chore(deps): bump aws-lc-rs from 1.17.0 to 1.18.1

[dependabot]

Bumps aws-lc-rs from 1.17.0 to 1.18.1.

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.1

What's Changed

• Add ECDSA P-256 SHA-1 ASN.1 signature verification by @​assafvayner in aws/aws-lc-rs#1214
  • Adds ECDSA_P256_SHA1_ASN1 for verifying ASN.1 DER-encoded ECDSA P-256 signatures over SHA-1, so applications can verify legacy signatures such as CloudFront signed URLs using ECDSA P-256 with the default SHA-1 hash.
  • SHA-1 remains available for legacy verification only. This release does not add a corresponding signing algorithm.
• Tighten AEAD, cipher IV, HKDF, ECDH, and RSA API contracts by @​justsmth in aws/aws-lc-rs#1215
  • In-place AEAD sealing now verifies that Extend produced exactly enough space for the plaintext and authentication tag before passing the buffer to AWS-LC. Non-conforming custom buffers now return Err(Unspecified).
  • Streaming cipher constructors now reject missing or mismatched IV contexts, matching the validation already performed by the one-shot APIs.
  • Salt::from(Okm) now uses the output algorithm selected by the Okm, rather than the algorithm from the source PRK.
  • ECDH shared-secret storage is now zeroized on fallible derive paths.
  • RSA verify_digest_sig now requires the supplied digest to match the digest configured by RsaParameters, for both parsed and unparsed public keys.
  • Valid inputs are unaffected. Calls using inconsistent algorithms, IV contexts, or custom AEAD buffers now fail closed with Err(Unspecified).

Upstream AWS-LC

• aws-lc-sys v0.45.0 aligns with AWS-LC v5.7.0 (previously v5.5.0). See also the release notes for v5.6.0.
  • v5.7.0 corrects EVP_DecryptUpdate for padded block ciphers so it modifies only the output range reported through out_len. aws-lc-rs now includes canary-based regression coverage around the documented minimum output-buffer sizes.
• aws-lc-fips-sys v0.14.2 moves to AWS-LC FIPS v4.2.0.
  • Includes the equivalent EVP_DecryptUpdate correction for FIPS builds.
  • Restores FIPS builds with Clang 20 and newer.
  • Removes the FIPS compiler wrapper's dependency on /usr/bin/env, fixing builds in Nix and similar sandboxed environments.

Build Improvements

• Export cargo:root metadata when linking against a system-installed AWS-LC by @​weihanglo in aws/aws-lc-rs#1208
  • The system-library path now exposes the installation prefix through DEP_AWS_LC_*_ROOT, consistently with the CC and CMake builders, so downstream build scripts can rely on the metadata regardless of how AWS-LC was built.
• Fix -Wa,--debug-prefix-map handling with Clang and LTO by @​justsmth in aws/aws-lc-rs#1212
  • Fixes Clang builds when CFLAGS contains -flto or -flto=thin. The assembler-specific flag is now used only with GCC; Clang's integrated assembler uses -ffile-prefix-map directly.
• Filter raw target-triple CFLAGS spellings when compiling jitterentropy by @​justsmth in aws/aws-lc-rs#1207
  • Prevents inherited optimization flags from overriding jitterentropy's required -O0, including when environment variables are set by a parent process using raw or legacy-normalized target triples.

Issues Being Closed

• aws-lc-fips-sys v0.14.0 fails to build with Clang newer than 19 -- aws/aws-lc-rs#1202
• FIPS compiler wrapper fails in Nix build environments -- aws/aws-lc-rs#1204
• Raw target-triple CFLAGS should be filtered for jitterentropy -- aws/aws-lc-rs#1205
• aws-lc-sys fails to build with Clang when CFLAGS includes -flto -- aws/aws-lc-rs#1211

Other Merged PRs

• Prepare aws-lc-fips-sys v0.14.1 by @​justsmth in aws/aws-lc-rs#1203
• fix(publish): verify packaged crate with cargo build instead of cargo test by @​justsmth in aws/aws-lc-rs#1201
• fix: address clippy::assert_is_empty lints in ECB cipher modes by @​justsmth in aws/aws-lc-rs#1210
• ci: replace removed llvm-devel-lite package in FreeBSD jobs by @​justsmth in aws/aws-lc-rs#1213
• Prepare aws-lc-sys v0.45.0 by @​justsmth in aws/aws-lc-rs#1220
• Prepare aws-lc-fips-sys v0.14.2 by @​justsmth in aws/aws-lc-rs#1221
• Prepare v1.18.1 by @​justsmth in aws/aws-lc-rs#1224

... (truncated)

Commits

• 22e629d Prepare v1.18.1 (#1224)
• c4fde5c Prepare aws-lc-fips-sys v0.14.2 (#1221)
• 7943223 Prepare aws-lc-sys v0.45.0 (#1220)
• 8ea2229 fix: tighten AEAD, cipher IV, and digest API contracts (#1215)
• bcca4d1 Add ECDSA P-256 SHA-1 ASN.1 verification algorithm (#1214)
• 32338a5 fix(builder): filter the raw-triple CFLAGS spelling for jitterentropy (#1207)
• af422bd Fix -Wa,--debug-prefix-map probe (#1212)
• 749b26f ci: replace removed llvm-devel-lite package in FreeBSD jobs (#1213)
• 36c7a68 fix(publish): verify packaged crate with cargo build, not cargo test (#1201)
• c71ab00 fix: address clippy::assert_is_empty lints in ECB cipher modes (#1210)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)