git: 3ca89828df98 - main - security/kanidm: Update version 1.6.3=>1.7.3

From: Muhammad Moinur Rahman <bofh_at_FreeBSD.org>
Date: Thu, 28 Aug 2025 10:36:56 UTC
The branch main has been updated by bofh:

URL: https://cgit.FreeBSD.org/ports/commit/?id=3ca89828df982affe1eb01a4488df3b1de2ca2e4

commit 3ca89828df982affe1eb01a4488df3b1de2ca2e4
Author:     William Brown <william@blackhats.net.au>
AuthorDate: 2025-08-28 10:33:59 +0000
Commit:     Muhammad Moinur Rahman <bofh@FreeBSD.org>
CommitDate: 2025-08-28 10:35:55 +0000

    security/kanidm: Update version 1.6.3=>1.7.3
    
    Changelog: https://github.com/kanidm/kanidm/releases/tag/v1.7.3
    Event: Oslo Hackathon 202508
---
 GIDs                                        |   2 +-
 UIDs                                        |   4 +-
 security/kanidm/Makefile                    |  60 ++-
 security/kanidm/Makefile.crates             | 354 ++++++++------
 security/kanidm/distinfo                    | 714 +++++++++++++++++-----------
 security/kanidm/files/kanidm_unixd.in       |   8 +-
 security/kanidm/files/kanidm_unixd_tasks.in |   6 +-
 security/kanidm/files/kanidmd.in            |  27 ++
 security/kanidm/pkg-plist.client            |   6 +
 security/kanidm/pkg-plist.server            |   8 +-
 10 files changed, 726 insertions(+), 463 deletions(-)

diff --git a/GIDs b/GIDs
index c3e5ad8ea7e7..d3ed7124e989 100644
--- a/GIDs
+++ b/GIDs
@@ -798,7 +798,7 @@ _geodns:*:853:
 ebusd:*:854:
 opensearch:*:855:
 # free: 856
-# free: 857
+kanidmd:*:857:
 umurmur:*:858:
 kanidm:*:859:
 plocate:*:860:
diff --git a/UIDs b/UIDs
index bd0fed681bce..899042c0c23a 100644
--- a/UIDs
+++ b/UIDs
@@ -804,9 +804,9 @@ _geodns:*:853:853::0:0:GeoDNS User:/var/empty:/usr/sbin/nologin
 ebusd:*:854:854::0:0:eBUS Daemon user:/nonexistent:/usr/sbin/nologin
 opensearch:*:855:855::0:0:opensearch user:/nonexistent:/usr/sbin/nologin
 # free: 856
-# free: 857
+kanidmd:*:857:857::0:0:Kanidmd server:/nonexistent:/usr/sbin/nologin
 umurmur:*:858:858::0:0:uMurmur:/nonexistent:/usr/sbin/nologin
-kanidm:*:859:859::0:0:Kanidm user:/nonexistent:/usr/sbin/nologin
+kanidm:*:859:859::0:0:Kanidm client resolver:/nonexistent:/usr/sbin/nologin
 # free: 860
 rekor:*:861:861::0:0:rekor user:/nonexistent:/usr/sbin/nologin
 timestamp-authority:*:862:862::0:0:Timestamp Authority:/nonexistent:/usr/sbin/nologin
diff --git a/security/kanidm/Makefile b/security/kanidm/Makefile
index 776a57bba5e0..d26139ca5e75 100644
--- a/security/kanidm/Makefile
+++ b/security/kanidm/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	kanidm
 DISTVERSIONPREFIX=	v
-DISTVERSION=	1.6.3
+DISTVERSION=	1.7.3
 CATEGORIES=	security net
 
 MAINTAINER=	bofh@FreeBSD.org
@@ -23,21 +23,45 @@ server_PKGNAMESUFFIX=	-server
 server_COMMENT=		(server only)
 server_PLIST=	${.CURDIR}/pkg-plist.server
 
