Bump aes-gcm from 0.10.3 to 0.11.0

[dependabot]

Bumps aes-gcm from 0.10.3 to 0.11.0.

Commits

• a10b56f aes-gcm v0.11.0 (#852)
• f042e9c aead-stream v0.6.0 (#851)
• b29735a Adopt Trusted Publishing (#854)
• a1fe43f xaes-256-gcm: enable and fix workspace level lints (#850)
• 8cf876f eax: remove toplevel lint attributes (#849)
• 4661ddf ocb3: enable and fix workspace-level lints (#848)
• c821431 eax: enable and fix workspace-level lints (#847)
• d3684bb deoxys: enable and fix workspace-level lints (#846)
• 5e016e2 chacha20poly1305: enable and fix workspace-level lints (#845)
• b3524d3 ccm: enable and fix workspace-level lints (#844)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​aes@​0.9.2
	cargo/​aes-gcm@​0.11.0

View full report

[ev-vaultkeeper]

Dependabot review: aes-gcm 0.10.3 -> 0.11.0

This bump does not compile as submitted, so I pushed a follow-up commit to this branch to make it build. Summary below.

Usage in the repo

aes-gcm is only used in attestation-doc-validation/src/nsm/crypto.rs, where CryptoClient implements the cose Encryption/Decryption/Hash traits. Note that the attestation-validation path only exercises the Hash + signature-verification code (get_payload::<CryptoClient>(None) / validate_cose_signature); the AES-GCM encrypt/decrypt functions exist only to satisfy the cose trait bounds and are not exercised by the library or its tests. Runtime risk from the bump is therefore low — the requirement is just that it keeps compiling.

Why it broke

1. Native build. aes-gcm 0.11 moves to the cipher 0.5 / aes 0.9 generation of the RustCrypto stack (aead 0.5->0.6, cipher 0.4->0.5, ghash 0.5->0.6, ctr 0.9->0.10). The custom alias type Aes192Gcm = AesGcm<Aes192, U12> uses aes::Aes192 from the top-level aes crate, which was still pinned to ^0.8 (cipher 0.4 traits), so KeyInit/new_from_slice no longer satisfied the trait bounds. Aes128Gcm/Aes256Gcm come from aes-gcm itself and were unaffected.
2. wasm build. aes-gcm 0.11's default features enable getrandom, which now pulls in getrandom 0.4 (via crypto-common 0.2). The crate's wasm32 override only pins getrandom 0.2 (js feature), so the wasm build failed with the getrandom 0.4 "wasm_js backend not enabled" error. (aes-gcm 0.10.3's default also enabled getrandom, but back then it resolved to getrandom 0.2, which is why wasm built fine on main.)

Fix pushed

aes = "^0.9"
aes-gcm = { version = "^0.11", default-features = false, features = ["aes", "alloc"] }

• Bumping aes to ^0.9 makes Aes192 implement the cipher 0.5 traits aes-gcm 0.11 needs (aes 0.9.2 was already in the lockfile via aes-gcm, so no new crates are added on that account).
• Disabling default features and enabling only aes + alloc drops the unused getrandom feature, removing getrandom 0.4 (+ r-efi, rand_core 0.10) from the resolved graph and restoring the wasm build. This preserves every aes-gcm API the code actually uses.

Verification

• cargo fmt --check, cargo clippy -- -W clippy::pedantic, cargo check/build (debug + release) for the main crate.
• cargo test plus both time_sensitive_beta and time_sensitive_ga suites — all pass.
• cargo check and cargo build --release for wasm-attestation-bindings on wasm32-unknown-unknown — pass.
• --locked builds succeed, so the lockfile is consistent.
• The changelog shows no algorithmic/behavioral change to AES-GCM itself and no security-relevant regressions; the only fixed constants (P_MAX/A_MAX) are unrelated to this usage.

Conclusion: safe to merge with the pushed fix. (The pre-existing kotlin-attestation-bindings uniffi_bindgen_main build failure also occurs on main and is unrelated to this PR / not part of CI.)