[dependabot]

Bumps the cargo-minor-patch group with 3 updates in the /products/platform/fuzz directory: aws-lc-rs, rustix and uuid.

Updates aws-lc-rs from 1.18.2 to 1.19.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

• Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
  • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
• Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
  • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
• Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
  • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
• Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
  • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
• Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
  • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
  • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

• aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
• aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

• Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
  • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
  • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
• Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
  • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

• Implement Clone for rsa::KeyPair -- aws/aws-lc-rs#1260
• Expose AWS-LC FIPS on-demand self-test -- aws/aws-lc-rs#1261
• Add a way to specify the RSA-PSS salt length -- aws/aws-lc-rs#1263

Other Merged PRs

• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1264
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1265
• fix: satisfy Clippy deprecated-since lint and lint legacy-des in CI by @​justsmth in aws/aws-lc-rs#1269
• ci: keep upstream Cargo.lock in rustls integration by @​justsmth in aws/aws-lc-rs#1270
• ci: use dynamic musl CRT for ARM FIPS tests by @​justsmth in aws/aws-lc-rs#1271
• Prepare aws-lc-fips-sys v0.14.4 by @​justsmth in aws/aws-lc-rs#1275
• Prepare aws-lc-sys v0.47.0 by @​justsmth in aws/aws-lc-rs#1274
• Prepare aws-lc-rs v1.19.0 by @​justsmth in aws/aws-lc-rs#1278

New Contributors

• @​lokeswarivejju made their first contribution in aws/aws-lc-rs#1259
• @​johncarmack1984 made their first contribution in aws/aws-lc-rs#1273
• @​JakeHuneau made their first contribution in aws/aws-lc-rs#1277

... (truncated)

Commits

• 5d496f8 Prepare aws-lc-rs v1.19.0 (#1278)
• d099134 Feat: Add the ability to specify an RSA-PSS salt length (#1267)
• b639322 feat(signature): implement Clone for signing key pairs (#1277)
• 7548d5c Prepare aws-lc-sys v0.47.0 (#1274)
• a5862bd Prepare aws-lc-fips-sys v0.14.4 (#1275)
• 9bba3fb perf(builder): share cc's compiler detection across builds (#1273)
• 6a66144 Add Keccak-256 digest algorithm (unstable) (#1266)
• cf4f62b feat(fips): add on-demand AWS-LC self-test API (#1262)
• 825d0e3 feat: support AES OFB, CFB8 and CFB1 modes (#1259)
• c225ce4 Lower minimum system AWS-LC to 4.2.0 and add an unstable floor (#1268)
• Additional commits viewable in compare view

Updates rustix from 1.1.5 to 1.1.6

Commits

• 4a563ad chore: Release rustix version 1.1.6
• 8e6aaa6 Merge commit from fork
• 4686873 fix: expose additional termios output mode flags (#1709)
• c9ad9d3 fix(net): don't trust cmsg_len past the end of a truncated control buffer (...
• 98358af Avoid constructing a zero Pid in tcgetpgrp on non-Linux targets (#1710)
• 664aeae fix(net): use IPPROTO_IPV6 for IPV6_MULTICAST_HOPS (#1692)
• bf78ee6 freebsd: Fix cfg gates for FreeBSD 12 (#1707)
• b3d81bd Fix fallocate on Apple platforms. (#1708)
• 915ab6f fix(fs): Set proper inotify WatchFlags values on libc backend (#1714)
• 52d5db7 Use 32-bit UID/GID syscalls on arm, sparc, and x86 (#1716)
• Additional commits viewable in compare view

Updates uuid from 1.28.0 to 1.29.0

Release notes

Sourced from uuid's releases.

v1.29.0

What's Changed

• Add versioned constructors to NonNilUuid by @​RanaPriyansh in uuid-rs/uuid#919
• Prepare for 1.29.0 release by @​KodrAus in uuid-rs/uuid#920

Full Changelog: uuid-rs/uuid@v1.28.0...v1.29.0

Commits

• 4643e60 Merge pull request #920 from uuid-rs/cargo/v1.29.0
• a3631fd prepare for 1.29.0 release
• 304913e Merge pull request #919 from RanaPriyansh/fix/non-nil-versioned-constructors-901
• d49f963 Reuse existing version tests for NonNilUuid constructors
• 2f02404 Add versioned constructors to NonNilUuid
• See full diff in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T04:09:34.869640Z	263e0f5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb70002cea

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Split the Zed lockfile refresh from the platform update

This platform-fuzz dependency update also upgrades the independent Zed extension dependency graph, even though the commit describes only three updates under products/platform/fuzz. Coupling the unrelated Zed refresh makes the stated validation and rollback scope inaccurate; move the editors/zed/Cargo.lock changes into a separate change, as the repository guidance requires changes to remain within one owning area.

AGENTS.md reference: AGENTS.md:L390-L392

Useful? React with 👍 / 👎.