deps(deps): bump the rust-minor-patch group with 5 updates

[dependabot]

Bumps the rust-minor-patch group with 5 updates:

Package	From	To
aws-lc-rs	1.17.0	1.17.1
aws-lc-sys	0.41.0	0.42.0
rustls-pki-types	1.14.1	1.15.0
time	0.3.51	0.3.52
time-macros	0.2.30	0.2.31

Updates aws-lc-rs from 1.17.0 to 1.17.1

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.1

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

• [Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) (static)
• [Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

• In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

• Support linking against a system-installed AWS-LC:
  • Set AWS_LC_SYS_SYSTEM_DIR or let pkg-config / OPENSSL_* environment variables auto-detect an existing AWS-LC installation instead of building from source by @​justsmth in aws/aws-lc-rs#1129
  • Support system-installed AWS-LC FIPS library for aws-lc-fips-sys by @​justsmth in aws/aws-lc-rs#1143
  • Auto-detect system AWS-LC from OPENSSL_* and pkg-config by @​justsmth in aws/aws-lc-rs#1156
  • Gate system AWS-LC on a declared minimum version by @​justsmth in aws/aws-lc-rs#1152
• Implement Send/Sync for RSA hazmat encryption key types by @​justsmth in aws/aws-lc-rs#1128
• Add Salt::none constructor for HKDF by @​justsmth in aws/aws-lc-rs#1135
• Add wasm32-unknown-emscripten build and test support by @​justsmth in aws/aws-lc-rs#1059
• Report specific key rejection reasons for invalid RSA key sizes by @​justsmth in aws/aws-lc-rs#1153

Upstream AWS-LC (v5.1.0)

aws-lc-sys now aligns with AWS-LC v5.1.0 (previously v1.73.0). Notable upstream changes include:

• ML-DSA native assembly backends for x86_64 and aarch64, imported from mldsa-native by @​jakemas in aws/aws-lc#3195 and aws/aws-lc#3219
• Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs)

Build Improvements

• Fix memcmp_check build failure when CFLAGS contains LTO flags by @​justsmth in aws/aws-lc-rs#1134
• Fix missing poly_Rq_mul symbol in Linux x86_64 build by @​Lebei2046 in aws/aws-lc-rs#1130
• Apply -ffile-prefix-map to jitterentropy builder by @​justsmth in aws/aws-lc-rs#1139
• Select compiler flag dialect by driver mode, not target ABI by @​justsmth in aws/aws-lc-rs#1147

Issues Being Closed

• RSA hazmat encryption key types missing Send/Sync -- aws/aws-lc-rs#1125
• RSA key rejection reports generic Unspecified for invalid key sizes -- aws/aws-lc-rs#1082
• Build failure when CFLAGS contains LTO flags (Windows/clang) -- aws/aws-lc-rs#1132
• cargo-xwin (clang-cl) jitterentropy build failure on x86_64-pc-windows-msvc -- aws/aws-lc-rs#1146
• Support system-provided AWS-LC library -- aws/aws-lc-rs#936
• cpu_arm_linux.c assumes sys/auxv.h and getauxval (uclibc targets) -- aws/aws-lc-rs#1108
• jitterentropy embeds absolute paths to files -- aws/aws-lc-rs#1137

Other Merged PRs

• Add ML-DSA aarch64 native assembly to CC builder scripts by @​jakemas in aws/aws-lc-rs#1113
• Clarify HKDF info concatenation and encoding responsibility by @​justsmth in aws/aws-lc-rs#1145
• CI: support zig cross compile for arm32 by @​justsmth in aws/aws-lc-rs#1124
• fix(clippy): fix truncate warnings by @​justsmth in aws/aws-lc-rs#1126
• ci: replace dtolnay/rust-toolchain with direct rustup invocations by @​justsmth in aws/aws-lc-rs#1133

... (truncated)

