v5.4.0

Compare Source

What's Changed

• Add AArch64 NEON runtime fallback for ML-KEM and ML-DSA by @​samuel40791765 in #​3353
• Support for EVP_AEAD_CTX_copy by @​justsmth in #​3332
• ci:ctest timing summary for MacOS by @​dougch in #​3288
• Remove dead P-256 nistz asm under OPENSSL_SMALL and extend the size-check harness by @​justsmth in #​3350
• Use built-in Camellia in krb5 integration patch; fix CTS doc label by @​WillChilds-Klein in #​3349
• Bump to v5.4.0, add AES-KWP wrap/unwrap CASTs by @​WillChilds-Klein in #​3366

Full Changelog: aws/aws-lc@v5.3.0...v5.4.0

v5.3.0

Compare Source

What's Changed

• Bump log from 0.4.30 to 0.4.33 in /tests/ci/lambda in the cargo-ci-lambda group by @​dependabot[bot] in #​3329
• Auto-fix integration patches and upload to S3 by @​prasden in #​3324
• Bump golang.org/x/crypto from 0.47.0 to 0.52.0 in /util/vecgen by @​dependabot[bot] in #​3339
• Add ACVP support for multi-expansion HKDF by @​nhatnghiho in #​3352
• Prepare 5.3.0 by @​nhatnghiho in #​3354

Full Changelog: aws/aws-lc@v5.2.0...v5.3.0

v5.2.0

Compare Source

What's Changed

• OPENSSL_SMALL: imply MY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX on x86_64 by @​justsmth in #​3319
• Documented and added feature stability tests for EVP_AEAD implementations that support concurrency through EVP_AEAD_CTX_seal/gather functions by @​torben-hansen in #​3325
• Fix libgit2, xtrabackup, grpc tests and add OSSL3 peer cert APIs by @​WillChilds-Klein in #​3331
• Null-guard EVP_AEAD_CTX_cleanup for fork+shm safety by @​WillChilds-Klein in #​3336
• Add Symbol Versioning Support by @​skmcgrail in #​3096
• Symbol versioning follow-ups: register peer cert APIs, fix dist_pkg_tests matrix by @​WillChilds-Klein in #​3338
• Update security review workflow by @​nhatnghiho in #​3333
• Add ML-KEM decapsulate CASTs to break-kat tooling by @​WillChilds-Klein in #​3342
• Pin required libssh2 integration to a release; track main separately by @​WillChilds-Klein in #​3343
• ci: harden GitHub Actions workflows against script injection by @​justsmth in #​3323
• openssl/target.h: Allow building for the e2k architecture by @​arrowd in #​3314
• Bump github.com/cloudflare/circl from 1.6.3 to 1.6.4 in /util/vecgen in the gomod-vecgen group by @​dependabot[bot] in #​3327
• Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 in /tests/ci/x509/limbo-report in the gomod-limbo-report group by @​dependabot[bot] in #​3328
• Add CTS mode, krb5 integration test by @​WillChilds-Klein in #​3308
• Gate s2n-bignum _alt variants under OPENSSL_SMALL by @​justsmth in #​3320
• Fix SSL_OP_IGNORE_UNEXPECTED_EOF being ignored over sockets by @​prasden in #​3341
• Prepare v5.2.0 by @​WillChilds-Klein in #​3348

New Contributors

• @​arrowd made their first contribution in #​3314

Full Changelog: aws/aws-lc@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed

• Quote LIBCRYPTO_PATH for dynamic load test by @​WillChilds-Klein in #​3259
• Add SSL_CTX_set_security_callback and related APIs for OpenSSL compat… by @​WillChilds-Klein in #​3275
• ci: move BSD actions to scheduled by @​dougch in #​3276
• Bump cross-platform-actions/action from 0.32.0 to 1.2.0 in the github-actions group by @​dependabot[bot] in #​3285
• Bump the cargo-ci-lambda group in /tests/ci/lambda with 4 updates by @​dependabot[bot] in #​3284
• Bump aws-cdk-lib from 2.251.0 to 2.255.0 in /tests/ci in the pip-ci group by @​dependabot[bot] in #​3283
• ML-DSA: import and enable x86_64 assembly backend from mldsa-native by @​jakemas in #​3195
• ci: fix Windows CI breakage from VS2026 (MSVC 14.51) image bump by @​justsmth in #​3298
• Fix PostgreSQL integration: match upstream revoked-cert alert regex by @​justsmth in #​3299
• Support SSL_OP_IGNORE_UNEXPECTED_EOF option by @​prasden in #​3294
• Update MySQL CI integration to mysql-cluster-9.7.1 by @​justsmth in #​3302
• Switch integration tests to nightly and raise alarm on failures by @​prasden in #​3287
• Stabilize libgit2 integration test by @​justsmth in #​3300
• Fix SSL_CTX_add_extra_chain_cert slot routing for chains added before the leaf by @​samuel40791765 in #​3296
• Make OPENSSL_memcmp constant time by @​WillChilds-Klein in #​3183
• Add WASIp2 build and test support by @​justsmth in #​3172
• Move TLS 1.3 KDF into the FIPS module and wire up ACVP by @​justsmth in #​3247
• Bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​3307
• Define OPENSSL_INIT_NO_ATEXIT as a no-op by @​samuel40791765 in #​3311
• ML-DSA: import and enable aarch64 assembly backend from mldsa-native by @​jakemas in #​3219
• ci: opt in to allow-unsafe-pr-checkout for gated pull_request_target jobs by @​jakemas in #​3313
• Bump AWSLC_FIPS_VERSION to 5 for next FIPS branch by @​samuel40791765 in #​3316
• Add 'version -fips' to surface FIPS module version in openssl tool by @​samuel40791765 in #​3315
• Concurrency is not generally supported for EVP_AEAD_CTX_foo functions by @​torben-hansen in #​3318
• Prepare v5.1.0 release by @​samuel40791765 in #​3321

Full Changelog: aws/aws-lc@v5.0.0...v5.1.0