Update dependency aws/aws-lc to v5.5.0

[openvpn-inc-ci]

This PR contains the following updates:

Package	Update	Change
aws/aws-lc	minor	v5.0.0 → v5.5.0

---

Release Notes

aws/aws-lc (aws/aws-lc)

v5.5.0

Compare Source

What's Changed

• Restore ADX/AVX2 code paths under OPENSSL_SMALL via new MY_ASSEMBLER_IS_TOO_OLD_FOR_ADX_AVX2 flag by @​justsmth in #​3368
• Include <openssl/cipher.h> from <openssl/hmac.h> for OpenSSL compat by @​justsmth in #​3371
• ci: harden security-review.yml against script injection by @​nebeid in #​3365
• Fix flaky s_client cipher tests by using better ciphers by @​justsmth in #​3373
• chore: simplify the api docs workflow by @​dougch in #​3186
• Add tests for RSASSA-PSS with SHA-3 digest and MGF1 by @​WillChilds-Klein in #​3377
• Link header documentation from README by @​WillChilds-Klein in #​3378
• Rename autofix reasoning role to AwsLcGitHubActionsBedrockRole by @​tianyiy-tim in #​3376
• ci: pin openssh required job by @​dougch in #​3387
• delocate: Drop redundant -dI flag by @​hanno-becker in #​3384
• Add Neoverse-V3 (Graviton5) detection and dispatch by @​nebeid in #​3374
• Bump ring from 0.17.8 to 0.17.14 in /tests/ci/lambda by @​dependabot[bot] in #​3375
• Fix docker image dependencies and update octocrab initialization by @​prasden in #​3388
• Update FIPS.md by @​justsmth in #​3382
• Bump urllib3 from 2.6.3 to 2.7.0 in /tests/ci by @​dependabot[bot] in #​3372
• Add MinGW shared-library Windows CI coverage by @​justsmth in #​3398
• Update concurrency in security-review by @​nhatnghiho in #​3403
• Enable linker garbage collection for non-FIPS static builds by @​justsmth in #​3397
• Prepare 5.5.0 by @​justsmth in #​3401

New Contributors

• @​tianyiy-tim made their first contribution in #​3376

Full Changelog: aws/aws-lc@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

• Add AArch64 NEON runtime fallback for ML-KEM and ML-DSA by @​samuel40791765 in #​3353
• Support for EVP_AEAD_CTX_copy by @​justsmth in #​3332
• ci:ctest timing summary for MacOS by @​dougch in #​3288
• Remove dead P-256 nistz asm under OPENSSL_SMALL and extend the size-check harness by @​justsmth in #​3350
• Use built-in Camellia in krb5 integration patch; fix CTS doc label by @​WillChilds-Klein in #​3349
• Bump to v5.4.0, add AES-KWP wrap/unwrap CASTs by @​WillChilds-Klein in #​3366

Full Changelog: aws/aws-lc@v5.3.0...v5.4.0

v5.3.0

Compare Source

What's Changed

• Bump log from 0.4.30 to 0.4.33 in /tests/ci/lambda in the cargo-ci-lambda group by @​dependabot[bot] in #​3329
• Auto-fix integration patches and upload to S3 by @​prasden in #​3324
• Bump golang.org/x/crypto from 0.47.0 to 0.52.0 in /util/vecgen by @​dependabot[bot] in #​3339
• Add ACVP support for multi-expansion HKDF by @​nhatnghiho in #​3352
• Prepare 5.3.0 by @​nhatnghiho in #​3354

