deps(deps): bump the rust-minor-patch group across 1 directory with 8 updates by dependabot[bot] · Pull Request #51 · org-event/OpenPolySphere

dependabot · 2026-07-02T03:21:40Z

Bumps the rust-minor-patch group with 6 updates in the / directory:

Package	From	To
aws-lc-rs	`1.17.0`	`1.17.1`
console	`0.16.3`	`0.16.4`
indicatif	`0.18.5`	`0.18.6`
libredox	`0.1.17`	`0.1.18`
rustls-pki-types	`1.14.1`	`1.15.0`
time	`0.3.51`	`0.3.53`

Updates aws-lc-rs from 1.17.0 to 1.17.1

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.1

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

[Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) (static)

[Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

Support linking against a system-installed AWS-LC:

Set AWS_LC_SYS_SYSTEM_DIR or let pkg-config / OPENSSL_* environment variables auto-detect an existing AWS-LC installation instead of building from source by @justsmth in aws/aws-lc-rs#1129

Support system-installed AWS-LC FIPS library for aws-lc-fips-sys by @justsmth in aws/aws-lc-rs#1143

Auto-detect system AWS-LC from OPENSSL_* and pkg-config by @justsmth in aws/aws-lc-rs#1156

Gate system AWS-LC on a declared minimum version by @justsmth in aws/aws-lc-rs#1152

Implement Send/Sync for RSA hazmat encryption key types by @justsmth in aws/aws-lc-rs#1128

Add Salt::none constructor for HKDF by @justsmth in aws/aws-lc-rs#1135

Add wasm32-unknown-emscripten build and test support by @justsmth in aws/aws-lc-rs#1059

Report specific key rejection reasons for invalid RSA key sizes by @justsmth in aws/aws-lc-rs#1153

Upstream AWS-LC (v5.1.0)

aws-lc-sys now aligns with AWS-LC v5.1.0 (previously v1.73.0). Notable upstream changes include:

ML-DSA native assembly backends for x86_64 and aarch64, imported from mldsa-native by @jakemas in aws/aws-lc#3195 and aws/aws-lc#3219

Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs)

Build Improvements

Fix memcmp_check build failure when CFLAGS contains LTO flags by @justsmth in aws/aws-lc-rs#1134

Fix missing poly_Rq_mul symbol in Linux x86_64 build by @Lebei2046 in aws/aws-lc-rs#1130

Apply -ffile-prefix-map to jitterentropy builder by @justsmth in aws/aws-lc-rs#1139

Select compiler flag dialect by driver mode, not target ABI by @justsmth in aws/aws-lc-rs#1147

Issues Being Closed

RSA hazmat encryption key types missing Send/Sync -- aws/aws-lc-rs#1125

RSA key rejection reports generic Unspecified for invalid key sizes -- aws/aws-lc-rs#1082

Build failure when CFLAGS contains LTO flags (Windows/clang) -- aws/aws-lc-rs#1132

cargo-xwin (clang-cl) jitterentropy build failure on x86_64-pc-windows-msvc -- aws/aws-lc-rs#1146

Support system-provided AWS-LC library -- aws/aws-lc-rs#936

cpu_arm_linux.c assumes sys/auxv.h and getauxval (uclibc targets) -- aws/aws-lc-rs#1108

jitterentropy embeds absolute paths to files -- aws/aws-lc-rs#1137

Other Merged PRs

Add ML-DSA aarch64 native assembly to CC builder scripts by @jakemas in aws/aws-lc-rs#1113

Clarify HKDF info concatenation and encoding responsibility by @justsmth in aws/aws-lc-rs#1145

CI: support zig cross compile for arm32 by @justsmth in aws/aws-lc-rs#1124

fix(clippy): fix truncate warnings by @justsmth in aws/aws-lc-rs#1126

ci: replace dtolnay/rust-toolchain with direct rustup invocations by @justsmth in aws/aws-lc-rs#1133

... (truncated)

Commits

741dbf5 Prepare aws-lc-rs v1.17.1 (#1164)
e6d42b8 Prepare aws-lc-sys v0.42.0 (#1162)
bd7abf5 Harden GitHub Actions workflows against script injection (#1161)
93b0123 Add wasm32-unknown-emscripten build and test support (#1059)
7b8a0e7 feat(system-lib): auto-detect system AWS-LC from OPENSSL_* and pkg-config (#1...
a95c524 Prepare aws-lc-fips-sys v0.13.15 (#1158)
00e016a Bump actions/checkout from 6 to 7 (#1157)
e7568de fix(system-lib): gate system AWS-LC on a declared minimum version (#1152)
dfe4525 fix(builder): select flag dialect by compiler driver mode, not target ABI (#1...
26838da rsa: report specific key rejection for invalid sizes (#1153)
Additional commits viewable in compare view

