[renovate]

This PR contains the following updates:

Package	Type	Update	Change
boring	workspace.dependencies	major	4.22.0 → 5.0.0

---

Release Notes

cloudflare/boring (boring)

v5.3.0

Compare Source

What's Changed

• aead: require &mut self for seal/open and add TLS AEAD variants by @​janrueth in #​514
• Add native HKDF bindings by @​punkeel in #​525
• RTG-5132 Bump BoringSSL by @​bwesterb in #​524
• CI: exclude non-BoringSSL symbols, fix outdated Node.js warnings, clean up Windows and Go setup by @​Lekensteyn in #​529
• Add X509Ref::check_host_with_flags (fixes #​530) by @​nox in #​531
• Back-compat shims for v4 by @​kornelski in #​532
• Add action-aware certificate selection callbacks by @​nox in #​533

New Contributors

• @​punkeel made their first contribution in #​525

Full Changelog: cloudflare/boring@v5.2.0...v5.3.0

v5.2.0: 5.2.0

Compare Source

What's Changed

• CI improvements by @​kornelski in #​490
• unsafe_op_in_unsafe_fn by @​kornelski in #​493
• ci: add Semgrep OSS scanning workflow by @​hrushikeshdeshpande in #​501
• Expose DTLS version constants in SslVersion by @​vynious in #​503
• Let crates detect boring-sys version by @​kornelski in #​506
• Bump BoringSSL to latest and update patches by @​cjpatton in #​499
• boring-sys: Bump BoringSSL to e2a57cf by @​cjpatton in #​509
• Fix dangling pointer in X509StoreContextRef::set_verify_param by @​TheJokr in #​508
• Pingora's patch disabling cert version validation for extensions by @​kornelski in #​495
• Expose TLS signature algorithm and per-connection sigalg preferences by @​lukevalenta in #​513
• MLDSA for Pingora by @​kornelski in #​497
• ci,mac: bew trust messense/macos-cross-toolchains by @​bwesterb in #​516
• ML-DSA: add private->public and public key marshalling by @​bwesterb in #​515
• Avoid panicking methods by @​kornelski in #​483
• boring-sys: add tvOS target support by @​gengjiawen in #​519

New Contributors

• @​vynious made their first contribution in #​503
• @​lukevalenta made their first contribution in #​513
• @​gengjiawen made their first contribution in #​519

Full Changelog: cloudflare/boring@v5.1.0...v5.1.1

What's Changed

• CI improvements by @​kornelski in #​490
• unsafe_op_in_unsafe_fn by @​kornelski in #​493
• ci: add Semgrep OSS scanning workflow by @​hrushikeshdeshpande in #​501
• Expose DTLS version constants in SslVersion by @​vynious in #​503
• Let crates detect boring-sys version by @​kornelski in #​506
• Bump BoringSSL to latest and update patches by @​cjpatton in #​499
• boring-sys: Bump BoringSSL to e2a57cf by @​cjpatton in #​509
• Fix dangling pointer in X509StoreContextRef::set_verify_param by @​TheJokr in #​508
• Pingora's patch disabling cert version validation for extensions by @​kornelski in #​495
• Expose TLS signature algorithm and per-connection sigalg preferences by @​lukevalenta in #​513
• MLDSA for Pingora by @​kornelski in #​497
• ci,mac: bew trust messense/macos-cross-toolchains by @​bwesterb in #​516
• ML-DSA: add private->public and public key marshalling by @​bwesterb in #​515
• Avoid panicking methods by @​kornelski in #​483
• boring-sys: add tvOS target support by @​gengjiawen in #​519
• Add relax-rsa-key-usage feature to restore historical RSA keyUsage by @​johnhurt in #​512

New Contributors

• @​vynious made their first contribution in #​503
• @​lukevalenta made their first contribution in #​513
• @​gengjiawen made their first contribution in #​519

Full Changelog: cloudflare/boring@v5.1.0...v5.2.0

v5.1.0: 5.1.0

Compare Source

What's Changed

• Added used_hello_retry_request function by @​icrutche in #​481
• Export pre-built libraries for packaging by @​kornelski in #​485
• Add TLS 1.2 PRF module and bindings by @​janrueth in #​487
• Add generic PKey private key generation API by @​janrueth in #​488
• Add EVP_AEAD-based detached AEAD module by @​janrueth in #​486

New Contributors

• @​icrutche made their first contribution in #​481
• @​janrueth made their first contribution in #​487

Full Changelog: cloudflare/boring@v5.0.2...v5.1.0

v5.0.2

Compare Source

What's Changed

• boring-sys: Support static MSVC runtime by @​jrose-signal in #​475
• Sync methods with rust-openssl by @​kornelski in #​477
• Don't add build/ to non-FIPS pre-built path + v4 compat alias by @​kornelski in #​474

For major changes in v5 see: https://github.com/cloudflare/boring/releases/tag/v5.0.0

Full Changelog: cloudflare/boring@v5.0.1...v5.0.2

v5.0.1

Compare Source

• Improved building with older versions of upstream BoringSSL C headers #​469
• Added mlkem and credential Cargo features for new BoringSSL APIs.

See v5.0.0 for major changes.

v5.0.0

Compare Source

Breaking changes

Upgrade to 4.21.1 first and fix any deprecation warnings.

Cargo features removed/simplified

• FIPS only needs the fips Cargo feature, and the rest is customized via env vars (like BORING_BSSL_FIPS_PATH): #​383
• Removed the "kx-*" features #​393
• Post-quantum is enabled by default (X25519MLKEM768 and P256Kyber768Draft00) and the "pq-experimental" Cargo feature flag is not used any more.

Other semver changes

• Updated BoringSSL to a newer version with updated patches by @​nox in #​419
• Removed SslCurve API. Identifying curves by name is more reliable across different builds of BoringSSL. Use SslRef::curve_name() instead #​390 #​396
• Removed deprecated X509CheckFlags #​425
• X509Store is now cheaply cloneable, but immutable. SslContextBuilder.cert_store_mut() can't be used after .set_cert_store(). If you need .cert_store_mut(), either don't overwrite the default store, or use .set_cert_store_builder() #​426
• X509StoreBuilder::add_cert takes a reference.
• Hyper version upgraded from v0 to v1
• set_ex_data() will always Drop previous values #​424
• Removed blanket Eq from FFI types
• BIO_set_retry_write on WouldBlock @​ihciah in #​118

Added

• Added ML-KEM-768 and ML-KEM-1024 support #​455 #​456 #​462
• Added init-update-finalize API for HMAC #​459
• set_strict_cipher_list by @​abernardeau-wallix in #​416
• Added set_ticket_key_callback by @​toidiu in #​330
• SslCipherRef::protocol_id by @​nox in #​409

Full Changelog: cloudflare/boring@v4.20.0...v5.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a1495dfd-21da-458e-94c3-5390fd1d243b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}