16.2 and aws-lc-sys 0.37.0 → 0.39.0 to resolve 5 RustSec advisories:

Advisory Severity Title
RUSTSEC-2026-0044 High X.509 Name Constraints Bypass via Wildcard/Unicode CN
RUSTSEC-2026-0045 Medium Timing Side-Channel in AES-CCM Tag Verification
RUSTSEC-2026-0046 High PKCS7_verify Certificate Chain Validation Bypass
RUSTSEC-2026-0047 High PKCS7_verify Signature Validation Bypass
RUSTSEC-2026-0048 High CRL Distribution Point Scope Check Logic Error

Impact

These are dev-dependencies only (via hyper-rustls used in e2e tests) and do not affect the release binary. This change clears the daily cargo audit CI check.

Changes

  • Lockfile-only update (Cargo.lock), no code or Cargo.toml changes.

Update aws-lc-rs 1.15.4 -> 1.16.2 and aws-lc-sys 0.37.0 -> 0.39.0
to resolve RUSTSEC-2026-0044, RUSTSEC-2026-0045, RUSTSEC-2026-0046,
RUSTSEC-2026-0047, and RUSTSEC-2026-0048. These are dev-dependencies
only (via hyper-rustls) and do not affect the release binary, but
this clears the daily cargo audit CI check.
@bnusunny bnusunny merged commit 3344863 into main Mar 26, 2026
7 checks passed
@bnusunny bnusunny deleted the fix/update-aws-lc-sys-security-audit branch March 26, 2026 22:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants