[dependabot]

Bumps the crates group with 5 updates in the / directory:

Package	From	To
aws-lc-rs	1.18.2	1.19.0
aes	0.9.3	0.9.4
rustix	1.1.5	1.1.6
toml	1.1.8+spec-1.1.0	1.2.0+spec-1.1.0
zip	9.0.5	9.4.1

Updates aws-lc-rs from 1.18.2 to 1.19.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

• Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
  • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
• Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
  • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
• Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
  • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
• Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
  • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
• Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
  • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
  • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

• aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
• aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

• Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
  • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
  • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
• Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
  • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

• Implement Clone for rsa::KeyPair -- aws/aws-lc-rs#1260
• Expose AWS-LC FIPS on-demand self-test -- aws/aws-lc-rs#1261
• Add a way to specify the RSA-PSS salt length -- aws/aws-lc-rs#1263

Other Merged PRs

• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1264
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1265
• fix: satisfy Clippy deprecated-since lint and lint legacy-des in CI by @​justsmth in aws/aws-lc-rs#1269
• ci: keep upstream Cargo.lock in rustls integration by @​justsmth in aws/aws-lc-rs#1270
• ci: use dynamic musl CRT for ARM FIPS tests by @​justsmth in aws/aws-lc-rs#1271
• Prepare aws-lc-fips-sys v0.14.4 by @​justsmth in aws/aws-lc-rs#1275
• Prepare aws-lc-sys v0.47.0 by @​justsmth in aws/aws-lc-rs#1274
• Prepare aws-lc-rs v1.19.0 by @​justsmth in aws/aws-lc-rs#1278

New Contributors

• @​lokeswarivejju made their first contribution in aws/aws-lc-rs#1259
• @​johncarmack1984 made their first contribution in aws/aws-lc-rs#1273
• @​JakeHuneau made their first contribution in aws/aws-lc-rs#1277

... (truncated)

Commits

• 5d496f8 Prepare aws-lc-rs v1.19.0 (#1278)
• d099134 Feat: Add the ability to specify an RSA-PSS salt length (#1267)
• b639322 feat(signature): implement Clone for signing key pairs (#1277)
• 7548d5c Prepare aws-lc-sys v0.47.0 (#1274)
• a5862bd Prepare aws-lc-fips-sys v0.14.4 (#1275)
• 9bba3fb perf(builder): share cc's compiler detection across builds (#1273)
• 6a66144 Add Keccak-256 digest algorithm (unstable) (#1266)
• cf4f62b feat(fips): add on-demand AWS-LC self-test API (#1262)
• 825d0e3 feat: support AES OFB, CFB8 and CFB1 modes (#1259)
• c225ce4 Lower minimum system AWS-LC to 4.2.0 and add an unstable floor (#1268)
• Additional commits viewable in compare view

Updates aes from 0.9.3 to 0.9.4

Commits

• 9a84f2f Release aes v0.9.4 (#604)
• b99ebe6 aes: remove references to old aes_backend cfgs (#597)
• a7136b4 aes: add #[inline] attributes (#598)
• 2449027 aes: shrink AES round keys for AES fixslice backend (#594)
• 99c6b37 Tweak Cargo.toml files (#592)
• 0eb02c0 aes: test x86 backends with Miri (#591)
• See full diff in compare view

Updates rustix from 1.1.5 to 1.1.6

Commits

• 4a563ad chore: Release rustix version 1.1.6
• 8e6aaa6 Merge commit from fork
• 4686873 fix: expose additional termios output mode flags (#1709)
• c9ad9d3 fix(net): don't trust cmsg_len past the end of a truncated control buffer (...
• 98358af Avoid constructing a zero Pid in tcgetpgrp on non-Linux targets (#1710)
• 664aeae fix(net): use IPPROTO_IPV6 for IPV6_MULTICAST_HOPS (#1692)
• bf78ee6 freebsd: Fix cfg gates for FreeBSD 12 (#1707)
• b3d81bd Fix fallocate on Apple platforms. (#1708)
• 915ab6f fix(fs): Set proper inotify WatchFlags values on libc backend (#1714)
• 52d5db7 Use 32-bit UID/GID syscalls on arm, sparc, and x86 (#1716)
• Additional commits viewable in compare view

Updates toml from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0

Commits

• 8ffe3c5 chore: Release
• fa51878 docs: Update changelog
• f8ad91e perf(serde): Reuse key allocations (#1261)
• fe51467 perf(serde): Reuse key allocations
• 7024319 perf(writer): Expand coverage of the fast path (#1259)
• be196a8 perf(writer): Expand coverage of the fast path
• 932704c perf(serde): Pre-allocate serialization buffers (#1258)
• 52b563d perf(serde): Pre-allocate serialization buffers
• e346a79 perff(writer): Add key and string fast paths (#1257)
• ab695e6 perf(writer): Add a fast path for writing string types
• Additional commits viewable in compare view

Updates zip from 9.0.5 to 9.4.1

Release notes

Sourced from zip's releases.

v9.4.1

🐛 Bug Fixes

• Add a OwnedZipFileEntry for #177 (#1270)

🚜 Refactor

• Use boxed slices instead of Vec when growability isn't needed (#1271)

v9.4.0

🚀 Features

• Implement ZipIterable::files_with_reader (#1267)

v9.3.0

🚀 Features

• (write) implement TryFrom for PreparedZipFile (#1258)

v9.2.3

🐛 Bug Fixes

• (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

• Replace std:: with core:: where possible (#1253)

v9.2.2

🚜 Refactor

• Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

• Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.1

🚜 Refactor

• Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

• Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.0

🚀 Features

• (write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)

... (truncated)

Changelog

Sourced from zip's changelog.

9.4.1 - 2026-11-06

🐛 Bug Fixes

• Add a OwnedZipFileEntry for #177 (#1270)

🚜 Refactor

• Use boxed slices instead of Vec when growability isn't needed (#1271)

9.4.0 - 2026-11-05

🚀 Features

• Implement ZipIterable::files_with_reader (#1267)

9.3.0 - 2026-11-03

🚀 Features

• (write) implement TryFrom for PreparedZipFile (#1258)

9.2.3 - 2026-11-03

🐛 Bug Fixes

• (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

• Replace std:: with core:: where possible (#1253)

9.2.2 - 2026-11-01

🚜 Refactor

• Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

• Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

9.2.0 - 2026-10-31

🚀 Features

• (write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)
• add index_for_name_raw (#1210)
• (extract) multi-threaded parallel extraction engine and safe extent pre-allocation (#1207)
• (read) add index-free iterable ZIP reader (#1218)

... (truncated)

Commits

• 96e8cce chore: release v9.4.1 (#1272)
• f1b82f2 docs(example): Fix bug in memory-tracking example where reallocations were co...
• 2308d6d refactor: Use boxed slices instead of Vec when growability isn't needed (#1271)
• b3ad5df fix: Add a OwnedZipFileEntry for #177 (#1270)
• 196b805 chore(deps): update lzma-rust2 from 0.24 to 0.25 (#1268)
• f347dd4 chore: release v9.4.0 (#1269)
• e9b7dcd feat: Implement ZipIterable::files_with_reader (#1267)
• 47765a9 docs(security): Clarify that some "vulnerabilities" are necessary for legitim...
• 53cfe46 ci(deps): bump useblacksmith/checkout from 1.8.1 to 1.8.2 (#1260)
• b66f6b1 ci(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 (#1262)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.