-USES=		cargo ssl
+USES=		cargo ssl llvm
 USE_GITHUB=	yes
+
+MAKE_ENV=    LIBCLANG_PATH=${LLVM_PREFIX}/lib
+
 .if ${FLAVOR} == server
-USE_RC_SUBR=	kanidm_unixd kanidm_unixd_tasks
+CARGO_BUILD_ARGS=	-p daemon
+USE_RC_SUBR=	kanidmd
 .endif
 
 .if ${FLAVOR} == client
 CARGO_BUILD_ARGS=	-p kanidm_tools -p kanidm_unix_int -p nss_kanidm -p pam_kanidm
+USE_RC_SUBR=	kanidm_unixd kanidm_unixd_tasks
 .endif
+
 CARGO_INSTALL=	no
 CARGO_ENV=	KANIDM_BUILD_PROFILE=release_freebsd
 
-CACHEDIR=/var/cache/kanidm-unixd
-LIBDIR=/var/lib/kanidm-unixd
-RUNDIR=/var/run/kanidm-unixd
+CLIENT_CACHEDIR=/var/cache/kanidm-unixd
+CLIENT_LIBDIR=/var/lib/kanidm-unixd
+CLIENT_RUNDIR=/var/run/kanidm-unixd
+
+SERVER_LIBDIR=/var/lib/kanidmd
+SERVER_RUNDIR=/var/run/kanidmd
+
+.if ${FLAVOR} == server
+USERS=		kanidmd
+GROUPS=		kanidmd
+
+SUB_LIST=	USER=${USERS} \
+		GROUP=${GROUPS} \
+		ETCDIR=${PREFIX}/etc/kanidm \
+		RUNDIR=/var/run/kanidmd \
+		LIBDIR=/var/lib/kanidmd
+.endif
+
+.if ${FLAVOR} == client
+USERS=		kanidm
+GROUPS=		kanidm
 
 SUB_LIST=	USER=${USERS} \
 		GROUP=${GROUPS} \
@@ -45,26 +69,30 @@ SUB_LIST=	USER=${USERS} \
 		RUNDIR=/var/run/kanidm-unixd \
 		CACHEDIR=/var/cache/kanidm-unixd \
 		LIBDIR=/var/lib/kanidm-unixd
-
-USERS=		${PORTNAME}
-GROUPS=		${PORTNAME}
+.endif
 
 do-install:
+.if ${FLAVOR} == server
+	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidmd ${STAGEDIR}${PREFIX}/libexec
 	${MKDIR} ${STAGEDIR}${ETCDIR}
+	${MKDIR} ${STAGEDIR}${SERVER_LIBDIR}
+	${MKDIR} ${STAGEDIR}${SERVER_RUNDIR}
+.endif
+
 .if ${FLAVOR} == client
+	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm-unix ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm_ssh_authorizedkeys ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm_ssh_authorizedkeys_direct ${STAGEDIR}${PREFIX}/bin
-	${INSTALL_LIB} ${WRKDIR}/target/release/libnss_kanidm.so ${STAGEDIR}${PREFIX}/lib/nss_kanidm.so.1
-	${INSTALL_LIB} ${WRKDIR}/target/release/libpam_kanidm.so ${STAGEDIR}${PREFIX}/lib
-.endif
-.if ${FLAVOR} == server
 	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm_unixd ${STAGEDIR}${PREFIX}/libexec
 	${INSTALL_PROGRAM} ${WRKDIR}/target/release/kanidm_unixd_tasks ${STAGEDIR}${PREFIX}/libexec
-	${MKDIR} ${STAGEDIR}${CACHEDIR}
-	${MKDIR} ${STAGEDIR}${LIBDIR}
-	${MKDIR} ${STAGEDIR}${RUNDIR}
+	${INSTALL_LIB} ${WRKDIR}/target/release/libnss_kanidm.so ${STAGEDIR}${PREFIX}/lib/nss_kanidm.so.1
+	${INSTALL_LIB} ${WRKDIR}/target/release/libpam_kanidm.so ${STAGEDIR}${PREFIX}/lib
+	${MKDIR} ${STAGEDIR}${ETCDIR}
+	${MKDIR} ${STAGEDIR}${CLIENT_CACHEDIR}
+	${MKDIR} ${STAGEDIR}${CLIENT_LIBDIR}
+	${MKDIR} ${STAGEDIR}${CLIENT_RUNDIR}
 .endif
 
