Bump p384 from 0.13.1 to 0.14.0

[dependabot]

Bumps p384 from 0.13.1 to 0.14.0.

Commits

• 24b65d1 p384 v0.14.0 (#1892)
• 65e79db p384: vendor and fix workspace-level lints (#1891)
• 27e62fd p256 v0.14.0 (#1890)
• 693577d p256: vendor and fix workspace-level lints (#1888)
• ef3a3b1 primeorder v0.14.0 (#1887)
• 3688e30 primeorder: enable and fix workspace level lints (#1886)
• 7f576df wnaf v0.14.0 (#1884)
• a6aeae5 wnaf: enable and fix workspace-level lints (#1885)
• b212497 Bump ecdsa to v0.17 (#1883)
• df6d7bd document PKCS#8 key loading (#1874)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​getrandom@​0.4.3
	cargo/​p384@​0.14.0

View full report

[ev-vaultkeeper]

Dependabot review: p384 0.13.1 → 0.14.0

Verdict: safe to merge, but the raw bump does not build. I pushed two small, behaviour-preserving commits to this branch to make it compile and pass CI. With those commits in place the change is good to go.

Why the raw bump breaks

p384 0.14 is a major upgrade of its internal RustCrypto stack (elliptic-curve 0.13→0.14, ecdsa 0.16→0.17, sha2 0.10→0.11, signature 2→3, der 0.7→0.8, plus new crypto-bigint 0.7 / crypto-common 0.2 / hybrid-array / getrandom 0.4). Only p384 was bumped in Cargo.toml; p256, ecdsa, der, sha2 stay on their old versions, so p256 remains on ecdsa 0.16 while p384 moves to ecdsa 0.17.

The only place the crate touches p384 is the shared impl_signature_verification! macro in attestation-doc-validation/src/nsm/pkey.rs, used for both p256 and p384. ecdsa 0.17 broke three things there (build errors E0433/E0425/E0599):

• p384::EncodedPoint was renamed to p384::Sec1Point.
• VerifyingKey::from_encoded_point was removed (replaced by from_sec1_point/from_sec1_bytes).
• The file-level use ecdsa::signature::hazmat::PrehashVerifier (ecdsa 0.16 / signature 2.2) no longer matches p384 0.14's VerifyingKey, which now implements signature 3.0's PrehashVerifier.

Separately, the new stack pulls in getrandom 0.4, which fails to compile for wasm32-unknown-unknown unless a backend is selected; the existing override only covers getrandom 0.2. wasm-attestation-bindings uses this crate via a path dependency, so the build_wasm job would break.

Fixes pushed

1. Migrate ECDSA verification to the p384 0.14 API — the macro now uses VerifyingKey::from_sec1_bytes(self.public_key().as_ref()) (present and semantically identical in both ecdsa 0.16 and 0.17 — it is exactly the previous EncodedPoint::from_bytes + from_encoded_point combined) and brings PrehashVerifier into scope per curve via $curve::ecdsa::signature, so p256 (0.13) and p384 (0.14) each resolve the correct trait version. Removed the now-unused direct ecdsa dependency. No change to Signature::from_str (hex parsing identical in both versions).
2. Enable getrandom's wasm_js backend for the p384 0.14 stack on wasm32 — added a wasm32-target override enabling getrandom 0.4's wasm_js feature, mirroring how getrandom 0.2's js backend is already enabled. Only affects wasm32.

Verification

• cargo build, cargo clippy -- -W clippy::pedantic, cargo fmt --check: clean (only pre-existing lifetime-elision warnings).
• Full test suite passes, including the FAKETIME time-sensitive tests that verify real P-384 Nitro attestation documents end-to-end — strong evidence the verification path is unchanged.
• wasm32-unknown-unknown release build passes.

Heads-up (not blocking)

p384 0.14 raises MSRV to Rust 1.85 and moves to edition 2024. This crate declares no rust-version, and CI builds on current stable, so it's fine here — but downstream consumers will need a compiler ≥ 1.85.