[dependabot]

Updates the requirements on pkcs8 to permit the latest version.

Commits

• a582243 pkcs8 v0.11.0 (#2314)
• 6f2ea3e der: disable wasmtime tests (#2315)
• 055d258 pkcs8 v0.11.0-rc.12 (#2312)
• 7d69c45 pkcs8: getrandom feature (#2311)
• 381e23c pkcs8: use TryCryptoRng instead of CryptoRng (#2309)
• 77c386e pkcs8: replace subtle with ctutils (#2308)
• 967d9f1 pkcs8: add KeyError enum (#2305)
• 1a52afe pkcs8: impl Decode/EncodePrivateKey for PrivateKeyInfoOwned (#2306)
• e65d751 pkcs8: enable workspace-level lint config (#2304)
• c50f584 pkcs5: build with all-features = true on docs.rs (#2303)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[abs0luty]

Closing this one — the bump is blocked by our MSRV, and it's not driven by any security fix.

pkcs8 0.11 pulls in der 0.8, spki 0.8, const-oid 0.10, base64ct 1.8, and for the encryption feature the PBES2 stack (aes-gcm 0.11 -> aes 0.9.4). All of these are edition 2024:

• der / spki / const-oid / base64ct / aes-gcm: MSRV 1.85
• aes 0.9.4: MSRV 1.89

We pin rust-version = "1.82" (Cargo.toml, README, and the MSRV CI matrix). Cargo 1.82 cannot even parse the manifests:

Caused by: feature `edition2024` is required
The package requires the Cargo feature called `edition2024`, but that feature is not
stabilized in this version of Cargo (1.82.0)

Raising the MSRV to 1.89 would drop 1.82/1.85 users for everyone, including people who never enable tls-rustls-encrypted-keys - Cargo has no per-feature MSRV.

Why it isn't urgent?

• No advisories for pkcs8 or der in OSV/RustSec.
• pkcs8 types never appear in our public API (the only use is private, in config_from_pem_with_password), so nothing downstream needs us to track it.
• It's behind the opt-in tls-rustls-encrypted-keys feature, off by default.

I've added an ignore rule for the 0.x minor line in .github/dependabot.yaml, so this won't be reopened daily. When we next raise the MSRV to 1.89+, this is worth picking up.