[dependabot]

Bumps the cargo-minor-patch group with 9 updates in the / directory:

Package	From	To
aws-lc-rs	1.18.2	1.19.0
pest	2.8.5	2.9.5
napi	3.15.0	3.16.1
napi-derive	3.6.13	3.7.0
rmcp	3.7.0	3.8.0
rustix	1.1.5	1.1.6
signal-hook	0.4.5	0.4.6
uuid	1.28.0	1.29.0
wat	1.262.0	1.263.0

Updates aws-lc-rs from 1.18.2 to 1.19.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

• Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
  • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
• Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
  • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
• Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
  • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
• Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
  • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
• Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
  • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
  • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

• aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
• aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

• Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
  • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
  • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
• Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
  • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

• Implement Clone for rsa::KeyPair -- aws/aws-lc-rs#1260
• Expose AWS-LC FIPS on-demand self-test -- aws/aws-lc-rs#1261
• Add a way to specify the RSA-PSS salt length -- aws/aws-lc-rs#1263

Other Merged PRs

• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1264
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1265
• fix: satisfy Clippy deprecated-since lint and lint legacy-des in CI by @​justsmth in aws/aws-lc-rs#1269
• ci: keep upstream Cargo.lock in rustls integration by @​justsmth in aws/aws-lc-rs#1270
• ci: use dynamic musl CRT for ARM FIPS tests by @​justsmth in aws/aws-lc-rs#1271
• Prepare aws-lc-fips-sys v0.14.4 by @​justsmth in aws/aws-lc-rs#1275
• Prepare aws-lc-sys v0.47.0 by @​justsmth in aws/aws-lc-rs#1274
• Prepare aws-lc-rs v1.19.0 by @​justsmth in aws/aws-lc-rs#1278

New Contributors

• @​lokeswarivejju made their first contribution in aws/aws-lc-rs#1259
• @​johncarmack1984 made their first contribution in aws/aws-lc-rs#1273
• @​JakeHuneau made their first contribution in aws/aws-lc-rs#1277

... (truncated)

Commits

• 5d496f8 Prepare aws-lc-rs v1.19.0 (#1278)
• d099134 Feat: Add the ability to specify an RSA-PSS salt length (#1267)
• b639322 feat(signature): implement Clone for signing key pairs (#1277)
• 7548d5c Prepare aws-lc-sys v0.47.0 (#1274)
• a5862bd Prepare aws-lc-fips-sys v0.14.4 (#1275)
• 9bba3fb perf(builder): share cc's compiler detection across builds (#1273)
• 6a66144 Add Keccak-256 digest algorithm (unstable) (#1266)
• cf4f62b feat(fips): add on-demand AWS-LC self-test API (#1262)
• 825d0e3 feat: support AES OFB, CFB8 and CFB1 modes (#1259)
• c225ce4 Lower minimum system AWS-LC to 4.2.0 and add an unstable floor (#1268)
• Additional commits viewable in compare view

Updates pest from 2.8.5 to 2.9.5

Release notes

Sourced from pest's releases.

v2.9.5

What's Changed

• make stacker-based checks opt-in on non-native targets by @​tomtau in pest-parser/pest#1234

Full Changelog: pest-parser/pest@v2.9.4...v2.9.5

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

pest 2.9.3 and 2.9.4 required a stacker dependency which relies on a C compiler toolchain; this was made optional for non-native targets and can be opt-in enabled with the feature flag in those targets (see native stack guard notes in README):

...
pest = { version = "2.9.5", features = ["stack-guard"] }

v2.9.4

What's Changed

• add Cargo.lock for reproducible builds (fixes #1161) by @​tomtau in pest-parser/pest#1230
• validator: reject repetitions that loop because of the stack by @​yuxi-liu-wired in pest-parser/pest#1227
• Fix typos in three-string fast path of skip_until by @​shivampwm2020 in pest-parser/pest#1231

New Contributors

• @​yuxi-liu-wired made their first contribution in pest-parser/pest#1227
• @​shivampwm2020 made their first contribution in pest-parser/pest#1231

Full Changelog: pest-parser/pest@v2.9.3...v2.9.4

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

v2.9.3

What's Changed

• bump syn to 3 by @​tomtau in pest-parser/pest#1210
• Detect left recursion behind a prefix that can match empty (fixes #411) by @​breken-ai in pest-parser/pest#1211
• Limit parse depth by @​tomtau in pest-parser/pest#1212
• Remove reqwest dependency from pest_debugger by @​tomtau with @​Copilot in pest-parser/pest#1209

... (truncated)

Commits

• c474eec make stacker-based checks opt-in on non-native targets (#1234) (fixes #1233)
• 66a059c Fix typos in the three-string fast path of skip_until (#1231)
• b4882ad validator: reject repetitions that loop because of the stack (#1227) (fixes 1...
• 7e779b7 add Cargo.lock for reproducible builds (fixes #1161) (#1230)
• 4248cbd bump version to 2.9.3 (#1228)
• 429e893 Limit parse depth (#1212)
• 3cdface Detect left recursion behind a prefix that can match empty (fixes #411) (#1211)
• 9124917 Add AI contribution and usage policy (#1221)
• 9abf9e5 bump syn to 3 (#1210)
• acf7fd9 Remove reqwest dependency from pest_debugger (#1209)
• Additional commits viewable in compare view

