chore(deps): bump the crypto-tls group across 1 directory with 3 updates

[dependabot]

Bumps the crypto-tls group with 3 updates in the / directory: rustls, rustls-pki-types and aws-lc-rs.

Updates rustls from 0.23.41 to 0.23.42

Commits

• 411fb02 Bump version to 0.23.42
• aff9845 implement rfc 9149 ticket_request extension
• 8bd3d1b server: add max_tls13_tickets configuration
• 4cce222 Address new std_instead_of_core in nightly
• d3ffdc1 Address new std_instead_of_core in nightly
• 75d1b7a Take semver-compatible dependency updates
• See full diff in compare view

Updates rustls-pki-types from 1.14.0 to 1.15.0

Release notes

Sourced from rustls-pki-types's releases.

v/1.15.0

New feature: add a constructor for FipsStatus::Certified.

What's Changed

• ci: sync cargo-check-external-types nightly by @​cpu in rustls/pki-types#109
• 1.15.0: ensure FipsStatus::Certified is usable by @​ctz in rustls/pki-types#110

Full Changelog: rustls/pki-types@v/1.14.1...v/1.15.0

1.14.1

Parsing PEM will now error for PEM sections larger than 256 MB in size, to avoid running out of memory during parsing. The limit was chosen based on historical data from large certificate revocation lists from the web PKI.

What's Changed

• Remove mention of rustls-pemfile from docs by @​ranile in rustls/pki-types#103
• Update ECH reference to RFC9849 by @​ctz in rustls/pki-types#104
• pem: error for sections that are too large by @​djc in rustls/pki-types#106
• Update ECH reference to RFC 9849 by @​ctz in rustls/pki-types#107
• Adjust PEM size limit to account for huge CRLs by @​ctz in rustls/pki-types#108

Commits

• ab46a65 Prepare 1.15.0
• 13d2dee Ensure FipsStatus::Certified is usable
• 23bc39f ci: sync cargo-check-external-types nightly
• bb3c1da Adjust PEM size limit to account for huge CRLs
• 20bcfe1 Bump version to 1.14.1
• b796d3d pem: error for sections that are too large
• 422d8cf Update ECH reference to RFC 9849
• 14ce65c Remove mention of rustls-pemfile from docs
• See full diff in compare view

Updates aws-lc-rs from 1.17.1 to 1.17.3

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.3

What's Changed

• Add public API to check AWS-LC and FIPS versions by @​prasden in aws/aws-lc-rs#1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @​Mark-Simulacrum in aws/aws-lc-rs#1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @​justsmth in aws/aws-lc-rs#1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @​justsmth in aws/aws-lc-rs#1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- aws/aws-lc-rs#1166
• memcmp probe fails under RPM hardened build flags -- aws/aws-lc-rs#1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- aws/aws-lc-rs#1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @​justsmth in aws/aws-lc-rs#1172
• ci: only run push-triggered workflows on main by @​justsmth in aws/aws-lc-rs#1163
• Prepare aws-lc-sys v0.43.0 by @​justsmth in aws/aws-lc-rs#1176
• Prepare aws-lc-rs v1.17.2 by @​justsmth in aws/aws-lc-rs#1178
• Prepare aws-lc-fips-sys v0.13.16 by @​justsmth in aws/aws-lc-rs#1180
• build(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in aws/aws-lc-rs#1177

New Contributors

• @​Mark-Simulacrum made their first contribution in aws/aws-lc-rs#1174
• @​prasden made their first contribution in aws/aws-lc-rs#1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE] aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions