Bump x509-parser from 0.14.0 to 0.18.1

[dependabot]

Bumps x509-parser from 0.14.0 to 0.18.1.

Changelog

Sourced from x509-parser's changelog.

ChangeLog

[Unreleased][unreleased]

Added/Changed/Fixed

• Add new feature verify-aws-fips to use the FIPS-approved crypto module of aws-lc-rs (#233)

Thanks

0.18.0

Added/Changed

• Update lock file and dependencies
• Fix clippy warnings
• Visitor: add method to visit unknown extension and those with parse errors
• Add new feature verify-aws to use aws-lc-rs as crypto provider instead of ring
  • The features are exclusive, so only one should be used
  • If both are specified, aws-lc-rs is used (but both dependencies are included)
• Add as_raw methods to X509Certificate, CertificateRevocationList and X509CertificationRequest
  • This method exposes the raw ASN.1 DER bytes used to build the object (#217)

Extensions:

• Add support for SubjectInfoAccess extension
• GeneralName: add a new variant Invalid so an invalid entry does not stop parsing for the entire list of names (for ex in SAN)

Fixed

• PEM: ignore lines in comments which contain invalid UTF-8 characters (#180)

Thanks

• Daniel McCarney, Lily Ballard, @​stormshield-gt, @​soundofspace

0.17.0

Added/Changed/Fixed

Global:

• Upgrade asn1-rs to version 0.6.2. (#161)
• Update asn1-rs to 0.7, der-parser to 10.0 and oid-registry to 0.8
• Upgrade time to 0.3.35 to make the crate compatible with rust >1.79.0 (#168, #175)
• Update MSRV to 1.67 (due to time 0.3.35, see #168)
• Add Visitor traits for X.509 Certificates and Certificate Revocation Lists (#179)

Code:

• Add support for RSA-PSS signature verification (#156)
• ASN1Time: store the kind of time (UTC or Generalized) in ASN1Time (#163)

... (truncated)

Commits

• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​x509-parser@​0.18.1

View full report

[ev-vaultkeeper]

Dependabot review: x509-parser 0.14.0 → 0.18.1 — safe to merge ✅

Audited every use of x509-parser in the workspace against the API changes across 0.15–0.18. The library and wasm bindings build, and the full test suite (including the time-sensitive tests that validate real attestation docs) passes locally, matching the PR's green CI.

Scope of the bump

Only the local workspace crate attestation-doc-validation (v0.10.1) — and therefore wasm-attestation-bindings, which uses the path dependency — actually picks up 0.18.1. The node/python/swift/kotlin bindings depend on the published crates (0.9.0 / 0.10.0) which stay on x509-parser 0.14.0, so they're unaffected. Transitive bumps: asn1-rs 0.5→0.7, der-parser 8→10, oid-registry 0.6→0.8, and thiserror 1→2 scoped inside the x509-parser subtree.

API usage — all still valid

• X509Certificate, parse_x509_certificate, pem::parse_x509_pem, error::PEMError — unchanged.
• get_extension_unique / parsed_extension / ParsedExtension::SubjectAlternativeName { general_names } — unchanged.
• GeneralName::DNSName(&str) — unchanged. 0.18 adds a new GeneralName::Invalid variant; the code matches non-exhaustively (let … else / filter_map), so it compiles and behaves correctly. Behavioural note: an invalid SAN entry no longer aborts parsing of the whole SAN list (it becomes Invalid and is skipped) — harmless here since we only pick the longest DNSName.
• x509::SubjectPublicKeyInfo { subject_public_key: BitString, raw: &[u8] } — unchanged between 0.14 and 0.18.
• oid_registry::asn1_rs::BitString<'a> — identical between asn1-rs 0.5.2 and 0.7.2 (same fields, lifetime, and AsRef<[u8]> impl), so nsm/pkey.rs is unaffected.
• oid_registry::Oid::from_str — unchanged.

Security / performance

No concerns. Default features are still default = [] in both versions (the verify/ring crypto backend remains optional and is not enabled here), so the wasm target still builds without pulling ring. The bumped deps (thiserror 2, asn1-rs 0.7, der-parser 10) are maintained releases. I also verified the unusual-looking syn 3.0.3 and thiserror-impl 2.0.20 → syn ^3 lockfile entries against the live crates.io sparse index — checksums match; not a tampered lockfile.

Verification performed

• cargo build / cargo check — OK (only pre-existing lint warnings).
• cargo test incl. time_sensitive_beta (FAKETIME=1674054914) and time_sensitive_ga (FAKETIME=1695050165) — all pass (real cert parse, SAN extraction, trust-chain validation, COSE signature verification).
• cargo clippy -- -W clippy::pedantic and cargo fmt --check — clean.
• wasm-attestation-bindings built for wasm32-unknown-unknown — OK.

No source changes were needed.