build(deps): bump openmls_rust_crypto from 0.4.4 to 0.5.1

[dependabot]

Bumps openmls_rust_crypto from 0.4.4 to 0.5.1.

Release notes

Sourced from openmls_rust_crypto's releases.

v0.5

This release has been a while in the making and covers substantial changes since the last release. See our blog post for a brief overview.

Generally, this release has a number of breaking API changes, a few of them are listed below:

• #902: Implement External Add proposal (NewMember sender only) and replace Sender::NewMember by Sender::NewMemberProposal and Sender::NewMemberCommit for external proposals and external commits repectively
• #903: Rename MlsGroup's resumptionn_secret to resumption_secret
• #1058: Rename resumption_secret to resumption_psk
• #900: Expose SerializedMlsGroup until issue #245 is done
• #1117: Remove signature key indirection
• #1123: Rename ResumptionPsk to ResumptionPskSecret and resumption_psk to resumption_psk_secret
• #1155: MlsGroup.members() now returns an iterator over group members, MlsGroup.merge_staged_commit() no longer returns a Result
• #1193: MlsGroup.propose_self_update takes the new LeafNode now instead of a KeyPackage. LeafNode.generate can be used to generate a new LeafNode for an update proposal.

Changelog

Sourced from openmls_rust_crypto's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

• #1972: Add APIs for time-based deletion of past epoch secrets, and for setting the past epoch deletion policy for an MlsGroup.
• #2010: Added MlsGroup::propose_self_update_with_new_signer, a variant of propose_self_update that stages an Update proposal carrying a new signature key.
• #2084: Added the ProcessedMessageContent::OwnPendingCommit variant, returned when processing a Commit authored by this client that matches the group's pending commit. Callers should merge the pending commit via MlsGroup::merge_pending_commit().
• #2109: Added Capabilities::for_provider, a constructor that advertises exactly the ciphersuites supported by the given crypto provider (as reported by OpenMlsCrypto::supported_ciphersuites), instead of the hardcoded default list.
• Added UnsupportedCiphersuite(Ciphersuite) variants to NewGroupError, KeyPackageNewError, WelcomeError, and CreationFromExternalError, returned when the crypto provider does not support the requested ciphersuite.
• #2099: Added ProcessedMessageContent::OwnPrivateMessage variant. Processing a PrivateMessage authored by this client (e.g. echoed back by the delivery service) now succeeds and returns this variant instead of failing. The content cannot be decrypted and the sender claim is unauthenticated; applications should use it only to skip/ignore the echoed message and must not act on it further. With the virtual-clients-draft feature, own messages whose secrets are still retained (e.g. unconfirmed sends) keep decrypting normally; the variant is returned in groups that do not use virtual clients when decryption of an own message fails.

Fixed

• #2134: Known structured extension payloads now reject trailing bytes during decoding instead of silently ignoring them.
• #2109: OpenMlsRustCrypto's OpenMlsCrypto::supports now accepts MLS_256_MLKEM1024_AES256GCM_SHA512_MLDSA87, consistent with its supported_ciphersuites list (draft-ietf-mls-pq-ciphersuites feature).
• #2089: A Commit without an UpdatePath from this client's own leaf that does not match the pending commit is now staged as a regular commit instead of being rejected as a mismatched own commit.
• #2034: Fixes a bug where the integer storage tags for serde non-self-describing serializations were changed, leading to incorrect deserializations. By default, storage format compatibility with openmls v0.7.1 and earlier is now restored. Enabling the 0-8-1-storage-format feature maintains storage format compatibility with openmls v0.8.1 (the previous openmls release).

Changed

• #2109: Group creation, key package creation, welcome processing, external commits, and PublicGroup creation from external input now fail early with a dedicated UnsupportedCiphersuite error when the crypto provider does not support the ciphersuite, instead of failing deep inside a crypto operation.
• #2109: ExternalCommitError::UnsupportedCiphersuite and ExternalCommitBuilderError::UnsupportedCiphersuite now carry the unsupported Ciphersuite.
• #1980: Enrich limetime related errors returned during leaf node validation with more information
• #1972: The method MlsGroup::max_past_epochs() now returns an Option<usize>, rather than a usize
• #1963: MessageEncryptionError is now part of the public API, but only surfaces if the virtual-clients-draft feature flag is enabled.
• #2043: Renamed and deprecated MlsGroup::propose_external_psk to MlsGroup::propose_pre_shared_key. Same for the _by_value variant.
• #2084: Renamed StageCommitError::OwnCommit to StageCommitError::OwnCommitMismatch, now returned only when a Commit authored by this client does not match the pending commit.
• #2099: Removed ValidationError::CannotDecryptOwnMessage; processing an own PrivateMessage is no longer an error.
• #2060 Renamed extensions-draft-08 feature flag to extensions-draft.
• Reworked the receive-side API for AppDataUpdate proposals (extensions-draft feature). MlsGroup::process_message now returns a commit covering AppDataUpdate proposals as ProcessedMessageContent::UnresolvedAppDataCommit. Applications inspect the verified proposals via UnresolvedAppDataCommit::app_data_update_proposals() and resume staging with MlsGroup::stage_app_data_commit(). This replaces the MlsGroup::unprotect_message/MlsGroup::process_unverified_message_with_app_data_updates flow, which exposed unverified message content; both functions are no longer public, and ProcessMessageError::FoundAppDataUpdateProposal was removed.
• #2098: Extended the reworked receive-side API for AppDataUpdate proposals to PublicGroup (extensions-draft feature). PublicGroup::process_message now returns a commit covering AppDataUpdate proposals as ProcessedMessageContent::UnresolvedAppDataCommit. Applications compute the updates with the new PublicGroup::app_data_dictionary_updater() and resume staging with the new PublicGroup::stage_app_data_commit(). This replaces PublicGroup::process_message_with_app_data_updates, which was removed. Also added MlsGroup::resolve_app_data_commit() and PublicGroup::resolve_app_data_commit(), which stage an UnresolvedAppDataCommit and return the same ProcessedMessage with regular StagedCommitMessage content, so callers can keep a single code path for commits with and without AppDataUpdate proposals. Made StagedCommit::safe_export_secret() public so secrets of the new epoch can be exported from resolved commits before merging.

0.8.1 (2026-02-13)

Added

• #1955: Expose functions that allow access to (blank) leaves and parent nodes

Changed

• #1964: update libcrux and rust_crypto provider dependencies, due to GHSA-435g-fcv3-8j26 and GHSA-g433-pq76-6cmf

0.8.0 (2026-02-04)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)