Commits

• 741dbf5 Prepare aws-lc-rs v1.17.1 (#1164)
• e6d42b8 Prepare aws-lc-sys v0.42.0 (#1162)
• bd7abf5 Harden GitHub Actions workflows against script injection (#1161)
• 93b0123 Add wasm32-unknown-emscripten build and test support (#1059)
• 7b8a0e7 feat(system-lib): auto-detect system AWS-LC from OPENSSL_* and pkg-config (#1...
• a95c524 Prepare aws-lc-fips-sys v0.13.15 (#1158)
• 00e016a Bump actions/checkout from 6 to 7 (#1157)
• e7568de fix(system-lib): gate system AWS-LC on a declared minimum version (#1152)
• dfe4525 fix(builder): select flag dialect by compiler driver mode, not target ABI (#1...
• 26838da rsa: report specific key rejection for invalid sizes (#1153)
• Additional commits viewable in compare view

Updates aws-lc-sys from 0.41.0 to 0.42.0

Commits

• 741dbf5 Prepare aws-lc-rs v1.17.1 (#1164)
• e6d42b8 Prepare aws-lc-sys v0.42.0 (#1162)
• bd7abf5 Harden GitHub Actions workflows against script injection (#1161)
• 93b0123 Add wasm32-unknown-emscripten build and test support (#1059)
• 7b8a0e7 feat(system-lib): auto-detect system AWS-LC from OPENSSL_* and pkg-config (#1...
• a95c524 Prepare aws-lc-fips-sys v0.13.15 (#1158)
• 00e016a Bump actions/checkout from 6 to 7 (#1157)
• e7568de fix(system-lib): gate system AWS-LC on a declared minimum version (#1152)
• dfe4525 fix(builder): select flag dialect by compiler driver mode, not target ABI (#1...
• 26838da rsa: report specific key rejection for invalid sizes (#1153)
• Additional commits viewable in compare view

Updates rustls-pki-types from 1.14.1 to 1.15.0

Release notes

Sourced from rustls-pki-types's releases.

v/1.15.0

New feature: add a constructor for FipsStatus::Certified.

What's Changed

• ci: sync cargo-check-external-types nightly by @​cpu in rustls/pki-types#109
• 1.15.0: ensure FipsStatus::Certified is usable by @​ctz in rustls/pki-types#110

Full Changelog: rustls/pki-types@v/1.14.1...v/1.15.0

Commits

• ab46a65 Prepare 1.15.0
• 13d2dee Ensure FipsStatus::Certified is usable
• 23bc39f ci: sync cargo-check-external-types nightly
• See full diff in compare view

Updates time from 0.3.51 to 0.3.52

Release notes

Sourced from time's releases.

v0.3.52

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.52 [2026-06-30]

Fixed

• Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result in a loss of precision and even invalid values.
• The date! macro could previously create an invalid value that would then panic at compile time. The macro now emits a proper error instead.
• When parsing an invalid format description, an edge case would inadvertently panic. This now returns an error as intended.

Added

• Support default values when parsing

Commits

• 7cf4780 v0.3.52 release
• 0e5b04f Fix trusted publishing workflow
• 6e4140a Support default values when parsing
• 10ac36a Add more doctests to Timestamp
• 6b0d468 Restore lexer depth on the unclosed-bracket error path
• 0abc06d Add trusted publishing
• 43cf0c0 Preferentially group shards by target
• 749c0ad Bump number of shards for ordinary build
• 24e6985 Run some CI steps in parallel
• 0eda8a2 Shard powerset type checking
• Additional commits viewable in compare view

Updates time-macros from 0.2.30 to 0.2.31

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

Cargo.lock

Package	Version	License	Issue Type
aws-lc-rs	1.17.1	Null	Unknown License
aws-lc-sys	0.42.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
cargo/aws-lc-rs	1.17.1	Unknown	Unknown
cargo/aws-lc-sys	0.42.0	Unknown	Unknown
cargo/rustls-pki-types	1.15.0	Unknown	Unknown
cargo/time	0.3.52	🟢 5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/time-macros	0.2.31	🟢 5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• Cargo.lock

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.