[dependabot]

Bumps openmls from 0.8.1 to 0.9.1.

Release notes

Sourced from openmls's releases.

v0.9.0

0.9.0 (2026-08-03)

Highlights

• Storage. Non-self describing storage formats are officially not supported anymore in OpenMLS starting with this release.
• Storage migration helper. A new opt-in migration-import feature lets applications move existing group state to a storage provider using a different serde codec (e.g. bincode -> CBOR), via new import entry points on MlsGroup and PublicGroup. See Migrating from a previous version.
• Targeted messages. Initial support for targeted messages, behind the new targeted-messages-draft feature flag.
• Reworked AppDataUpdate processing. Both MlsGroup and PublicGroup now return commits carrying AppDataUpdate proposals as ProcessedMessageContent::UnresolvedAppDataCommit, replacing the previous unprotect_message/process_unverified_message_with_app_data_updates flow that exposed unverified content.
• MSRV raised to Rust 1.91.

Added

• #1972: APIs for time-based deletion of past epoch secrets, and for setting the past epoch deletion policy for an MlsGroup.
• #2010: MlsGroup::propose_self_update_with_new_signer.
• #2084: ProcessedMessageContent::OwnPendingCommit variant.
• #2109: Capabilities::for_provider, plus dedicated UnsupportedCiphersuite errors returned early when a provider doesn't support a requested ciphersuite.
• #2099: ProcessedMessageContent::OwnPrivateMessage variant for processing echoed-back own messages.
• #2128: Storage-format migration helper (migration-import feature).
• #2028: Targeted messages (targeted-messages-draft feature).
• #2046, #2118: P-384, ML-DSA and additional PQ ciphersuites.
• #2037: Safe AAD capabilities from the extensions draft.
• #2045: Unchecked constructors to bypass KeyPackage/LeafNode validation for already-verified input.
• #2095: AppDataUpdate proposals allowed in external commits; group-context getter on VerifiableGroupInfo.
• #1979: Application data dictionary extension in key packages.
• #2113: VcKeyPackageBatchBuilder for virtual clients (experimental).

Changed

• #2109: Group/key-package creation, welcome processing, external commits and PublicGroup creation now fail early with UnsupportedCiphersuite instead of failing deep in a crypto operation.
• #1980: Enriched lifetime-related leaf node validation errors.
• #1972: MlsGroup::max_past_epochs() now returns Option<usize>.
• #1963: MessageEncryptionError is now public (behind virtual-clients-draft).
• #2043: Renamed and deprecated MlsGroup::propose_external_psk to propose_pre_shared_key (and the _by_value variant).
• #2084: Renamed StageCommitError::OwnCommit to OwnCommitMismatch.
• #2099: Removed ValidationError::CannotDecryptOwnMessage — processing an own PrivateMessage is no longer an error.
• #2060: Renamed the extensions-draft-08 feature flag to extensions-draft (across the openmls, openmls_sqlite_storage and openmls_sqlx_storage crates).
• #2092, #2098, #2099: Reworked the AppDataUpdate receive-side API on MlsGroup and PublicGroup (see Highlights above).
• #2083: Raised MSRV to Rust 1.91.

Fixed

• #2186: Fix wrong computation of tree node indexes when provided invalid inputs.
• #2134: Known structured extension payloads now reject trailing bytes during decoding.
• #2109: OpenMlsRustCrypto's supports() now agrees with supported_ciphersuites() for MLS_256_MLKEM1024_AES256GCM_SHA512_MLDSA87.
• #2089: A Commit without an UpdatePath from this client's own leaf that doesn't match the pending commit is now staged normally instead of rejected.
• #2034: Fixed incorrect storage-format deserialization caused by changed integer storage tags; storage-format compatibility with openmls v0.7.1 and earlier is restored by default (0-8-1-storage-format feature keeps v0.8.1 compatibility).
• #2125: A bare GroupContextExtensions proposal could bypass the AppDataUpdate immutability check on the app_data_dictionary extension.
• #2051: Backward-incompatible deserialization of PastEpochDeletionPolicy.

