chore(deps): bump aws-lc-rs from 1.18.1 to 1.18.2

[dependabot]

Bumps aws-lc-rs from 1.18.1 to 1.18.2.

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.2

What's Changed

• Implement Eq and PartialEq for RSA and EdDSA parameters by @​dsykes16 in aws/aws-lc-rs#1228
  • RsaParameters can now be compared directly against RSA verification constants. Algorithms with different digests, padding schemes, or modulus-size ranges compare unequal. EdDSAParameters also gains equality support.
• Add wasm32-wasip2 and wasm32-wasip3 support by @​ricochet in aws/aws-lc-rs#1239
  • Adds non-FIPS builds using universal bindings, with CI coverage under Wasmtime and wasi-sdk 34. WASIp3 requires nightly Rust.
  • Direct aws-lc-sys consumers must disable the default all-bindings feature for these targets.
• Publish the intended RandomizedNonceKey::open_in_place documentation by @​Serophots in aws/aws-lc-rs#1227
  • Makes the existing nonce, ciphertext/tag layout, and buffer-on-error contract visible in rustdoc. No runtime behavior changes.

Upstream AWS-LC

• aws-lc-sys v0.46.0 aligns with AWS-LC v5.11.0 (previously v5.7.0). See also the release notes for v5.8.0, v5.9.0, and v5.10.0.
  • The Ed25519 C-implementation decoder now rejects non-canonical public keys, matching the assembly-optimized implementations: aws/aws-lc#3457
  • Includes ChaCha20-Poly1305 key-material zeroization and fixes ML-KEM CPU feature detection to avoid illegal-instruction failures on x86-64 CPUs with AVX2 but no BMI2: aws/aws-lc#3552 and aws/aws-lc#3596
• aws-lc-fips-sys v0.14.3 updates its bundled AWS-LC FIPS 4.2.0 snapshot and regenerates bindings. It remains on the FIPS 4.x release line.

Build Improvements

• Raise the minimum system AWS-LC version to 5.7.0 by @​justsmth in aws/aws-lc-rs#1243
  • Non-FIPS system-library installations must now provide AWS-LC 5.7.0 or newer, previously 1.68.0. Bundled-source builds and FIPS version requirements are unchanged.
• Fix static FIPS system-library linking by @​justsmth in aws/aws-lc-rs#1236
  • Fixes unresolved FIPS_mode references with GNU ld.bfd when linking a prebuilt static FIPS library, including binaries that do not call crypto and builds where LTO removes those calls.
  • Uses whole-archive linking to retain libcrypto, including in downstream Rust staticlib outputs. This can increase binary size; dynamic FIPS and non-FIPS linking are unchanged.
• Fix Cranelift linking by @​justsmth in aws/aws-lc-rs#1234
  • Normalizes binding link names to avoid undefined-symbol failures, including when Cranelift is selected through Cargo profiles rather than RUSTFLAGS. The AWS_LC_SYS_NO_U1_BINDINGS workaround is no longer needed.
• Fix jitterentropy builds with optimizing CFLAGS and newer cc versions by @​justsmth in aws/aws-lc-rs#1254
  • Keeps filtered flags in effect throughout the jitterentropy builder's lifetime, preventing cached environment reads from allowing flags such as -O2 to override its required -O0.
• Honor AWS_LC_SYS_CC in the main library build by @​justsmth in aws/aws-lc-rs#1255
  • Applies crate-specific compiler overrides before compiler lookup in both CC and CMake build paths, keeping compiler selection and capability probes consistent when cc caches environment reads.
• Improve archive reproducibility through symlinked build paths by @​justsmth in aws/aws-lc-rs#1238
  • Prevents the non-Windows CC builder from incorporating symlink-resolved absolute build paths into archive member names, avoiding unnecessary downstream compile-cache misses. Windows short-path handling is unchanged.
• Upgrade bindgen to 0.73 by @​xtqqczze in aws/aws-lc-rs#1244
• Document the system-library trust model by @​justsmth in aws/aws-lc-rs#1218
  • Clarifies that supplied paths and pkg-config results are trusted build inputs, and that FIPS validation can execute candidate library code before accepting or rejecting it. Documents runner requirements and how to disable automatic system-library detection.

Issues Being Closed

• Cranelift builds fail with codegen-backend = "cranelift" -- aws/aws-lc-rs#1231
• Upgrade bindgen to v0.73 -- aws/aws-lc-rs#1245
• Undefined FIPS_mode when linking a prebuilt FIPS module into a binary that does not use crypto -- aws/aws-lc-rs#1246
• Jitterentropy fails with "must not be compiled with optimizations" in aws-lc-rs v1.18.1 / aws-lc-sys v0.45.0 -- aws/aws-lc-rs#1252

Other Merged PRs

• Add security review workflow by @​nhatnghiho in aws/aws-lc-rs#1226
• docs: align pull request template with AWS-LC by @​justsmth in aws/aws-lc-rs#1219
• ci: verify docs.rs build with read-only crate sources by @​justsmth in aws/aws-lc-rs#1209
• ci: harden workflows and release tooling by @​justsmth in aws/aws-lc-rs#1216

... (truncated)

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🧬 Mutation testing (cargo-mutants, --in-diff)

No mutants were generated for the changed lines.

[github-actions]

✅ No CRAP threshold violations

1095 function(s) analyzed · threshold 30