Full Changelog: aws/aws-lc@v5.2.0...v5.3.0

v5.2.0

Compare Source

What's Changed

• OPENSSL_SMALL: imply MY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX on x86_64 by @​justsmth in #​3319
• Documented and added feature stability tests for EVP_AEAD implementations that support concurrency through EVP_AEAD_CTX_seal/gather functions by @​torben-hansen in #​3325
• Fix libgit2, xtrabackup, grpc tests and add OSSL3 peer cert APIs by @​WillChilds-Klein in #​3331
• Null-guard EVP_AEAD_CTX_cleanup for fork+shm safety by @​WillChilds-Klein in #​3336
• Add Symbol Versioning Support by @​skmcgrail in #​3096
• Symbol versioning follow-ups: register peer cert APIs, fix dist_pkg_tests matrix by @​WillChilds-Klein in #​3338
• Update security review workflow by @​nhatnghiho in #​3333
• Add ML-KEM decapsulate CASTs to break-kat tooling by @​WillChilds-Klein in #​3342
• Pin required libssh2 integration to a release; track main separately by @​WillChilds-Klein in #​3343
• ci: harden GitHub Actions workflows against script injection by @​justsmth in #​3323
• openssl/target.h: Allow building for the e2k architecture by @​arrowd in #​3314
• Bump github.com/cloudflare/circl from 1.6.3 to 1.6.4 in /util/vecgen in the gomod-vecgen group by @​dependabot[bot] in #​3327
• Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 in /tests/ci/x509/limbo-report in the gomod-limbo-report group by @​dependabot[bot] in #​3328
• Add CTS mode, krb5 integration test by @​WillChilds-Klein in #​3308
• Gate s2n-bignum _alt variants under OPENSSL_SMALL by @​justsmth in #​3320
• Fix SSL_OP_IGNORE_UNEXPECTED_EOF being ignored over sockets by @​prasden in #​3341
• Prepare v5.2.0 by @​WillChilds-Klein in #​3348

New Contributors

• @​arrowd made their first contribution in #​3314

Full Changelog: aws/aws-lc@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed

• Quote LIBCRYPTO_PATH for dynamic load test by @​WillChilds-Klein in #​3259
• Add SSL_CTX_set_security_callback and related APIs for OpenSSL compat… by @​WillChilds-Klein in #​3275
• ci: move BSD actions to scheduled by @​dougch in #​3276
• Bump cross-platform-actions/action from 0.32.0 to 1.2.0 in the github-actions group by @​dependabot[bot] in #​3285
• Bump the cargo-ci-lambda group in /tests/ci/lambda with 4 updates by @​dependabot[bot] in #​3284
• Bump aws-cdk-lib from 2.251.0 to 2.255.0 in /tests/ci in the pip-ci group by @​dependabot[bot] in #​3283
• ML-DSA: import and enable x86_64 assembly backend from mldsa-native by @​jakemas in #​3195
• ci: fix Windows CI breakage from VS2026 (MSVC 14.51) image bump by @​justsmth in #​3298
• Fix PostgreSQL integration: match upstream revoked-cert alert regex by @​justsmth in #​3299
• Support SSL_OP_IGNORE_UNEXPECTED_EOF option by @​prasden in #​3294
• Update MySQL CI integration to mysql-cluster-9.7.1 by @​justsmth in #​3302
• Switch integration tests to nightly and raise alarm on failures by @​prasden in #​3287
• Stabilize libgit2 integration test by @​justsmth in #​3300
• Fix SSL_CTX_add_extra_chain_cert slot routing for chains added before the leaf by @​samuel40791765 in #​3296
• Make OPENSSL_memcmp constant time by @​WillChilds-Klein in #​3183
• Add WASIp2 build and test support by @​justsmth in #​3172
• Move TLS 1.3 KDF into the FIPS module and wire up ACVP by @​justsmth in #​3247
• Bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​3307
• Define OPENSSL_INIT_NO_ATEXIT as a no-op by @​samuel40791765 in #​3311
• ML-DSA: import and enable aarch64 assembly backend from mldsa-native by @​jakemas in #​3219
• ci: opt in to allow-unsafe-pr-checkout for gated pull_request_target jobs by @​jakemas in #​3313
• Bump AWSLC_FIPS_VERSION to 5 for next FIPS branch by @​samuel40791765 in #​3316
• Add 'version -fips' to surface FIPS module version in openssl tool by @​samuel40791765 in #​3315
• Concurrency is not generally supported for EVP_AEAD_CTX_foo functions by @​torben-hansen in #​3318
• Prepare v5.1.0 release by @​samuel40791765 in #​3321

Full Changelog: aws/aws-lc@v5.0.0...v5.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.