From 2ed9bea9f20267eb4b64529cbad02f3cddb9be4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartek=20Iwa=C5=84czuk?= Date: Tue, 20 Oct 2026 20:22:52 +0200 Subject: [PATCH 1/3] fix(tls): distrust compromised eMudhra certificate authorities --- Cargo.lock | 54 ++++++++++++++++++++++++++++++++++++++---------------- Cargo.toml | 6 +++--- 2 files changed, 41 insertions(+), 19 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f92a7a852d20fc..2f5e3f24e8f704 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -438,11 +438,11 @@ checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0" [[package]] name = "aws-lc-rs" -version = "1.16.3" +version = "1.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f" +checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13" dependencies = [ - "aws-lc-sys", + "aws-lc-sys 0.46.0", "untrusted 0.7.1", "zeroize", ] @@ -459,6 +459,19 @@ dependencies = [ "fs_extra", ] +[[package]] +name = "aws-lc-sys" +version = "0.46.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc" +dependencies = [ + "cc", + "cmake", + "dunce", + "fs_extra", + "pkg-config", +] + [[package]] name = "backhand" version = "0.25.1" @@ -2370,7 +2383,7 @@ dependencies = [ name = "deno_crypto_provider" version = "0.53.0" dependencies = [ - "aws-lc-sys", + "aws-lc-sys 0.40.0", "ed448-goldilocks", ] @@ -2924,7 +2937,7 @@ dependencies = [ "aead-gcm-stream", "aes", "aws-lc-rs", - "aws-lc-sys", + "aws-lc-sys 0.40.0", "base64 0.22.1", "blake2 0.10.6", "cbc", @@ -3506,7 +3519,7 @@ dependencies = [ "serde", "thiserror 2.0.12", "tokio", - "webpki-roots", + "webpki-roots 1.0.10", ] [[package]] @@ -5608,7 +5621,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower-service", - "webpki-roots", + "webpki-roots 0.26.11", ] [[package]] @@ -7934,9 +7947,9 @@ dependencies = [ [[package]] name = "pkg-config" -version = "0.3.30" +version = "0.3.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec" +checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" [[package]] name = "plist" @@ -8602,7 +8615,7 @@ dependencies = [ "wasm-bindgen-futures", "wasm-streams", "web-sys", - "webpki-roots", + "webpki-roots 0.26.11", "winreg 0.52.0", ] @@ -8942,9 +8955,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -11537,18 +11550,27 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "0.26.6" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8c6dfa3ac045bc517de14c7b1384298de1dbd229d38e08e169d9ae8c170937c" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "0.26.1" +version = "0.26.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" +dependencies = [ + "webpki-roots 1.0.10", +] + +[[package]] +name = "webpki-roots" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b3de34ae270483955a94f4b21bdaaeb83d508bb84a01435f393818edb0012009" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/Cargo.toml b/Cargo.toml index 79e56e4417fbaf..03875f8f697228 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -299,7 +299,7 @@ rusqlite = { version = "0.40.0", features = ["unlock_notify", "bundled", "sessio rustls = { version = "=0.23.40", default-features = false, features = ["logging", "std", "tls12", "aws_lc_rs"] } rustls-pemfile = "2" rustls-tokio-stream = "=0.8.0" -rustls-webpki = "0.103" +rustls-webpki = "0.103.16" rustyline = { version = "=17.0.0", features = ["custom-bindings"] } rustyline-derive = "=0.11.1" same-file = "1.0.6" @@ -343,8 +343,8 @@ urlpattern = "=0.4.2" uuid = { version = "1.3.0", features = ["v4"] } walkdir = "=2.5.0" web-transport-proto = "0.2.7" -webpki-root-certs = "0.26.5" -webpki-roots = "0.26" +webpki-root-certs = "1.0.10" +webpki-roots = "1.0.10" which = { version = "8.0.0", default-features = false } yoke = { version = "0.7.4", features = ["derive"] } zeromq = "0.6" From 9787a2870a1a70662d3444eb089902cc2d9a2e6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartek=20Iwa=C5=84czuk?= Date: Tue, 20 Oct 2026 20:38:51 +0200 Subject: [PATCH 2/3] fix(crypto): use stable AWS-LC ML-DSA APIs --- Cargo.toml | 2 +- ext/crypto/mldsa.rs | 24 +++++++++++++----------- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 03875f8f697228..79d5fb81ff1d8c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -191,7 +191,7 @@ async-compression = "0.4" async-once-cell = "0.5.4" async-stream = "0.3" async-trait = "0.1.73" -aws-lc-rs = { version = "1.16.3" } +aws-lc-rs = { version = "1.18.2" } aws-lc-sys = { version = "0.40.0", features = ["prebuilt-nasm"] } backhand = { version = "0.25.1", default-features = false, features = ["zstd"] } base32 = "=0.5.1" diff --git a/ext/crypto/mldsa.rs b/ext/crypto/mldsa.rs index 3ebbda79ce92d9..f64188f6afe103 100644 --- a/ext/crypto/mldsa.rs +++ b/ext/crypto/mldsa.rs @@ -1,16 +1,16 @@ // Copyright 2018-2026 the Deno authors. MIT license. use aws_lc_rs::signature::KeyPair; +use aws_lc_rs::signature::ML_DSA_44; +use aws_lc_rs::signature::ML_DSA_44_SIGNING; +use aws_lc_rs::signature::ML_DSA_65; +use aws_lc_rs::signature::ML_DSA_65_SIGNING; +use aws_lc_rs::signature::ML_DSA_87; +use aws_lc_rs::signature::ML_DSA_87_SIGNING; +use aws_lc_rs::signature::PqdsaKeyPair; +use aws_lc_rs::signature::PqdsaSigningAlgorithm; +use aws_lc_rs::signature::PqdsaVerificationAlgorithm; use aws_lc_rs::signature::UnparsedPublicKey; -use aws_lc_rs::unstable::signature::ML_DSA_44; -use aws_lc_rs::unstable::signature::ML_DSA_44_SIGNING; -use aws_lc_rs::unstable::signature::ML_DSA_65; -use aws_lc_rs::unstable::signature::ML_DSA_65_SIGNING; -use aws_lc_rs::unstable::signature::ML_DSA_87; -use aws_lc_rs::unstable::signature::ML_DSA_87_SIGNING; -use aws_lc_rs::unstable::signature::PqdsaKeyPair; -use aws_lc_rs::unstable::signature::PqdsaSigningAlgorithm; -use aws_lc_rs::unstable::signature::PqdsaVerificationAlgorithm; use spki::der::Encode; use spki::der::asn1::BitString; @@ -324,7 +324,9 @@ pub(crate) fn mldsa_export_pkcs8( let p = params(variant)?; let key_pair = PqdsaKeyPair::from_seed(p.signing, seed) .map_err(|_| MlDsaError::InvalidKeyData)?; - let pkcs8 = key_pair.to_pkcs8().map_err(|_| MlDsaError::FailedExport)?; + let pkcs8 = key_pair + .to_pkcs8v1() + .map_err(|_| MlDsaError::FailedExport)?; Ok(pkcs8.as_ref().to_vec()) } @@ -395,7 +397,7 @@ trait AsRawBytesVec { fn as_raw_bytes_vec(&self) -> Result, ()>; } -impl AsRawBytesVec for aws_lc_rs::unstable::signature::PqdsaPrivateKey<'_> { +impl AsRawBytesVec for aws_lc_rs::signature::PqdsaPrivateKey<'_> { fn as_raw_bytes_vec(&self) -> Result, ()> { use aws_lc_rs::encoding::AsRawBytes; let raw = self.as_raw_bytes().map_err(|_| ())?; From 5967dcf3d0065753e2b1f67ef6d46bdfa8408334 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartek=20Iwa=C5=84czuk?= Date: Tue, 20 Oct 2026 22:17:04 +0200 Subject: [PATCH 3/3] chore: bump deno_graph to 0.111.1 --- Cargo.lock | 4 ++-- Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 2f5e3f24e8f704..ab91f6d11b26c7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2551,9 +2551,9 @@ dependencies = [ [[package]] name = "deno_graph" -version = "0.111.0" +version = "0.111.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "74d39f55639b6bffe4e886d2ea33724606729d3ec9c8e05a48952a56c1cef961" +checksum = "8d88c8fda5602e366ff999b3b246cdbeca6a228f09370d5617eb20bab1ed0411" dependencies = [ "async-trait", "boxed_error", diff --git a/Cargo.toml b/Cargo.toml index 79d5fb81ff1d8c..3b22ac1e30a290 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -96,7 +96,7 @@ deno_ast = { version = "=0.53.3", features = ["transpiling"] } deno_core_icudata = "0.77.0" deno_doc = "=0.207.0" deno_error = "=0.7.1" -deno_graph = { version = "=0.111.0", default-features = false } +deno_graph = { version = "=0.111.1", default-features = false } deno_lint = "=0.84.1" deno_media_type = { version = "=0.4.0", features = ["module_specifier"] } deno_native_certs = "0.3.0"