Updates napi from 3.15.0 to 3.16.1

Release notes

Sourced from napi's releases.

napi-v3.16.1

Fixed

• (napi) avoid a deadlock when a worker loads the addon during block_on (#3670)

napi-v3.16.0

Added

• (napi) support well-known symbol keys for class members (#3665)
• (napi) support symbol_for keys for class members (#3661)

Fixed

• (napi) compact class identity metadata (#3667)
• (napi) keep the registered classes when a later load fails (#3666)
• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)
• (napi) free threadsafe function call data when the call fails (#3656)

Commits

• 417375a chore: release (#3671)
• 9ffcf8d build(deps): bump qs from 6.16.0 to 6.17.1 (#3669)
• 8a89547 fix(napi): avoid a deadlock when a worker loads the addon during block_on (...
• eec0c64 chore(deps): update dependency oxfmt to ^0.75.0 (#3660)
• f89400d chore: release (#3637)
• 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
• 9188219 chore(deps): update dependency electron to v45 (#3634)
• 1d93a4e fix(napi): compact class identity metadata (#3667)
• e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
• cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
• Additional commits viewable in compare view

Updates napi-derive from 3.6.13 to 3.7.0

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.7.0

Added

• (napi) support well-known symbol keys for class members (#3665)
• (napi) support symbol_for keys for class members (#3661)

Fixed

• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)

Commits

• f89400d chore: release (#3637)
• 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
• 9188219 chore(deps): update dependency electron to v45 (#3634)
• 1d93a4e fix(napi): compact class identity metadata (#3667)
• e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
• cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
• c01ce60 fix(napi): free define_class closures, honour static flags, avoid TS1016 in c...
• 5a49dad feat(napi): support symbol_for keys for class members (#3661)
• 0c58903 fix(napi): free threadsafe function call data when the call fails (#3656)
• ada66a3 chore(deps): update release-plz/action action to v0.5.147 (#3659)
• Additional commits viewable in compare view

Updates rmcp from 3.7.0 to 3.8.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.8.0

Fixed

• (transport) accept nested x-mcp-header annotations (#1359)
• ship LICENSE in rmcp and rmcp-macros crates (#1342)

Other

• combine AI issue triage with a maintainer rotation as the responsible reviewer (#1260)

rmcp-v3.8.0

Added

• (transport) expose body-free HTTP status errors (#1386)

Fixed

• (client) stop SSE reconnects on permanent GET errors (#1363)

Commits

• cd88056 chore: release v3.8.0 (#1388)
• 8aec389 fix(client): stop SSE reconnects on permanent GET errors (#1363)
• 2a401c4 feat(transport): expose body-free HTTP status errors (#1386)
• See full diff in compare view

Updates rustix from 1.1.5 to 1.1.6

Commits

• 4a563ad chore: Release rustix version 1.1.6
• 8e6aaa6 Merge commit from fork
• 4686873 fix: expose additional termios output mode flags (#1709)
• c9ad9d3 fix(net): don't trust cmsg_len past the end of a truncated control buffer (...
• 98358af Avoid constructing a zero Pid in tcgetpgrp on non-Linux targets (#1710)
• 664aeae fix(net): use IPPROTO_IPV6 for IPV6_MULTICAST_HOPS (#1692)
• bf78ee6 freebsd: Fix cfg gates for FreeBSD 12 (#1707)
• b3d81bd Fix fallocate on Apple platforms. (#1708)
• 915ab6f fix(fs): Set proper inotify WatchFlags values on libc backend (#1714)
• 52d5db7 Use 32-bit UID/GID syscalls on arm, sparc, and x86 (#1716)
• Additional commits viewable in compare view

Updates signal-hook from 0.4.5 to 0.4.6

Changelog

Sourced from signal-hook's changelog.

0.4.6

• Allow registering 'static flags in addition to Arc ones (#215, #180).

Commits

• 0a1de6b Version 0.4.6
• ae4ece5 Merge pull request #215 from Frost-54/static-atomic-unsafe-trait
• 48b56d5 Deps updates
• fd51cde Allow &'static AtomicBool in flag module - #213
• See full diff in compare view

Updates uuid from 1.28.0 to 1.29.0

Release notes

Sourced from uuid's releases.

v1.29.0

What's Changed

• Add versioned constructors to NonNilUuid by @​RanaPriyansh in uuid-rs/uuid#919
• Prepare for 1.29.0 release by @​KodrAus in uuid-rs/uuid#920