Updates aws-lc-sys from 0.41.0 to 0.42.0

Commits

741dbf5 Prepare aws-lc-rs v1.17.1 (#1164)
e6d42b8 Prepare aws-lc-sys v0.42.0 (#1162)
bd7abf5 Harden GitHub Actions workflows against script injection (#1161)
93b0123 Add wasm32-unknown-emscripten build and test support (#1059)
7b8a0e7 feat(system-lib): auto-detect system AWS-LC from OPENSSL_* and pkg-config (#1...
a95c524 Prepare aws-lc-fips-sys v0.13.15 (#1158)
00e016a Bump actions/checkout from 6 to 7 (#1157)
e7568de fix(system-lib): gate system AWS-LC on a declared minimum version (#1152)
dfe4525 fix(builder): select flag dialect by compiler driver mode, not target ABI (#1...
26838da rsa: report specific key rejection for invalid sizes (#1153)
Additional commits viewable in compare view

Updates console from 0.16.3 to 0.16.4

Release notes

Sourced from console's releases.

0.16.4

What's Changed

chore: Remove redudant helper and add TermInner constructors by @ChrisDenton in console-rs/console#284

Style::from_dotted_str ignore non-ascii by @danjl1100 in console-rs/console#287

feat: add is_dumb public function by @ugur-eren in console-rs/console#290

Commits

598eca9 Bump version to 0.16.4
0f22c35 feat: add is_dumb public function
1426649 Bump actions/checkout from 3 to 7
d2d89ad ignore non-ascii input in Style::from_dotted_str
6cff3e0 document current panic in Style::from_dotted_str via test cases
dd4334f Apply suggestions from clippy 1.95
586efad Remove redundant as_handle helper
be20e85 Add TermInner::new constructors
See full diff in compare view

Updates indicatif from 0.18.5 to 0.18.6

Release notes

Sourced from indicatif's releases.

0.18.6

What's Changed

fix: correctly detect dumb terminal on Windows by @ugur-eren in console-rs/indicatif#818

Commits

e4d49d8 Bump version to 0.18.6
582727e fix: correctly detect dumb terminal on Windows
See full diff in compare view

Updates libredox from 0.1.17 to 0.1.18

Updates rustls-pki-types from 1.14.1 to 1.15.0

Release notes

Sourced from rustls-pki-types's releases.

v/1.15.0

New feature: add a constructor for FipsStatus::Certified.

What's Changed

ci: sync cargo-check-external-types nightly by @cpu in rustls/pki-types#109

1.15.0: ensure FipsStatus::Certified is usable by @ctz in rustls/pki-types#110

Full Changelog: rustls/pki-types@v/1.14.1...v/1.15.0

Commits

ab46a65 Prepare 1.15.0
13d2dee Ensure FipsStatus::Certified is usable
23bc39f ci: sync cargo-check-external-types nightly
See full diff in compare view

Updates time from 0.3.51 to 0.3.53

Release notes

Sourced from time's releases.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result in a loss of precision and even invalid values.

The date! macro could previously create an invalid value that would then panic at compile time. The macro now emits a proper error instead.

When parsing an invalid format description, an edge case would inadvertently panic. This now returns an error as intended.

Added

Support default values when parsing

Commits

0ae2f84 v0.3.53 release
cea8c96 Avoid issue with cookie crate temporarily
55e1f2b Require private type to properly seal traits
7cf4780 v0.3.52 release
0e5b04f Fix trusted publishing workflow
6e4140a Support default values when parsing
10ac36a Add more doctests to Timestamp
6b0d468 Restore lexer depth on the unclosed-bracket error path
0abc06d Add trusted publishing
43cf0c0 Preferentially group shards by target
Additional commits viewable in compare view

