chore(deps): bump the fuzz-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the fuzz-minor-patch group with 3 updates in the /fuzz directory: aws-lc-rs, encoding_rs and indexmap.

Updates aws-lc-rs from 1.18.0 to 1.18.1

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.1

What's Changed

• Add ECDSA P-256 SHA-1 ASN.1 signature verification by @​assafvayner in aws/aws-lc-rs#1214
  • Adds ECDSA_P256_SHA1_ASN1 for verifying ASN.1 DER-encoded ECDSA P-256 signatures over SHA-1, so applications can verify legacy signatures such as CloudFront signed URLs using ECDSA P-256 with the default SHA-1 hash.
  • SHA-1 remains available for legacy verification only. This release does not add a corresponding signing algorithm.
• Tighten AEAD, cipher IV, HKDF, ECDH, and RSA API contracts by @​justsmth in aws/aws-lc-rs#1215
  • In-place AEAD sealing now verifies that Extend produced exactly enough space for the plaintext and authentication tag before passing the buffer to AWS-LC. Non-conforming custom buffers now return Err(Unspecified).
  • Streaming cipher constructors now reject missing or mismatched IV contexts, matching the validation already performed by the one-shot APIs.
  • Salt::from(Okm) now uses the output algorithm selected by the Okm, rather than the algorithm from the source PRK.
  • ECDH shared-secret storage is now zeroized on fallible derive paths.
  • RSA verify_digest_sig now requires the supplied digest to match the digest configured by RsaParameters, for both parsed and unparsed public keys.
  • Valid inputs are unaffected. Calls using inconsistent algorithms, IV contexts, or custom AEAD buffers now fail closed with Err(Unspecified).

Upstream AWS-LC

• aws-lc-sys v0.45.0 aligns with AWS-LC v5.7.0 (previously v5.5.0). See also the release notes for v5.6.0.
  • v5.7.0 corrects EVP_DecryptUpdate for padded block ciphers so it modifies only the output range reported through out_len. aws-lc-rs now includes canary-based regression coverage around the documented minimum output-buffer sizes.
• aws-lc-fips-sys v0.14.2 moves to AWS-LC FIPS v4.2.0.
  • Includes the equivalent EVP_DecryptUpdate correction for FIPS builds.
  • Restores FIPS builds with Clang 20 and newer.
  • Removes the FIPS compiler wrapper's dependency on /usr/bin/env, fixing builds in Nix and similar sandboxed environments.

Build Improvements

• Export cargo:root metadata when linking against a system-installed AWS-LC by @​weihanglo in aws/aws-lc-rs#1208
  • The system-library path now exposes the installation prefix through DEP_AWS_LC_*_ROOT, consistently with the CC and CMake builders, so downstream build scripts can rely on the metadata regardless of how AWS-LC was built.
• Fix -Wa,--debug-prefix-map handling with Clang and LTO by @​justsmth in aws/aws-lc-rs#1212
  • Fixes Clang builds when CFLAGS contains -flto or -flto=thin. The assembler-specific flag is now used only with GCC; Clang's integrated assembler uses -ffile-prefix-map directly.
• Filter raw target-triple CFLAGS spellings when compiling jitterentropy by @​justsmth in aws/aws-lc-rs#1207
  • Prevents inherited optimization flags from overriding jitterentropy's required -O0, including when environment variables are set by a parent process using raw or legacy-normalized target triples.

Issues Being Closed

• aws-lc-fips-sys v0.14.0 fails to build with Clang newer than 19 -- aws/aws-lc-rs#1202
• FIPS compiler wrapper fails in Nix build environments -- aws/aws-lc-rs#1204
• Raw target-triple CFLAGS should be filtered for jitterentropy -- aws/aws-lc-rs#1205
• aws-lc-sys fails to build with Clang when CFLAGS includes -flto -- aws/aws-lc-rs#1211

Other Merged PRs

• Prepare aws-lc-fips-sys v0.14.1 by @​justsmth in aws/aws-lc-rs#1203
• fix(publish): verify packaged crate with cargo build instead of cargo test by @​justsmth in aws/aws-lc-rs#1201
• fix: address clippy::assert_is_empty lints in ECB cipher modes by @​justsmth in aws/aws-lc-rs#1210
• ci: replace removed llvm-devel-lite package in FreeBSD jobs by @​justsmth in aws/aws-lc-rs#1213
• Prepare aws-lc-sys v0.45.0 by @​justsmth in aws/aws-lc-rs#1220
• Prepare aws-lc-fips-sys v0.14.2 by @​justsmth in aws/aws-lc-rs#1221
• Prepare v1.18.1 by @​justsmth in aws/aws-lc-rs#1224

... (truncated)

Commits

• 22e629d Prepare v1.18.1 (#1224)
• c4fde5c Prepare aws-lc-fips-sys v0.14.2 (#1221)
• 7943223 Prepare aws-lc-sys v0.45.0 (#1220)
• 8ea2229 fix: tighten AEAD, cipher IV, and digest API contracts (#1215)
• bcca4d1 Add ECDSA P-256 SHA-1 ASN.1 verification algorithm (#1214)
• 32338a5 fix(builder): filter the raw-triple CFLAGS spelling for jitterentropy (#1207)
• af422bd Fix -Wa,--debug-prefix-map probe (#1212)
• 749b26f ci: replace removed llvm-devel-lite package in FreeBSD jobs (#1213)
• 36c7a68 fix(publish): verify packaged crate with cargo build, not cargo test (#1201)
• c71ab00 fix: address clippy::assert_is_empty lints in ECB cipher modes (#1210)
• Additional commits viewable in compare view

Updates encoding_rs from 0.8.35 to 0.8.40

Commits

• 662cb42 Allow split_u16_stride_mut as dead code
• 55f2530 Increment version number to 0.8.40
• 71ae1c0 Mention defense in depth when writing to &mut str
• 12790ab Remove remarks about a standard library bug that has been worked around
• d477c2a Inline asm not stable on powerpc/powerpc64 at MSRV
• 6c2fb49 Work around slow _mm_packus_epi16 in Rust 1.96 through 1.98, inclusive
• 9451175 Zero the output slice upon panic in functions that write to &mut str
• 4cdc020 Anticipate complaints about the dependencies in the README
• debb436 Add thanks to the related release notes
• 5b05f10 Mention rust-lang/stdarch#2208 in the README
• Additional commits viewable in compare view

Updates indexmap from 2.14.0 to 2.14.2

Changelog

Sourced from indexmap's changelog.

2.14.2 (2026-09-04)

• Fix item hygiene in map and set macros. Previously, an internal const CAP could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and indexset_with_default!. The hasher may also be omitted if it's inferrable.

2.14.1 (2026-08-28)

• Simplify comparisons where Equivalent isn't needed (Q = K).
• Unify index assertions for bounds checks.
• Fix (or expect) clippy lints.

Commits

• 41a8708 Merge pull request #450 from cuviper/macros
• 0fb7b5c Release 2.14.2
• 55e6b28 Improve the empty macro cases
• c067355 Fix item hygiene in user macros
• fdf7e17 Merge pull request #449 from cuviper/release-2.14.1
• ada540e Release 2.14.1
• af93b43 expect clippy::redundant_slicing in tests
• c95da18 fix clippy::derivable_impls
• 2196365 fix clippy::useless_vec (and more) in tests
• 1c2be7b use inherent usize::MAX
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions