Minor nits + changelog

RELEASE_NOTES

@@ -1,3 +1,16 @@
+5.3.0
+- 2026-10-14 Add action-aware certificate selection callbacks
+- 2026-10-14 Back-compat shims for v4
+- 2026-10-14 Add X509Ref::check_host_with_flags (fixes #530)
+- 2026-10-09 boring-sys: exclude non-BoringSSL symbols from bindings
+- 2026-09-30 Fix tests failures related to upstream X509_V_FLAG_TRUSTED_FIRST change
+- 2026-09-30 Update to boringssl 0.20260929.0
+- 2026-08-28 RTG-5132 Enable X25519MLKEM768 in FIPS compliance profile
+- 2026-08-20 RTG-5132 Bump BoringSSL
+- 2026-09-22 Add native HKDF bindings
+- 2026-08-14 Semver compat for nonce mutability issue
+- 2026-06-25 aead: require &mut self for seal/open and add TLS AEAD variants
+
 5.2.0
 - 2026-10-14 Add action-aware certificate selection callbacks, including ECH fallback
 - 2026-05-21 Export `DEP_BORINGSSL_VERSION_MAJOR` var

boring/src/asn1.rs

@@ -62,7 +62,7 @@ foreign_type_and_impl_send_sync! {
 }
 
 impl fmt::Display for Asn1GeneralizedTimeRef {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let bio = MemBio::new().ok();
         let msg = bio
             .as_ref()
@@ -261,7 +261,7 @@ impl PartialOrd<Asn1Time> for &Asn1TimeRef {
 }
 
 impl fmt::Display for Asn1TimeRef {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         unsafe {
             let mem_bio = match MemBio::new() {
                 Err(_) => return f.write_str("error"),
@@ -270,14 +270,14 @@ impl fmt::Display for Asn1TimeRef {
             let print_result = cvt(ffi::ASN1_TIME_print(mem_bio.as_ptr(), self.as_ptr()));
             match print_result {
                 Err(_) => f.write_str("error"),
-                Ok(_) => f.write_str(str::from_utf8_unchecked(mem_bio.get_buf())),
+                Ok(()) => f.write_str(str::from_utf8_unchecked(mem_bio.get_buf())),
             }
         }
     }
 }
 
 impl fmt::Debug for Asn1TimeRef {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         fmt::Display::fmt(self, f)
     }
 }
@@ -439,7 +439,7 @@ impl Asn1StringRef {
 }
 
 impl fmt::Debug for Asn1StringRef {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+    fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self.as_utf8() {
             Ok(openssl_string) => openssl_string.fmt(fmt),
             Err(_) => fmt.write_str("error"),
@@ -606,7 +606,7 @@ impl Asn1ObjectRef {
 }
 
 impl fmt::Display for Asn1ObjectRef {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+    fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
         unsafe {
             let mut buf = [0u8; 80];
             let len = ffi::OBJ_obj2txt(
@@ -625,7 +625,7 @@ impl fmt::Display for Asn1ObjectRef {
 }
 
 impl fmt::Debug for Asn1ObjectRef {
-    fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
+    fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
         fmt::Display::fmt(self, fmt)
     }
 }

boring/src/ssl/mod.rs

@@ -1199,7 +1199,7 @@ impl SslContextBuilder {
             self.ctx.replace_ex_data(callback_index, callback);
             let callback = self.ctx.ex_data(callback_index).unwrap();
 
-            let arg = std::ptr::from_ref(callback).cast_mut().cast();
+            let arg = ptr::from_ref(callback).cast_mut().cast();
             ffi::SSL_CTX_set_tlsext_servername_arg(self.as_ptr(), arg);
             ffi::SSL_CTX_set_tlsext_servername_callback(self.as_ptr(), Some(raw_sni::<F>));
         }
@@ -4763,20 +4763,20 @@ pub trait CertificateCompressor: Send + Sync + 'static {
 
     /// Perform compression of `input` buffer and write compressed data to `output`.
     #[allow(unused_variables)]
-    fn compress<W>(&self, input: &[u8], output: &mut W) -> std::io::Result<()>
+    fn compress<W>(&self, input: &[u8], output: &mut W) -> io::Result<()>
     where
-        W: std::io::Write,
+        W: Write,
     {
-        Err(std::io::Error::other("not implemented"))
+        Err(io::Error::other("not implemented"))
     }
 
     /// Perform decompression of `input` buffer and write compressed data to `output`.
     #[allow(unused_variables)]
-    fn decompress<W>(&self, input: &[u8], output: &mut W) -> std::io::Result<()>
+    fn decompress<W>(&self, input: &[u8], output: &mut W) -> io::Result<()>
     where
-        W: std::io::Write,
+        W: Write,
     {
-        Err(std::io::Error::other("not implemented"))
+        Err(io::Error::other("not implemented"))
     }
 }
 

boring/src/ssl/test/mod.rs

@@ -467,7 +467,7 @@ fn test_select_cert_disable_ech_without_ech_fails() {
 #[test]
 fn test_select_cert_unknown_extension() {
     let mut server = Server::builder();
-    let unknown_extension = std::sync::Arc::new(std::sync::Mutex::new(Some(vec![])));
+    let unknown_extension = Arc::new(std::sync::Mutex::new(Some(vec![])));
 
     server.ctx().set_select_certificate_callback({
         let unknown = unknown_extension.clone();
@@ -491,7 +491,7 @@ fn test_select_cert_unknown_extension() {
 #[test]
 fn test_select_cert_alpn_extension() {
     let mut server = Server::builder();
-    let alpn_extension = std::sync::Arc::new(std::sync::Mutex::new(None));
+    let alpn_extension = Arc::new(std::sync::Mutex::new(None));
     server.ctx().set_select_certificate_callback({
         let alpn = alpn_extension.clone();
         move |client_hello| {
@@ -1390,7 +1390,7 @@ fn peer_signature_algorithm_mtls_server_sees_client() {
     // Observe from a server-side HANDSHAKE_DONE info callback so the capture
     // happens synchronously during the server's accept, before the client's
     // connect() returns.
-    let captured = std::sync::Arc::new(AtomicBool::new(false));
+    let captured = Arc::new(AtomicBool::new(false));
 
     let mut server_builder = Server::builder();
     {
@@ -1401,7 +1401,7 @@ fn peer_signature_algorithm_mtls_server_sees_client() {
             .set_verify_cert_store(store.build())
             .unwrap();
         server_builder.ctx().set_verify(SslVerifyMode::PEER);
-        let captured_cb = std::sync::Arc::clone(&captured);
+        let captured_cb = Arc::clone(&captured);
         server_builder
             .ctx()
             .set_info_callback(move |ssl, mode, _value| {
@@ -1436,11 +1436,11 @@ fn peer_signature_algorithm_mtls_server_sees_client() {
 fn signature_algorithm_used_server_default() {
     // BoringSSL only retains signature_algorithm_used during the handshake, so we
     // capture it from a HANDSHAKE_DONE info callback.
-    let captured = std::sync::Arc::new(AtomicBool::new(false));
+    let captured = Arc::new(AtomicBool::new(false));
 
     let mut server_builder = Server::builder();
     {
-        let captured_cb = std::sync::Arc::clone(&captured);
+        let captured_cb = Arc::clone(&captured);
         server_builder
             .ctx()
             .set_info_callback(move |ssl, mode, _value| {
@@ -1489,8 +1489,8 @@ fn signature_algorithm_used_mtls_client() {
     }
     let server = server_builder.build();
 
-    let captured = std::sync::Arc::new(AtomicBool::new(false));
-    let captured_cb = std::sync::Arc::clone(&captured);
+    let captured = Arc::new(AtomicBool::new(false));
+    let captured_cb = Arc::clone(&captured);
 
     let mut client_builder = server.client_with_root_ca();
     client_builder

hyper-boring/src/lib.rs

@@ -15,8 +15,9 @@ mod v1;
 pub use self::v1::*;
 
 fn key_index() -> Result<Index<Ssl, SessionKey>, ErrorStack> {
-    static IDX: LazyLock<Index<Ssl, SessionKey>> = LazyLock::new(|| Ssl::new_ex_index().unwrap());
-    Ok(*IDX)
+    static IDX: LazyLock<Result<Index<Ssl, SessionKey>, ErrorStack>> =
+        LazyLock::new(Ssl::new_ex_index);
+    IDX.clone()
 }
 
 /// Settings for [`HttpsLayer`]

tokio-boring/examples/simple-async.rs

@@ -7,7 +7,7 @@ async fn main() -> anyhow::Result<()> {
     let (tcp_stream, _addr) = listener.accept().await?;
 
     let server = ssl::SslMethod::tls();
-    let mut ssl_builder = boring::ssl::SslAcceptor::mozilla_modern(server)?;
+    let mut ssl_builder = ssl::SslAcceptor::mozilla_modern(server)?;
     ssl_builder.set_default_verify_paths()?;
     ssl_builder.set_verify(ssl::SslVerifyMode::PEER);
     let acceptor = ssl_builder.build();

tokio-boring/src/lib.rs

@@ -203,7 +203,7 @@ where
     fn poll_read(
         mut self: Pin<&mut Self>,
         ctx: &mut Context<'_>,
-        buf: &mut ReadBuf,
+        buf: &mut ReadBuf<'_>,
     ) -> Poll<io::Result<()>> {
         self.run_in_context(ctx, |s| {
             // SAFETY: read_uninit does not de-initialize the buffer.
@@ -227,17 +227,17 @@ where
 {
     fn poll_write(
         mut self: Pin<&mut Self>,
-        ctx: &mut Context,
+        ctx: &mut Context<'_>,
         buf: &[u8],
     ) -> Poll<io::Result<usize>> {
         self.run_in_context(ctx, |s| cvt(s.write(buf)))
     }
 
-    fn poll_flush(mut self: Pin<&mut Self>, ctx: &mut Context) -> Poll<io::Result<()>> {
+    fn poll_flush(mut self: Pin<&mut Self>, ctx: &mut Context<'_>) -> Poll<io::Result<()>> {
         self.run_in_context(ctx, |s| cvt(s.flush()))
     }
 
-    fn poll_shutdown(mut self: Pin<&mut Self>, ctx: &mut Context) -> Poll<io::Result<()>> {
+    fn poll_shutdown(mut self: Pin<&mut Self>, ctx: &mut Context<'_>) -> Poll<io::Result<()>> {
         match self.run_in_context(ctx, |s| s.shutdown()) {
             Ok(ShutdownResult::Sent | ShutdownResult::Received) => {}
             Err(ref e) if e.code() == ErrorCode::ZERO_RETURN => {}