chore(deps): bump the rust-patch group with 5 updates

[dependabot]

Bumps the rust-patch group with 5 updates:

Package	From	To
aws-lc-fips-sys	0.13.15	0.13.16
aws-lc-rs	1.17.1	1.17.3
webpki-roots	1.0.8	1.0.9
serde	1.0.228	1.0.229
sanitization	1.2.4	1.2.5

Updates aws-lc-fips-sys from 0.13.15 to 0.13.16

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• See full diff in compare view

Updates aws-lc-rs from 1.17.1 to 1.17.3

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.3

What's Changed

• Add public API to check AWS-LC and FIPS versions by @​prasden in aws/aws-lc-rs#1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @​Mark-Simulacrum in aws/aws-lc-rs#1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @​justsmth in aws/aws-lc-rs#1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @​justsmth in aws/aws-lc-rs#1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- aws/aws-lc-rs#1166
• memcmp probe fails under RPM hardened build flags -- aws/aws-lc-rs#1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- aws/aws-lc-rs#1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @​justsmth in aws/aws-lc-rs#1172
• ci: only run push-triggered workflows on main by @​justsmth in aws/aws-lc-rs#1163
• Prepare aws-lc-sys v0.43.0 by @​justsmth in aws/aws-lc-rs#1176
• Prepare aws-lc-rs v1.17.2 by @​justsmth in aws/aws-lc-rs#1178
• Prepare aws-lc-fips-sys v0.13.16 by @​justsmth in aws/aws-lc-rs#1180
• build(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in aws/aws-lc-rs#1177

New Contributors

• @​Mark-Simulacrum made their first contribution in aws/aws-lc-rs#1174
• @​prasden made their first contribution in aws/aws-lc-rs#1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE] aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• See full diff in compare view

Updates webpki-roots from 1.0.8 to 1.0.9

Release notes

Sourced from webpki-roots's releases.

1.0.9

Changes:

• Add "Telia EC TLS Root CA v3" and "Telia RSA TLS Root CA v3" - https://bugzilla.mozilla.org/show_bug.cgi?id=2047804
• Add "SECOM TLS ECC Root CA 2024" and "SECOM TLS RSA Root CA 2024" - https://bugzilla.mozilla.org/show_bug.cgi?id=1943001
• Remove "Atos TrustedRoot 2011" - https://bugzilla.mozilla.org/show_bug.cgi?id=2017374

What's Changed

• Take webpki-root-certs lockfile update by @​weifanglab in rustls/webpki-roots#125
• 1.0.9: upstream updates by @​ctz in rustls/webpki-roots#126

New Contributors

• @​weifanglab made their first contribution in rustls/webpki-roots#125

Full Changelog: rustls/webpki-roots@v/1.0.8...v/1.0.9

Commits

• 0a553db 1.0.9: upstream updates (#126)
• 1ce667b Take webpki-root-certs lockfile update (#125)
• See full diff in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates sanitization from 1.2.4 to 1.2.5

Release notes

Sourced from sanitization's releases.

Sanitization 1.2.5

Release 1.2.5

• Added BoundedSecretString<MAX> for UTF-8 secrets with an application-defined public byte limit across construction, append, replacement, and serde ingestion.
• Added a 1 MiB default serde byte ceiling for ordinary SecretString, matching the existing bounded-by-default SecretVec ingestion policy.
• Added allocation-preserving conversions between SecretVec and SecretString; invalid UTF-8 inputs are cleared before returning an error.
• Added LockedSecretString, a UTF-8-safe wrapper over LockedSecretVec that preserves memory locking, dump/fork policy, canaries, clearing, and mapped storage without introducing a second mapping.
• Added GuardedSecretString, a UTF-8-safe wrapper over GuardedSecretVec that preserves guard pages, optional memory locking, canaries, and clearing.
• Added checked locked/guarded text exposure through SecretTextIntegrityError, distinguishing canary corruption from invalid UTF-8.
• Added owned String ingestion helpers that clear the original global allocator storage after copying into locked or guarded mappings.
• Extended native constant-time traits and optional zeroize/subtle interoperability to the new text containers.
• Updated README guidance for direct secret-aware JSON ingestion, including the remaining limits around parser input and scratch-buffer copies.
• Clarified that UTF-8 validation and length rejection are not data-oblivious, that serde limits begin at visitor control, and that Miri/Kani do not provide native syscall or real-concurrency coverage.
• Updated all workspace crates and crates.io-facing version references for the 1.2.5 patch release.

Changelog

Sourced from sanitization's changelog.

1.2.5

• Added BoundedSecretString<MAX> with byte-length enforcement for construction, mutation, conversion, and serde ingestion.
• Added a 1 MiB default serde ceiling for ordinary SecretString.
• Added zero-reallocation conversions between SecretVec and SecretString with clear-on-invalid-UTF-8 failure behavior.
• Added LockedSecretString over LockedSecretVec and GuardedSecretString over GuardedSecretVec.
• Added checked canary and UTF-8 exposure errors for mapped text containers.
• Extended native constant-time traits and optional zeroize/subtle interoperability to the new text types.
• Documented direct JSON-to-secret ingestion and the remaining parser/input copy limitations.
• Clarified serde visitor boundaries, validation timing, and the native syscall and concurrency limits of Miri/Kani evidence.

Commits

• d412045 Record 1.2.5 pentest attestation
• 1d0c5ba Document validation and verification limits
• 280991c Add secure UTF-8 secret containers
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.