Full Changelog: uuid-rs/uuid@v1.28.0...v1.29.0

Commits

• 4643e60 Merge pull request #920 from uuid-rs/cargo/v1.29.0
• a3631fd prepare for 1.29.0 release
• 304913e Merge pull request #919 from RanaPriyansh/fix/non-nil-versioned-constructors-901
• d49f963 Reuse existing version tests for NonNilUuid constructors
• 2f02404 Add versioned constructors to NonNilUuid
• See full diff in compare view

Updates wat from 1.262.0 to 1.263.0

Release notes

Sourced from wat's releases.

v1.263.0

What's Changed

• Bump arbitrary from 1.4.2 to 1.5.0 by @​dependabot[bot] in bytecodealliance/wasm-tools#2772
• mutate: Remove eq-associates rewrite rules by @​tamaroning in bytecodealliance/wasm-tools#2776
• wit-parser: reject @​external-id where it isn't supported by @​jrandolf in bytecodealliance/wasm-tools#2781
• mutate: Remove algebric rewrites that breaks semantics by @​tamaroning in bytecodealliance/wasm-tools#2774
• wast: support map values by @​jrandolf in bytecodealliance/wasm-tools#2784
• wasm-wave: return an error instead of panicking on unsupported values by @​jrandolf in bytecodealliance/wasm-tools#2778
• Expose the types within a ModuleType by @​alexcrichton in bytecodealliance/wasm-tools#2786
• wast: accept import/export attributes in any order by @​jrandolf in bytecodealliance/wasm-tools#2780
• Update spec test suite by @​alexcrichton in bytecodealliance/wasm-tools#2787
• wasm-wave: support the component model map type by @​jrandolf in bytecodealliance/wasm-tools#2782
• Bump wit-bindgen from 0.62.0 to 0.63.0 by @​dependabot[bot] in bytecodealliance/wasm-tools#2788
• mutate: Don't reorder, drop or duplicate effectful operands by @​tamaroning in bytecodealliance/wasm-tools#2775
• Move recursion in wasmprinter to the heap by @​alexcrichton in bytecodealliance/wasm-tools#2790
• Reject handles in the value types of maps by @​jrandolf in bytecodealliance/wasm-tools#2791
• Plumb wasm features through reencoding/printing by @​alexcrichton in bytecodealliance/wasm-tools#2797
• Implement the acquire-release-atomics proposal by @​alexcrichton in bytecodealliance/wasm-tools#2799
• wasmprinter: fix outer aliases that print unparsable or shadowed identifiers by @​jrandolf in bytecodealliance/wasm-tools#2795
• wast: parse core rec groups in component and instance types by @​jrandolf in bytecodealliance/wasm-tools#2798
• Implement the multibyte-array-access proposal by @​alexcrichton in bytecodealliance/wasm-tools#2800
• wit-parser: fix panics decoding WIT from components by @​jrandolf in bytecodealliance/wasm-tools#2794
• Bump wasmtime from 49.0.1 to 50.0.0 by @​dependabot[bot] in bytecodealliance/wasm-tools#2801
• wasm-wave: require commas between record/flag/map entries per the grammar by @​willemschots in bytecodealliance/wasm-tools#2802
• Release wasm-tools 1.263.0 by @​github-actions[bot] in bytecodealliance/wasm-tools#2803

New Contributors

• @​tamaroning made their first contribution in bytecodealliance/wasm-tools#2776
• @​jrandolf made their first contribution in bytecodealliance/wasm-tools#2781
• @​willemschots made their first contribution in bytecodealliance/wasm-tools#2802

Full Changelog: bytecodealliance/wasm-tools@v1.262.0...v1.263.0

Commits

• 7a2fa42 Release wasm-tools 1.263.0 (#2803)
• e5095e9 wasm-wave: require commas between record/flag/map entries per the grammar (#2...
• 25a937a wit-parser: fix panics decoding WIT from components (#2794)
• e6e6991 Implement the multibyte-array-access proposal (#2800)
• cc0d3b7 wast: parse core rec groups in component and instance types (#2798)
• 24de91c wasmprinter: fix outer aliases that print unparsable or shadowed identifiers ...
• 23dc76b Implement the acquire-release-atomics proposal (#2799)
• ebcc07c Plumb wasm features through reencoding/printing (#2797)
• 2e6b2d6 Reject handles in the value types of maps (#2791)
• 8c7a8e6 Move recursion in wasmprinter to the heap (#2790)
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T08:35:23.147409Z	af956ad	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d05a776c8c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Repeat the FIPS dependency review before upgrading

This changes the accepted cryptographic wrapper version and checksum, but release/notes/dependency-vetting-aws-lc-fips.md:7-9 still accepts exactly aws-lc-rs 1.18.2, and its review triggers at lines 199-207 require repeating the review whenever the locked version, checksum, features, or dependency graph changes. Since this commit also moves the compiled non-FIPS aws-lc-sys node to 0.47.0 but changes no review-note file, the repository no longer has the required evidence supporting its FIPS/backend and supply-chain posture; complete and commit that re-review before adopting 1.19.0.

AGENTS.md reference: AGENTS.md:L396-L398

Useful? React with 👍 / 👎.