Updates time-macros from 0.2.30 to 0.2.31

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the rust-minor-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.17.0` | `1.17.1` | | [console](https://github.com/console-rs/console) | `0.16.3` | `0.16.4` | | [indicatif](https://github.com/console-rs/indicatif) | `0.18.5` | `0.18.6` | | libredox | `0.1.17` | `0.1.18` | | [rustls-pki-types](https://github.com/rustls/pki-types) | `1.14.1` | `1.15.0` | | [time](https://github.com/time-rs/time) | `0.3.51` | `0.3.53` | Updates `aws-lc-rs` from 1.17.0 to 1.17.1 - [Release notes](https://github.com/aws/aws-lc-rs/releases) - [Commits](aws/aws-lc-rs@v1.17.0...v1.17.1) Updates `aws-lc-sys` from 0.41.0 to 0.42.0 - [Release notes](https://github.com/aws/aws-lc-rs/releases) - [Commits](aws/aws-lc-rs@aws-lc-sys/v0.41.0...aws-lc-sys/v0.42.0) Updates `console` from 0.16.3 to 0.16.4 - [Release notes](https://github.com/console-rs/console/releases) - [Changelog](https://github.com/console-rs/console/blob/main/CHANGELOG.md) - [Commits](console-rs/console@0.16.3...0.16.4) Updates `indicatif` from 0.18.5 to 0.18.6 - [Release notes](https://github.com/console-rs/indicatif/releases) - [Commits](console-rs/indicatif@0.18.5...0.18.6) Updates `libredox` from 0.1.17 to 0.1.18 Updates `rustls-pki-types` from 1.14.1 to 1.15.0 - [Release notes](https://github.com/rustls/pki-types/releases) - [Commits](rustls/pki-types@v/1.14.1...v/1.15.0) Updates `time` from 0.3.51 to 0.3.53 - [Release notes](https://github.com/time-rs/time/releases) - [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md) - [Commits](time-rs/time@v0.3.51...v0.3.53) Updates `time-macros` from 0.2.30 to 0.2.31 - [Release notes](https://github.com/time-rs/time/releases) - [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md) - [Commits](https://github.com/time-rs/time/commits) --- updated-dependencies: - dependency-name: aws-lc-rs dependency-version: 1.17.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: aws-lc-sys dependency-version: 0.42.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: rust-minor-patch - dependency-name: console dependency-version: 0.16.4 dependency-type: indirect update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: indicatif dependency-version: 0.18.6 dependency-type: indirect update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: libredox dependency-version: 0.1.18 dependency-type: indirect update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: rustls-pki-types dependency-version: 1.15.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: rust-minor-patch - dependency-name: time dependency-version: 0.3.53 dependency-type: indirect update-type: version-update:semver-patch dependency-group: rust-minor-patch - dependency-name: time-macros dependency-version: 0.2.31 dependency-type: indirect update-type: version-update:semver-patch dependency-group: rust-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-02T03:21:40Z

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-07-02T03:21:54Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

Cargo.lock

Package	Version	License	Issue Type
aws-lc-rs	1.17.1	Null	Unknown License
aws-lc-sys	0.42.0	Null	Unknown License
console	0.16.4	Null	Unknown License

OpenSSF Scorecard

Package

Version

Score

Details

cargo/aws-lc-rs

1.17.1

Unknown

cargo/aws-lc-sys

0.42.0

Unknown

cargo/console

0.16.4

Unknown

cargo/indicatif

0.18.6

Unknown

cargo/libredox

0.1.18

Unknown

cargo/rustls-pki-types

1.15.0

Unknown

cargo/time

0.3.53

🟢 4.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 10	security policy file detected

cargo/time-macros

0.2.31

🟢 4.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 10	security policy file detected

Scanned Files

Cargo.lock

dependabot · 2026-07-03T03:21:20Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot closed this Jul 3, 2026

dependabot Bot deleted the dependabot/cargo/rust-minor-patch-0e1158cc62 branch July 3, 2026 03:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps(deps): bump the rust-minor-patch group across 1 directory with 8 updates#51

deps(deps): bump the rust-minor-patch group across 1 directory with 8 updates#51
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-minor-patch-0e1158cc62

dependabot Bot commented on behalf of github Jul 2, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

aws-lc-rs v1.17.1

What's Changed

Upstream AWS-LC (v5.1.0)

Build Improvements

Issues Being Closed

Other Merged PRs

0.16.4

What's Changed

0.18.6

What's Changed

v/1.15.0

What's Changed

v0.3.53

v0.3.52

0.3.53 [2026-07-01]

0.3.52 [2026-06-30]

Fixed

Added

Uh oh!

dependabot Bot commented on behalf of github Jul 2, 2026

Labels

Uh oh!

github-actions Bot commented Jul 2, 2026

Dependency Review

License Issues

Cargo.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

dependabot Bot commented on behalf of github Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 2, 2026 •

edited

Loading