... (truncated)

Changelog

Sourced from openmls's changelog.

0.9.1 (2026-10-07)

Fixed

• GHSA-gc79-23g3-8g52: Unbounded recursion while decoding invalid nested extensions can abort the process
• When checking whether an extension type is valid in the given context, always treat GREASE values like unknown extensions.

0.9.0 (2026-08-25)

Added

• #1972: Add APIs for time-based deletion of past epoch secrets, and for setting the past epoch deletion policy for an MlsGroup.
• #2010: Added MlsGroup::propose_self_update_with_new_signer, a variant of propose_self_update that stages an Update proposal carrying a new signature key.
• #2084: Added the ProcessedMessageContent::OwnPendingCommit variant, returned when processing a Commit authored by this client that matches the group's pending commit. Callers should merge the pending commit via MlsGroup::merge_pending_commit().
• #2109: Added Capabilities::for_provider, a constructor that advertises exactly the ciphersuites supported by the given crypto provider (as reported by OpenMlsCrypto::supported_ciphersuites), instead of the hardcoded default list.
• Added UnsupportedCiphersuite(Ciphersuite) variants to NewGroupError, KeyPackageNewError, WelcomeError, and CreationFromExternalError, returned when the crypto provider does not support the requested ciphersuite.
• #2148: Added fuzz targets that exercise the DeserializeBytes byte-slice decode path for MlsMessageIn, KeyPackageIn, Welcome, ProposalIn, and Extension, and run them in the fuzz CI workflow.
• #2099: Added ProcessedMessageContent::OwnPrivateMessage variant. Processing a PrivateMessage authored by this client (e.g. echoed back by the delivery service) now succeeds and returns this variant instead of failing. The content cannot be decrypted and the sender claim is unauthenticated; applications should use it only to skip/ignore the echoed message and must not act on it further. With the virtual-clients-draft feature, own messages whose secrets are still retained (e.g. unconfirmed sends) keep decrypting normally; the variant is returned in groups that do not use virtual clients when decryption of an own message fails.
• #2128: Added an opt-in migration-import feature that lets applications move existing group state to a storage provider using a different serde codec (e.g. bincode -> CBOR). MlsGroup and PublicGroup gain import entry points that re-read state with the old codec and fully overwrite it in the new provider, with the intermediate buffer zeroized. See the new "Migrating from a previous version" book chapter.
• #2028: Added support for targeted messages, behind the new targeted-messages-draft feature flag.
• #2046, #2118: Added P-384, ML-DSA and additional PQ ciphersuites (including the draft-ietf-mls-pq-ciphersuites draft v5 code points), behind the draft-ietf-mls-pq-ciphersuites feature flag.
• #2037: Implemented Safe AAD capabilities as defined in the MLS extensions draft.
• #2045: Added unchecked constructors to bypass KeyPackage/LeafNode validation, for callers that have already verified the input through another path.
• #2095: AppDataUpdate proposals are now allowed in external commits (extensions-draft feature). Also added a getter for the group context on VerifiableGroupInfo.
• #1979: Key packages can now carry an application data dictionary extension (extensions-draft feature).
• #2113: Added VcKeyPackageBatchBuilder to build heterogeneous batches of key packages (virtual-clients-draft feature, experimental).

