chore: update aws-lc-sys to fix security vulnerabilities

[mostronatorcoder]

Summary

Updates aws-lc-rs and aws-lc-sys to fix multiple security vulnerabilities.

Changes

Package	Old Version	New Version
aws-lc-rs	1.15.4	1.16.2
aws-lc-sys	0.37.0	0.39.0

Security Advisories Fixed

• GHSA-394x-vwmw-crm3: X.509 Name Constraints Bypass via Wildcard/Unicode CN
• RUSTSEC-2026-0044: CRL Distribution Point Scope Check Logic Error
• PKCS7_verify Signature Validation Bypass
• Timing Side-Channel in AES-CCM Tag Verification
• PKCS7_verify Certificate Chain Validation Bypass

Notes

aws-lc-sys is a transitive dependency through rustls → aws-lc-rs. Running cargo update aws-lc-rs pulls in the latest patched version.

All advisories are patched in aws-lc-sys >= 0.39.0.

Summary by CodeRabbit

• Chores
  • Updated project dependencies to their latest compatible versions.

[arkanoider]

@coderabbitai review please!! Don't tell me you don't work on saturdays!?!? 😄

[coderabbitai]

@arkanoider: Ha, weekends are no obstacle! 🐇 Kicking off the review right away!

One important heads-up based on a previous learning from this repository: directly overriding aws-lc-sys to >= 0.38.0 in Cargo.toml is known to break Windows/MSVC builds due to a long-standing upstream issue where the build system does not pass /std:c11 to cl.exe, resulting in C atomics require C11 or later errors. Since this PR targets aws-lc-sys 0.39.0, it falls right in that problematic range. The recommended approach has been to wait for upstream crates (e.g., nostr-sdk) to adopt a compatible aws-lc-rs/aws-lc-sys version, and acknowledge the Dependabot alerts in the GitHub UI in the meantime.

I'll factor this into the full review now! 👇

---

🧠 Learnings used

Learnt from: arkanoider
Repo: MostroP2P/mostrix PR: 38
File: Cargo.toml:62-66
Timestamp: 2026-03-17T08:19:56.335Z
Learning: In the MostroP2P/mostrix repository (Rust/Cargo project), directly overriding `aws-lc-sys` to >= 0.38.0 in Cargo.toml breaks Windows/MSVC builds due to a long-standing upstream issue where the build system does not pass `/std:c11` to `cl.exe`, causing `C atomics require C11 or later` errors. The correct fix is to wait for upstream crates (e.g., `nostr-sdk`) to adopt a compatible `aws-lc-rs`/`aws-lc-sys` version that builds on Windows. The `aws-lc-sys` Dependabot alerts should be acknowledged in the GitHub UI with a note about the Windows MSVC incompatibility until upstream support is available.

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Walkthrough

Dependencies in Cargo.toml were bumped across multiple crates including mostro-core (0.8.0), tokio (1.50.0), config (0.15.22), serde (1.0.228), uuid (1.22.0), and rustls (0.23.37). The reqwest dependency was reformatted from inline to multiline array syntax while preserving existing feature configuration.

Changes

Cohort / File(s)	Summary
Dependency Updates Cargo.toml	Version bumps for mostro-core, tokio, config, serde, uuid, and rustls. Reformatted reqwest dependency declaration to multiline array format with unchanged features (rustls, json, http2) and default-features = false.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Dependencies dance in versions new,
Tokio hops to 1.50 true,
UUID leaps to 1.22 high,
Cargo locks them in the sky,
A rabbit's work, all clean and spry!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title claims to update 'aws-lc-sys' but the actual changes only update mostro-core, tokio, config, serde, uuid, and rustls in Cargo.toml. The aws-lc-sys update mentioned in the PR summary is not reflected in the file changes provided.	Revise the title to accurately reflect the actual dependency updates in the changeset, or verify that the Cargo.toml changes are complete and include the aws-lc-sys update.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update-aws-lc-security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Cargo.toml`:
- Around line 32-37: The updated rustls = "0.23.37" entry in Cargo.toml pulls in
aws-lc-sys 0.39.0 which breaks Windows/MSVC builds; to fix, revert or pin rustls
to the last known-compatible patch (e.g., 0.23.36) in the Cargo.toml entry for
rustls or add a crates-io override/patch to force a compatible
aws-lc-sys/aws-lc-rs version, and add a short PR note acknowledging the
Dependabot alert and that Windows/MSVC builds are intentionally guarded until
upstream (e.g., nostr-sdk/aws-lc-rs) provides a compatible release.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b2dbe67c-40cf-42fc-b926-625b9e48bf96

📥 Commits

Reviewing files that changed from the base of the PR and between 380f662 and c21102a.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the transitive dependency chain and aws-lc-sys version
echo "Checking Cargo.lock for aws-lc-sys version..."
rg "name = \"aws-lc-sys\"" -A2 Cargo.lock

echo ""
echo "Checking rustls dependency chain..."
rg "name = \"rustls\"" -A5 Cargo.lock | head -20

echo ""
echo "Checking if project has Windows CI or targets..."
fd -e yml -e yaml . .github/workflows --exec cat {} \; 2>/dev/null | rg -i "windows" || echo "No Windows CI config found in workflows"

Repository: MostroP2P/mostrix

Length of output: 714

---

rustls 0.23.37 will break Windows/MSVC builds via aws-lc-sys 0.39.0.

Updating rustls to 0.23.37 introduces aws-lc-sys 0.39.0 as a transitive dependency, which fails on Windows/MSVC because the build system does not pass /std:c11 to cl.exe, causing "C atomics require C11 or later" errors. Your project includes Windows CI targets, making this a breaking change.

Recommendation: Wait for upstream crates (e.g., nostr-sdk) to adopt a compatible aws-lc-rs/aws-lc-sys version that builds on Windows. Acknowledge the Dependabot alerts in the GitHub UI with a note about this incompatibility until upstream support is available.

If Windows support is not a project requirement, document that decision before merging.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Cargo.toml` around lines 32 - 37, The updated rustls = "0.23.37" entry in
Cargo.toml pulls in aws-lc-sys 0.39.0 which breaks Windows/MSVC builds; to fix,
revert or pin rustls to the last known-compatible patch (e.g., 0.23.36) in the
Cargo.toml entry for rustls or add a crates-io override/patch to force a
compatible aws-lc-sys/aws-lc-rs version, and add a short PR note acknowledging
the Dependabot alert and that Windows/MSVC builds are intentionally guarded
until upstream (e.g., nostr-sdk/aws-lc-rs) provides a compatible release.