 .include <bsd.port.mk>
diff --git a/security/kanidm/Makefile.crates b/security/kanidm/Makefile.crates
index f49487d21325..451f9cc8e6c8 100644
--- a/security/kanidm/Makefile.crates
+++ b/security/kanidm/Makefile.crates
@@ -1,15 +1,19 @@
 CARGO_CRATES=	addr2line-0.24.2 \
-		adler2-2.0.0 \
+		adler2-2.0.1 \
+		aead-0.5.2 \
+		aes-0.8.4 \
+		aes-gcm-0.10.3 \
+		aes-kw-0.2.1 \
 		ahash-0.8.12 \
 		aho-corasick-1.1.3 \
 		allocator-api2-0.2.21 \
 		android-tzdata-0.1.1 \
 		android_system_properties-0.1.5 \
-		anstream-0.6.18 \
-		anstyle-1.0.10 \
-		anstyle-parse-0.2.6 \
-		anstyle-query-1.1.2 \
-		anstyle-wincon-3.0.7 \
+		anstream-0.6.20 \
+		anstyle-1.0.11 \
+		anstyle-parse-0.2.7 \
+		anstyle-query-1.1.4 \
+		anstyle-wincon-3.0.10 \
 		anyhow-1.0.98 \
 		arc-swap-1.7.1 \
 		argon2-0.5.3 \
@@ -21,71 +25,82 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		asn1-rs-0.6.2 \
 		asn1-rs-derive-0.5.1 \
 		asn1-rs-impl-0.2.0 \
-		async-compression-0.4.23 \
+		async-compression-0.4.27 \
 		async-stream-0.3.6 \
 		async-stream-impl-0.3.6 \
 		async-trait-0.1.88 \
 		atomic-waker-1.1.2 \
 		authenticator-0.4.1 \
-		autocfg-1.4.0 \
+		autocfg-1.5.0 \
+		aws-lc-rs-1.13.3 \
+		aws-lc-sys-0.30.0 \
 		axum-0.7.9 \
 		axum-core-0.4.5 \
 		axum-extra-0.9.6 \
 		axum-htmx-0.5.0 \
 		axum-macros-0.4.2 \
 		backtrace-0.3.75 \
+		base16ct-0.2.0 \
 		base32-0.5.1 \
 		base64-0.13.1 \
 		base64-0.21.7 \
 		base64-0.22.1 \
-		base64ct-1.7.3 \
-		base64urlsafedata-0.5.1 \
+		base64ct-1.8.0 \
+		base64urlsafedata-0.5.2 \
 		basic-toml-0.1.10 \
 		bindgen-0.66.1 \
-		bindgen-0.71.1 \
+		bindgen-0.69.5 \
+		bindgen-0.72.0 \
 		bit-set-0.5.3 \
 		bit-set-0.8.0 \
 		bit-vec-0.6.3 \
 		bit-vec-0.8.0 \
 		bitfield-0.13.2 \
 		bitflags-1.3.2 \
-		bitflags-2.9.0 \
+		bitflags-2.9.1 \
 		blake2-0.10.6 \
 		block-buffer-0.10.4 \
+		block-buffer-0.11.0-rc.4 \
+		block-padding-0.3.3 \
 		borrow-or-share-0.2.2 \
 		bstr-1.12.0 \
-		bumpalo-3.17.0 \
-		bytecount-0.6.8 \
-		bytemuck-1.23.0 \
+		bumpalo-3.19.0 \
+		bytecount-0.6.9 \
+		bytemuck-1.23.1 \
 		byteorder-1.5.0 \
 		byteorder-lite-0.1.0 \
 		bytes-1.10.1 \
-		cc-1.2.22 \
+		cbc-0.1.2 \
+		cc-1.2.31 \
 		cexpr-0.6.0 \
