build(deps): bump aws-lc-rs from 1.18.1 to 1.18.2

[dependabot]

Bumps aws-lc-rs from 1.18.1 to 1.18.2.

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.2

What's Changed

• Implement Eq and PartialEq for RSA and EdDSA parameters by @​dsykes16 in aws/aws-lc-rs#1228
  • RsaParameters can now be compared directly against RSA verification constants. Algorithms with different digests, padding schemes, or modulus-size ranges compare unequal. EdDSAParameters also gains equality support.
• Add wasm32-wasip2 and wasm32-wasip3 support by @​ricochet in aws/aws-lc-rs#1239
  • Adds non-FIPS builds using universal bindings, with CI coverage under Wasmtime and wasi-sdk 34. WASIp3 requires nightly Rust.
  • Direct aws-lc-sys consumers must disable the default all-bindings feature for these targets.
• Publish the intended RandomizedNonceKey::open_in_place documentation by @​Serophots in aws/aws-lc-rs#1227
  • Makes the existing nonce, ciphertext/tag layout, and buffer-on-error contract visible in rustdoc. No runtime behavior changes.

Upstream AWS-LC

• aws-lc-sys v0.46.0 aligns with AWS-LC v5.11.0 (previously v5.7.0). See also the release notes for v5.8.0, v5.9.0, and v5.10.0.
  • The Ed25519 C-implementation decoder now rejects non-canonical public keys, matching the assembly-optimized implementations: aws/aws-lc#3457
  • Includes ChaCha20-Poly1305 key-material zeroization and fixes ML-KEM CPU feature detection to avoid illegal-instruction failures on x86-64 CPUs with AVX2 but no BMI2: aws/aws-lc#3552 and aws/aws-lc#3596
• aws-lc-fips-sys v0.14.3 updates its bundled AWS-LC FIPS 4.2.0 snapshot and regenerates bindings. It remains on the FIPS 4.x release line.

Build Improvements

• Raise the minimum system AWS-LC version to 5.7.0 by @​justsmth in aws/aws-lc-rs#1243
  • Non-FIPS system-library installations must now provide AWS-LC 5.7.0 or newer, previously 1.68.0. Bundled-source builds and FIPS version requirements are unchanged.
• Fix static FIPS system-library linking by @​justsmth in aws/aws-lc-rs#1236
  • Fixes unresolved FIPS_mode references with GNU ld.bfd when linking a prebuilt static FIPS library, including binaries that do not call crypto and builds where LTO removes those calls.
  • Uses whole-archive linking to retain libcrypto, including in downstream Rust staticlib outputs. This can increase binary size; dynamic FIPS and non-FIPS linking are unchanged.
• Fix Cranelift linking by @​justsmth in aws/aws-lc-rs#1234
  • Normalizes binding link names to avoid undefined-symbol failures, including when Cranelift is selected through Cargo profiles rather than RUSTFLAGS. The AWS_LC_SYS_NO_U1_BINDINGS workaround is no longer needed.
• Fix jitterentropy builds with optimizing CFLAGS and newer cc versions by @​justsmth in aws/aws-lc-rs#1254
  • Keeps filtered flags in effect throughout the jitterentropy builder's lifetime, preventing cached environment reads from allowing flags such as -O2 to override its required -O0.
• Honor AWS_LC_SYS_CC in the main library build by @​justsmth in aws/aws-lc-rs#1255
  • Applies crate-specific compiler overrides before compiler lookup in both CC and CMake build paths, keeping compiler selection and capability probes consistent when cc caches environment reads.
• Improve archive reproducibility through symlinked build paths by @​justsmth in aws/aws-lc-rs#1238
  • Prevents the non-Windows CC builder from incorporating symlink-resolved absolute build paths into archive member names, avoiding unnecessary downstream compile-cache misses. Windows short-path handling is unchanged.
• Upgrade bindgen to 0.73 by @​xtqqczze in aws/aws-lc-rs#1244
• Document the system-library trust model by @​justsmth in aws/aws-lc-rs#1218
  • Clarifies that supplied paths and pkg-config results are trusted build inputs, and that FIPS validation can execute candidate library code before accepting or rejecting it. Documents runner requirements and how to disable automatic system-library detection.

Issues Being Closed

• Cranelift builds fail with codegen-backend = "cranelift" -- aws/aws-lc-rs#1231
• Upgrade bindgen to v0.73 -- aws/aws-lc-rs#1245
• Undefined FIPS_mode when linking a prebuilt FIPS module into a binary that does not use crypto -- aws/aws-lc-rs#1246
• Jitterentropy fails with "must not be compiled with optimizations" in aws-lc-rs v1.18.1 / aws-lc-sys v0.45.0 -- aws/aws-lc-rs#1252

Other Merged PRs

• Add security review workflow by @​nhatnghiho in aws/aws-lc-rs#1226
• docs: align pull request template with AWS-LC by @​justsmth in aws/aws-lc-rs#1219
• ci: verify docs.rs build with read-only crate sources by @​justsmth in aws/aws-lc-rs#1209
• ci: harden workflows and release tooling by @​justsmth in aws/aws-lc-rs#1216

... (truncated)

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.83%. Comparing base (26fb123) to head (103df37).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##               main      #71   +/-   ##
=========================================
  Coverage     86.83%   86.83%           
  Complexity      616      616           
=========================================
  Files            60       60           
  Lines         16979    16979           
  Branches        490      490           
=========================================
  Hits          14743    14743           
  Misses         1912     1912           
  Partials        324      324           

Flag	Coverage Δ
jvm	57.50% <ø> (ø)
rust	93.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed]

Merging this PR will regress 1 benchmark

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ 6 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• response[0]
• retained-response[1024]
• retained-response[65536]
• allocate-drop[1048576]
• response[1024]
• retained-response[0]

⚡ 5 improved benchmarks
❌ 1 regressed benchmark
✅ 111 untouched benchmarks
⏩ 65 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Simulation	buffer/budget-rejected	550 ns	661.1 ns	-16.81%
⚡	Simulation	slice-drop[1048576]	543.9 ns	434.2 ns	+25.27%
⚡	Simulation	slice-drop[4096]	543.9 ns	434.2 ns	+25.27%
⚡	Simulation	slice-drop[64]	543.9 ns	434.2 ns	+25.27%
⚡	Simulation	slice-drop[65536]	543.9 ns	434.2 ns	+25.27%
⚡	Simulation	buffer/exclusive-freeze-recover	713.4 ns	603.7 ns	+18.18%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/cargo/aws-lc-rs-1.18.2 (103df37) with main (26fb123)}

Footnotes

1. 65 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