Fixed

• #2186: Two treemath helpers computed node indexes without checking their inputs, so a commit from a sender outside the tree could be accepted. Both now reject out-of-range input.
• #2143: A commit built with CommitBuilder::build_with_new_signer (or MlsGroup::self_update_with_new_signer) now signs the GroupInfo in the Welcome and the exported GroupInfo with the new signer, matching the signature key the commit puts in the committer's leaf. Previously both were signed with the old signer, so invited members rejected the Welcome with InvalidGroupInfoSignature.
• #2147: Fixed an off-by-one in the computation of the variable-length prefix size during extension serialization. Extensions with payloads of exactly 0x3fff or 0x3fff_ffff bytes now serialize with the correct length prefix.
• GHSA-rrmv-c79f-cf5r: Fix out-of-bounds panic in manual DeserializeBytes impls
• #2134: Known structured extension payloads now reject trailing bytes during decoding instead of silently ignoring them.
• #2109: OpenMlsRustCrypto's OpenMlsCrypto::supports now accepts MLS_256_MLKEM1024_AES256GCM_SHA512_MLDSA87, consistent with its supported_ciphersuites list (draft-ietf-mls-pq-ciphersuites feature).
• #2089: A Commit without an UpdatePath from this client's own leaf that does not match the pending commit is now staged as a regular commit instead of being rejected as a mismatched own commit.
• #2034: Fixes a bug where the integer storage tags for serde non-self-describing serializations were changed, leading to incorrect deserializations. By default, storage format compatibility with openmls v0.7.1 and earlier is now restored. Enabling the 0-8-1-storage-format feature maintains storage format compatibility with openmls v0.8.1 (the previous openmls release).
• #2125: A bare GroupContextExtensions proposal could rewrite the app_data_dictionary extension directly, bypassing the AppDataUpdate proposal machinery required by the extensions draft. The immutability check now applies to every commit carrying a GroupContextExtensions proposal.
• #2051: Fixed a backward-incompatible deserialization of PastEpochDeletionPolicy.

Changed

• #2174: Duplicate and membership checks on extensions, capabilities and key packages now use hash sets instead of nested scans, and unmerged leaf lookups use binary search. This cuts the cost of validating large groups and key packages. No API change.
• #2149: CommitBuilder::build_with_new_signer now always generates an UpdatePath, so the new signature key is installed in the committer's leaf even when no proposal requires a path. Previously, a new signer passed to an otherwise pathless commit was silently ignored. It also rejects a new signer whose signature scheme does not match the group's ciphersuite with CreateCommitError::InvalidSignerCiphersuite.
• #2149: External commits now have a single authoritative credential: the CredentialWithKey passed to ExternalCommitBuilder::build_group. Leaf node parameters that pin a different credential are rejected with the new CreateCommitError::ExternalCommitCredentialMismatch, and build_with_new_signer on an external commit fails with the new CreateCommitError::ExternalCommitWithNewSigner.
• #2146: The Debug output of HpkePrivateKey and ExporterSecret no longer contains the secret bytes. The crypto-debug feature now also enables the corresponding feature in openmls_traits, restoring the full output for debugging.
• #2109: Group creation, key package creation, welcome processing, external commits, and PublicGroup creation from external input now fail early with a dedicated UnsupportedCiphersuite error when the crypto provider does not support the ciphersuite, instead of failing deep inside a crypto operation.
• #2109: ExternalCommitError::UnsupportedCiphersuite and ExternalCommitBuilderError::UnsupportedCiphersuite now carry the unsupported Ciphersuite.
• #1980: Enrich limetime related errors returned during leaf node validation with more information
• #1972: The method MlsGroup::max_past_epochs() now returns an Option<usize>, rather than a usize

... (truncated)

Commits

• 1762090 bump rand dep
• 157ce3a Merge commit from fork
• bdaef52 run CI for v0.9 branch (#2258)
• 3a3e35d prepare v0.9.0 release
• 730b3be bump to -rc.4 for openmls v0.9.0
• e7c2437 Fix minor treemath issues (#2186)
• 80b2163 bump to -rc.3 for openmls v0.9.0
• 0bcaf03 perf: various reductions of computational complexity (#2174)
• 831ea9e bump to -rc.2 for openmls v0.9.0
• c3ab778 chore: commit builder hardening (#2149)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.