jsonwebtoken currently specifies aws-lc-rs ^1.15.0 as an optional dependency for the aws_lc_rs feature. This allows Cargo to resolve versions of aws-lc-rs that depend on aws-lc-sys < 0.38.0, which is affected by CVEs disclosed on 2026-03-02:
Bumping the minimum version of aws_lc_rs ensures that fresh resolves will pick up the patched aws-lc-sys >= 0.38.0
jsonwebtoken currently specifies
aws-lc-rs ^1.15.0as an optional dependency for theaws_lc_rsfeature. This allows Cargo to resolve versions ofaws-lc-rsthat depend onaws-lc-sys < 0.38.0, which is affected by CVEs disclosed on 2026-03-02:PKCS7_verifycertificate chain validation bypassPKCS7_verifysignature validation bypassBumping the minimum version of aws_lc_rs ensures that fresh resolves will pick up the patched
aws-lc-sys >= 0.38.0