build(deps): bump the minor-patch group across 1 directory with 5 updates

[dependabot]

Bumps the minor-patch group with 5 updates in the / directory:

Package	From	To
aws-lc-rs	1.17.3	1.18.0
base64	0.23.0	0.23.1
bytesize	2.4.2	2.7.0
eyre	0.6.12	0.6.14
futures-util	0.3.33	0.3.34

Updates aws-lc-rs from 1.17.3 to 1.18.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.0

AWS-LC-FIPS module updated to 4.x

This release switches aws-lc-fips-sys (used via the fips feature) from the AWS-LC-FIPS 3.x branch to AWS-LC-FIPS 4.0.

• If your project requires FIPS compliance, please consult your local FIPS compliance experts before upgrading. The FIPS v3 module shipped in aws-lc-rs v1.17.x is FIPS 140-3 validated ([Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) static, [Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) dynamic). The 4.x module has completed validation testing by an accredited lab and has been submitted to NIST for certification. Refer to the CMVP Modules In Progress List for its current status, and to FIPS.md for security policies and supported operating environments.
• Consumers who need to remain on the FIPS 3.x module should pin aws-lc-rs to <1.18.0. See the Cargo Book on Specifying Dependencies.

AWS-LC-FIPS module	aws-lc-rs
2.0.x	<1.12.0
3.0.x	<1.18.0
4.x	latest

What's Changed

• Switch aws-lc-fips-sys to AWS-LC's "FIPS 4.0" branch by @​justsmth in aws/aws-lc-rs#1185
  • aws-lc-fips-sys v0.13.16 -> v0.14.0. Please see the call-out above.
• The ML-DSA signature APIs are now stable 🎉 by @​justsmth in aws/aws-lc-rs#1188 and aws/aws-lc-rs#1189
  • PqdsaKeyPair, PqdsaPublicKey, PqdsaPrivateKey, PqdsaSigningAlgorithm, PqdsaVerificationAlgorithm, and the ML_DSA_44 / ML_DSA_65 / ML_DSA_87 algorithms (and their _SIGNING counterparts) now live in aws_lc_rs::signature. ML-DSA no longer requires the unstable feature, and is now available under fips -- the FIPS 4.0 module provides ML-DSA, which is what had kept these APIs unstable. See our updated API documentation.
  • Please migrate any use of aws_lc_rs::unstable::signature to aws_lc_rs::signature. The unstable::signature module remains as deprecated aliases and will be removed in a future release.
  • PqdsaKeyPair::to_pkcs8 has been renamed to to_pkcs8v1, since elsewhere in the module an unqualified to_pkcs8 means PKCS#8 v2. A deprecated to_pkcs8 alias remains available under the unstable feature.
  • Existing unstable consumers continue to compile, with deprecation warnings. Two cases need a source change: builds using #![deny(warnings)], and code that glob-imports both signature::* and unstable::signature::*, which now needs an explicit import to disambiguate.
  • Behavior change: PqdsaVerificationAlgorithm::parsed_verify_digest_sig now always returns Unspecified. Digest-then-verify is not an operation defined by FIPS 204 -- pure ML-DSA signs the message itself, and the pre-hash variant (HashML-DSA) uses a distinct domain separator that this API does not implement.
• Add out-of-place AEAD sealing by @​iainmcgin in aws/aws-lc-rs#1183
  • Adds seal_separate_out_of_place to LessSafeKey and TlsRecordSealingKey. Every sealing entry point was previously in-place, so a caller whose plaintext was borrowed or shared had to copy it into a scratch buffer purely to make it mutable. This mirrors the existing open_separate_gather, so the sealing and opening directions now match.
• Add rsa::KeyPair::from_components for constructing RSA key pairs from raw components by @​justsmth in aws/aws-lc-rs#1175
  • Adds rsa::KeyPairComponents and rsa::KeyPair::from_components, matching ring 0.17, so a signing key can be built from formats such as JWK without first encoding the components as DER. Unlike ring, d and the CRT parameters are validated at construction using RSA_check_key, so keys with inconsistent or placeholder values that ring accepts may be rejected. Unnecessary generic bounds were also removed from PublicKeyComponents.
• Automatically optimize aws-lc for size when opt-level is "s" or "z" by @​justsmth in aws/aws-lc-rs#1159
  • The builder now enables AWS-LC's size-optimized configuration (OPENSSL_SMALL, and no AVX-512 assembly on x86_64) whenever Cargo is already building for size. In CI, a small binary exercising SHA-256, AES-256-GCM, and ECDSA P-256 is 36-50% smaller at opt-level=z than at opt-level=3: 50% on x86_64 Linux, 48% on aarch64 macOS, 39% on x86_64 Windows, 36% on aarch64 Linux. Your own savings depend on how much of AWS-LC your binary retains.
  • No algorithms are removed and outputs are unchanged; the trade-off is slower elliptic-curve performance. Set AWS_LC_SYS_SMALL=1/=0 to force it on or off independently of opt-level.
  • FIPS builds do not opt in automatically: aws-lc-fips-sys requires an explicit AWS_LC_FIPS_SYS_SMALL=1, and warns when it is set.
  • Partially addresses aws/aws-lc-rs#745; the default size under opt-level=3 footprint is unchanged.
• Export native library build metadata from the -sys crates by @​justsmth in aws/aws-lc-rs#1187, including original commits from @​glebpom in aws/aws-lc-rs#1184
  • Downstream build scripts compiling C code against AWS-LC can now locate our artifacts via DEP_AWS_LC_* / DEP_AWS_LC_FIPS_* (libdir, libcrypto_path, link_kind, and libssl_path with ssl), consistently across the CC, CMake, and system-library build paths. Existing linker directives are unchanged. On Windows, the *_path values are the link-time artifact (import library), not the runtime DLL.
• Key wrap hardening by @​justsmth in aws/aws-lc-rs#1190 and aws/aws-lc-rs#1191
  • KeyEncryptionKey::unwrap no longer underflows on ciphertexts shorter than 8 bytes. Since the ciphertext is untrusted input, builds with overflow-checks = true would panic instead of returning the documented Err(Unspecified); default release builds were unaffected.
  • KeyEncryptionKey now zeroizes its key material on drop, consistent with the other key types in this crate.
• docs(signature): correct outdated note about signing a separate digest by @​WesleyRosenblum in aws/aws-lc-rs#1186

Upstream AWS-LC (v5.5.0)

aws-lc-sys v0.44.0 aligns with AWS-LC v5.5.0 (previously v5.2.0). See also the release notes for v5.3.0 and v5.4.0.

Build Improvements

• Fix bindings copy from read-only prebuilt AWS-LC install by @​justsmth in aws/aws-lc-rs#1194
  • Copies into OUT_DIR now remove any stale destination first and leave the fresh copy writable, so building against a read-only prebuilt install (e.g. the Nix store) no longer fails with Permission denied on a build-script rerun. An OUT_DIR already poisoned by an earlier build now recovers without a cargo clean.

Issues Being Closed

• ML-DSA stabilization? -- aws/aws-lc-rs#964
• Expose out-of-place AEAD sealing -- aws/aws-lc-rs#1182

... (truncated)

Commits

• f464440 Prepare aws-lc-rs v1.18.0 (#1200)
• 7085f8b Fix bindings copy from read-only prebuilt AWS-LC install (#1194)
• 2196440 Export native library build metadata from the -sys crates (#1187)
• 623100f Prepare aws-lc-sys v0.44.0 (#1199)
• 90c687e Add rsa::KeyPair::from_components for constructing RSA key pairs from raw c...
• b84076f Automatically optimize aws-lc for size when opt-level is "s" or "z" (#1159)
• 5a5408b Publish script fixes: cargo clean failure, and verify aws-lc-rs against minim...
• a23dd38 ci: fix mdbook test failure and run docs checks on PRs (#1181)
• 390622e fix: align PQDSA API with signature module conventions (#1189)
• 4b0cb00 docs(signature): correct outdated note about signing a separate digest (#1186)
• Additional commits viewable in compare view

Updates base64 from 0.23.0 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• See full diff in compare view

Updates bytesize from 2.4.2 to 2.7.0

Release notes

Sourced from bytesize's releases.

bytesize: v2.7.0

• Remove no-alloc support because it removed ByteSize::display() when default features were disabled.

bytesize: v2.6.0

• Add display styles for IEC and SI bit units.

(yanked)

bytesize: v2.5.0

• Honor precision when a width is set with formatting args.
• Add #[no_alloc] support.

(yanked)

Changelog

Sourced from bytesize's changelog.

2.7.0

• Remove no-alloc support because it removed ByteSize::display() when default features were disabled.

2.6.0

• Add display styles for IEC and SI bit units.

2.5.0

• Honor precision when a width is set with formatting args.
• Add #[no_alloc] support.

Commits

• a854b58 chore(bytesize): prepare release 2.7.0
• fe908fb fix: restore display without default features (#192)
• 18f6be4 chore(deps): bump serde from 1.0.228 to 1.0.229 (#184)
• 76da7d5 chore(deps): bump toml from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0 (#185)
• 56ba3dc chore(deps): bump serde_json from 1.0.150 to 1.0.151 (#186)
• 2a061ff chore(deps): bump taiki-e/install-action from 2.82.7 to 2.85.4 (#187)
• 2473dc1 chore(deps): bump MarcoIeni/release-plz-action from 0.5.130 to 0.5.131 (#188)
• 1c58e4d chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#189)
• 5c53c89 chore: release v2.6.0 (#183)
• 7d326c0 feat: display in bits (#110)
• Additional commits viewable in compare view

Updates eyre from 0.6.12 to 0.6.14

Commits

• b7014af 0.6.14
• 704488e Revert "Make ContextCompat consistent and non-ambiguous with WrapErr (#138, #...
• 3ce35d4 Backport future incompat fix, release 0.6.13 (#296)
• 41042dc Bump to 0.6.13
• 4564219 Remove pyo3 feature (#278)
• f5f5d90 Don't emit trailing semicolon from bail! (#294)
• 154c8de Eliminate pointer->reference->pointer during downcast (#286)
• d83c1e7 Use std backtrace on stable (#284)
• 786879d Add default type parameter value of T = () to eyre::Result\<T> (#273)
• 8c27860 Fix compile probe and nightly backtraces (#160)
• Additional commits viewable in compare view

Updates futures-util from 0.3.33 to 0.3.34

Release notes

Sourced from futures-util's releases.

0.3.34

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Changelog

Sourced from futures-util's changelog.

0.3.34 - 2026-08-11

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Commits

• 705e6b5 Release 0.3.34
• 616dac7 compat: Inline RawWaker clone function
• 4176369 Inline remaining RawWaker clone functions
• f17a895 Fix cloned FuturesUnordered waker identity
• 51d62ad macro: bump syn to v3 (#3028)
• 9e26177 ci: Reduce timeout-minutes
• b2d0983 tsan: Enable Adaptive Delay
• f733d0e Miri: Ignore compat tests
• e5def2f Rename default branch to main
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions