v0.15.4

This is a minor release with one security fix. It also updates rustls to 0.23.45.

Security

This update addresses GHSA-2mjx-qc3c-rqvc, a security issue affecting TLS 1.3 handshake message processing that could allow a broken peer to send plaintext handshake messages where an encrypted one is expected without rustls rejecting the connection.

Added

• ML-DSA certificate signature support when using the aws-lc-rs cryptography provider, inherited from the upstream rustls 0.23.44 release. This includes ML-DSA-44, ML-DSA-65, and ML-DSA-87, and is independent of the prefer-post-quantum feature that controls X25519MLKEM768 key-exchange priority.
• RFC 9149 support
  • rustls_client_config_builder_set_send_ticket_request() populates ClientConfig::send_ticket_request, offering the extension with the given new-session and resumption ticket counts. The default remains to not send the extension.
  • rustls_server_config_builder_set_max_tls13_tickets() populates ServerConfig::max_tls13_tickets, the cap applied to client ticket requests. The default remains 0 (requests ignored).
• Added rustls_server_config_builder_set_send_tls13_tickets() to allow setting the number of TLS 1.3 NewSessionTickets sent after a full handshake.
• New Linux arm64 packaging in GitHub release artifacts.

What's Changed

• Update dependencies by @djc in #640
• Take semver-compatible dependency updates by @djc in #649
• librustls: switch common.c's read_file to binary mode by @cpu in #650
• server: add rustls_server_config_builder_set_send_tls13_tickets by @mattrobenolt in #653
• Rustls 0.23.42, RFC 9149 API, check ALPN fix, and cbindgen update by @cpu in #655
• 0.15.4 prep: linux arm64 packaging, rustls 0.23.45 by @cpu in #682

Full Changelog: v0.15.3...v0.15.4