s2n 1.6.4

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

Weekly release for Jan 5, 2026
Release Summary:

Enables certificate intent validation by default. This also adds a config API s2n_config_disable_x509_intent_verification() to disable it if necessary
Fixed an issue where selected_key_exchange_group for a resumed TLS 1.2 connection would incorrectly report secp256r1.

What's Changed

build(deps): bump ytanikin/pr-conventional-commits from 1.4.2 to 1.5.1 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in build(deps): bump ytanikin/pr-conventional-commits from 1.4.2 to 1.5.1 in /.github/workflows in the all-gha-updates group aws/s2n-tls#5656
ci: add typo check to ci by @brimonk in ci: add typo check to ci aws/s2n-tls#5491
Import Cloudfront PQ TLS Policies by @alexw91 in Import Cloudfront PQ TLS Policies aws/s2n-tls#5539
feat(build): Improve OpenSSL libcrypto discovery by @goatgoose in feat(build): Improve OpenSSL libcrypto discovery aws/s2n-tls#5572
test: update CRL certs to comply with intent validation by @CarolYeh910 in test: update CRL certs to comply with intent validation aws/s2n-tls#5651
(chore): Rust bindings bump 0.3.32 by @maddeleine in (chore): Rust bindings bump 0.3.32 aws/s2n-tls#5662
ci: update clang format version by @CarolYeh910 in ci: update clang format version aws/s2n-tls#5661
(chore): Revert "feat(build): Improve OpenSSL libcrypto discovery (#5572)" by @maddeleine in (chore): Revert "feat(build): Improve OpenSSL libcrypto discovery (#5572)" aws/s2n-tls#5664
feat: verify certificate issuer intent by default by @CarolYeh910 in feat: verify certificate issuer intent by default aws/s2n-tls#5657
chore: Fix increase in Rust unit test timings by @maddeleine in chore: Fix increase in Rust unit test timings aws/s2n-tls#5677
feat: add handshake event by @jmayclin in feat: add handshake event aws/s2n-tls#5635
test(integration): add async cert verify and offload 'stress' test by @kaukabrizvi in test(integration): add async cert verify and offload 'stress' test aws/s2n-tls#5653
test(integration): refactor PQ tests to utilize in-memory harness by @kaukabrizvi in test(integration): refactor PQ tests to utilize in-memory harness aws/s2n-tls#5667
build(deps): bump the all-gha-updates group across 1 directory with 4 updates by @dependabot[bot] in build(deps): bump the all-gha-updates group across 1 directory with 4 updates aws/s2n-tls#5675
build(deps): bump cross-platform-actions/action from 0.31.0 to 0.32.0 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in build(deps): bump cross-platform-actions/action from 0.31.0 to 0.32.0 in /.github/workflows in the all-gha-updates group aws/s2n-tls#5685
Fix: print diagnostics to stdout in s2n_resume_test by @ravindran-dev in Fix: print diagnostics to stdout in s2n_resume_test aws/s2n-tls#5660
Fix: Unpin the rust nightly toolchain version by @VIM4L-M in Fix: Unpin the rust nightly toolchain version aws/s2n-tls#5682
fix: incorrect group reported for TLS 1.2 session resumption by @jmayclin in fix: incorrect group reported for TLS 1.2 session resumption aws/s2n-tls#5673
test: confirm errors for no matching parameters by @jmayclin in test: confirm errors for no matching parameters aws/s2n-tls#5679
test(integration): add rust test for prefer low latency by @kaukabrizvi in test(integration): add rust test for prefer low latency aws/s2n-tls#5684
test(integration): add BoringSSL cohort to expand mTLS coverage by @kaukabrizvi in test(integration): add BoringSSL cohort to expand mTLS coverage aws/s2n-tls#5659
Fix unit test build errors under -Werror by @thulasiramk-2310 in Fix unit test build errors under -Werror aws/s2n-tls#5686

New Contributors

@brimonk made their first contribution in ci: add typo check to ci aws/s2n-tls#5491
@ravindran-dev made their first contribution in Fix: print diagnostics to stdout in s2n_resume_test aws/s2n-tls#5660
@VIM4L-M made their first contribution in Fix: Unpin the rust nightly toolchain version aws/s2n-tls#5682
@thulasiramk-2310 made their first contribution in Fix unit test build errors under -Werror aws/s2n-tls#5686

Full Changelog: aws/s2n-tls@v1.6.3...v1.6.4

View the full release notes at https://github.com/aws/s2n-tls/releases/tag/v1.6.4.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.