[openvpn-inc-ci]

This PR contains the following updates:

Package	Update	Change
aws/aws-lc	minor	v5.9.0 → v5.12.0

---

Release Notes

aws/aws-lc

v5.12.0

Compare Source

What's Changed

• Clear buffered cipher state per record in aead_tls_open by @​WillChilds-Klein in #​3587
• Deduplicate digest algorithms in PKCS7_dataInit by @​spwalgren in #​3579
• Reset cached extension state when reusing an X509 or X509_CRL by @​WillChilds-Klein in #​3584
• Honor restricted PSS min saltlen for AUTO verify by @​justsmth in #​3470
• Check EVP_PKEY_assign_EC_KEY return by @​prasden in #​3620
• Add SHA2-224 and establish the SHA-2 variant pattern by @​geedo0 in #​3449
• Grow BIO_read_asn1's buffer incrementally, not from the claimed length by @​WillChilds-Klein in #​3583
• Adding RC2 EVP key length signed truncation guard by @​spwalgren in #​3589
• Implement remaining SHA2 digests by @​geedo0 in #​3485
• Salt len truncation fix by @​spwalgren in #​3570
• Reject repeated AES-XTS data unit operations by @​nebeid in #​3621
• Verify provider-wide algorithm reachability by @​geedo0 in #​3486
• Fix -Wunused-but-set-global in fork_ube_detect.c by @​samuel40791765 in #​3645
• Reject failed signature controls (CWE-393) by @​justsmth in #​3643
• Reserve alignment slack in SSLBuffer max capacity by @​samuel40791765 in #​3642
• fix(ci): scope id-token permission to report-failures job in integration omnibus by @​dougch in #​3640
• Fix -Wunused-but-set-global in rand_isolated_test.cc by @​justsmth in #​3648
• Validate OCSP HTTP request inputs by @​prasden in #​3639
• Ensure UBE is caught between thread-local state init and uniqueness test by @​torben-hansen in #​3654
• Bump the github-actions group across 1 directory with 3 updates by @​dependabot[bot] in #​3627
• Bump urllib3 from 2.7.0 to 2.8.0 in /tests/ci by @​dependabot[bot] in #​3606
• Bump rustls from 0.23.40 to 0.23.45 in /tests/ci/lambda by @​dependabot[bot] in #​3649
• Add FIPS support to the aws-lc-provider by @​geedo0 in #​3487
• Bump the cargo-ci-lambda group across 1 directory with 3 updates by @​dependabot[bot] in #​3658
• Bump the pip-ci group across 1 directory with 3 updates by @​dependabot[bot] in #​3657
• Scope OCSP noCheck exemption to the responder certificate by @​WillChilds-Klein in #​3576
• fix(ci): running ci in dedicated msys shell by @​spwalgren in #​3669
• Reject ECH configuration on DTLS connections by @​WillChilds-Klein in #​3578
• Import s2n-bignum 2026-09-29 by @​justsmth in #​3661
• fix(ssl): Reject non-ECDHE cipher in handback by @​spwalgren in #​3653
• Implement aws-lc-provider error queue handling by @​geedo0 in #​3488
• Use CMake find_package for OpenSSL by @​geedo0 in #​3662
• Move AArch64 Keccak round constants out of .text by @​justsmth in #​3674
• tool-openssl: support cipher name as command (e.g. openssl aes-256-cbc) by @​PlasmaIntec in #​3666
• Make the SSL_SHA256 constant non-overlapping with the rest by @​aydinmercan in #​3659
• Fix PKCS12 password prompt test isolation on OpenBSD by @​justsmth in #​3680
• tool-openssl: add openssl rand subcommand by @​PlasmaIntec in #​3664
• tool-openssl: add password-based key derivation to openssl enc by @​PlasmaIntec in #​3665
• feat(tool-openssl): add x509 -serial/-addtrust/-trustout by @​spwalgren in #​3636
• Hold HPKE key and context buffers out of line by @​WillChilds-Klein in #​3637
• Explicitly block a small set of intermediates by @​torben-hansen in #​3688
• feat(tool-openssl): support CA signing, revocation, and CRLs in ca by @​spwalgren in #​3634
• feat(tool-openssl): add ocsp command by @​spwalgren in #​3635
• Prepare v5.12.0 by @​justsmth in #​3689

New Contributors

• @​PlasmaIntec made their first contribution in #​3666
• @​aydinmercan made their first contribution in #​3659

Full Changelog: aws/aws-lc@v5.11.0...v5.12.0

v5.11.0

Compare Source

What's Changed

• ci: fix openssh-master integration by @​prasden in #​3561
• Skip AEAD ConcurrentStability under Intel SDE; add deterministic context-immutability test by @​justsmth in #​3562
• Zeroize ChaCha20-Poly1305 key material by @​nhatnghiho in #​3552
• Record job settings for failed integrations by @​prasden in #​3569
• Restricting CI permissions so fork-PR code doesn't run CI with ECR push and shared S3 write permissions by @​spwalgren in #​3546
• Fix BIO socket error handling by @​justsmth in #​3459
• Reject [UNIVERSAL 0] elements with content as end-of-contents by @​spwalgren in #​3560
• Add OpenSSL-compatible rehash -compat support by @​justsmth in #​3563
• Harden a number of code-paths to avoid e.g. hangs and invalid input by @​torben-hansen in #​3543
• Guard against NULL attribute type names in X509_NAME_print_ex by @​WillChilds-Klein in #​3574
• Fail openssl ca when the issued certificate cannot be written by @​WillChilds-Klein in #​3568
• Gating PR auth checks on actor pushing the code instead of author by @​spwalgren in #​3567
• Seed groups and signature algorithms from the system crypto policy by @​WillChilds-Klein in #​3504
• Extend FIPS 3.x EOS to February 2030 by @​samuel40791765 in #​3539
• fix: Update Ruby (master) integration patch by @​skmcgrail in #​3590
• fix(acvp): place the IUT public key correctly in KAS-ECC fixedInfo by @​prasden in #​3597
• Support pkcs12 -export and req -batch in the OpenSSL CLI by @​justsmth in #​3575
• feat(duvet): RFC 8032 (EdDSA) requirement coverage + annotation-regression CI by @​dougch in #​3477
• fix: Add patch for failing gRPC master branch by @​skmcgrail in #​3591
• Reject unoffered cipher suite in TLS 1.3 client by @​spwalgren in #​3537
• fix(ssl): Check buffer-view bounds before pointer arithmetic by @​spwalgren in #​3566
• fix(x509): Verify CSR proof-of-possession on -req by @​spwalgren in #​3592
• Remove nameRelativeToCRLIssuer CRL distribution point support by @​justsmth in #​3598
• Use the dummy key when a PKCS#7 content encryption key is the wrong length by @​WillChilds-Klein in #​3585
• Resize md_data when an HMAC EVP_MD_CTX changes digest by @​WillChilds-Klein in #​3586
• Support RSA encryption/decryption and additional ciphers in the OpenSSL CLI by @​justsmth in #​3605
• fix(ml_kem): Gate ML-KEM x86-64 on BMI2 in addition to AVX2 by @​spwalgren in #​3596
• fix(ci): restrict calls for autofix by @​prasden in #​3599
• Recognise known safe DH groups/primes and short-circuit Diffie-Hellman test by @​torben-hansen in #​3337
• Harden previous-finished* length in v1/v2 transfer by @​spwalgren in #​3595
• Prepare v5.11.0 by @​skmcgrail in #​3610

Full Changelog: aws/aws-lc@v5.10.0...v5.11.0

v5.10.0

Compare Source

What's Changed

• Shard WASM gtests across runner CPUs by @​justsmth in #​3524
• Retry failed rndr register read a bounded number of times by @​torben-hansen in #​3475
• Add a reader for the system crypto-policies OpenSSL back-end by @​WillChilds-Klein in #​3502
• Export the crypto-policies reader and add its CI job by @​WillChilds-Klein in #​3527
• fix: restore alloc-size >= ivlen invariant in legacy AES-GCM SET_IVLEN by @​dougch in #​3466
• fix: declare FIPS service-indicator funcs in curve25519.c by @​dougch in #​3514
• Add context length guard in ML-DSA ACVP siggen by @​spwalgren in #​3538
• Add EVP_PKEY_check and EVP_PKEY_public_check for KEMs by @​jakemas in #​2709
• Return process exit codes from openssl CLI tool entry points by @​justsmth in #​3536
• Prevent tests from creating temporary files in the source tree by @​justsmth in #​3498
• Seed cipher lists and version bounds from the system crypto policy by @​WillChilds-Klein in #​3503
• Improve verify and x509 CLI compatibility by @​justsmth in #​3548
• Add pkcs12 import subcommand to the CLI by @​justsmth in #​3532
• Reject non-canonical Ed25519 public keys in the nohw decoder by @​justsmth in #​3457
• Bump the github-actions group with 8 updates by @​dependabot[bot] in #​3550
• Quote shell arguments in tool tests by @​justsmth in #​3499
• Fix SIGPIPE race in linkage checks by @​justsmth in #​3551
• Add EVP_add_cipher as a compatibility no-op by @​justsmth in #​3554
• Prepare 5.10.0 by @​justsmth in #​3553

New Contributors

• @​spwalgren made their first contribution in #​3538

Full Changelog: aws/aws-lc@v5.9.0...v5.10.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.