-		cfg-if-1.0.0 \
+		cfg-if-1.0.1 \
 		cfg_aliases-0.2.1 \
 		chrono-0.4.41 \
 		cidr-0.3.1 \
+		cipher-0.4.4 \
 		clang-sys-1.8.1 \
-		clap-4.5.38 \
-		clap_builder-4.5.38 \
-		clap_complete-4.5.50 \
-		clap_derive-4.5.32 \
-		clap_lex-0.7.4 \
+		clap-4.5.42 \
+		clap_builder-4.5.42 \
+		clap_complete-4.5.55 \
+		clap_derive-4.5.41 \
+		clap_lex-0.7.5 \
 		clru-0.6.2 \
+		cmake-0.1.54 \
 		color_quant-1.1.0 \
-		colorchoice-1.0.3 \
-		concread-0.5.5 \
+		colorchoice-1.0.4 \
+		compact_jwt-0.5.3-dev \
+		concread-0.5.7 \
 		console-0.15.11 \
 		const-oid-0.9.6 \
 		cookie-0.16.2 \
 		cookie-0.18.1 \
 		cookie_store-0.21.1 \
 		core-foundation-0.9.4 \
-		core-foundation-0.10.0 \
+		core-foundation-0.10.1 \
 		core-foundation-sys-0.8.7 \
+		core_maths-0.1.1 \
 		cpufeatures-0.2.17 \
-		crc32fast-1.4.2 \
+		crc32fast-1.5.0 \
 		cron-0.15.0 \
 		crossbeam-0.8.4 \
 		crossbeam-channel-0.5.15 \
@@ -93,9 +108,13 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		crossbeam-epoch-0.9.18 \
 		crossbeam-queue-0.3.12 \
 		crossbeam-utils-0.8.21 \
+		crypto-bigint-0.5.5 \
 		crypto-common-0.1.6 \
+		crypto-common-0.2.0-rc.3 \
+		crypto-glue-0.1.9 \
 		csv-1.3.1 \
 		csv-core-0.1.12 \
+		ctr-0.9.2 \
 		darling-0.20.11 \
 		darling_core-0.20.11 \
 		darling_macro-0.20.11 \
@@ -111,36 +130,40 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		dhat-0.3.3 \
 		dialoguer-0.11.0 \
 		digest-0.10.7 \
+		digest-0.11.0-rc.0 \
 		dirs-6.0.0 \
 		dirs-sys-0.5.0 \
 		displaydoc-0.2.5 \
 		document-features-0.2.11 \
 		dunce-1.0.5 \
-		dyn-clone-1.0.19 \
+		dyn-clone-1.0.20 \
+		ecdsa-0.16.9 \
 		either-1.15.0 \
+		elliptic-curve-0.13.8 \
 		email_address-0.2.9 \
 		encode_unicode-1.0.0 \
 		encoding_rs-0.8.35 \
 		enum-iterator-2.1.0 \
 		enum-iterator-derive-1.4.0 \
-		enumflags2-0.7.11 \
-		enumflags2_derive-0.7.11 \
+		enumflags2-0.7.12 \
+		enumflags2_derive-0.7.12 \
 		equivalent-1.0.2 \
-		errno-0.3.11 \
+		errno-0.3.13 \
 		escargot-0.5.14 \
 		fallible-iterator-0.3.0 \
 		fallible-streaming-iterator-0.1.9 \
 		fancy-regex-0.13.0 \
 		fancy-regex-0.14.0 \
-		fantoccini-0.21.5 \
+		fantoccini-0.22.0 \
 		faster-hex-0.9.0 \
 		faster-hex-0.10.0 \
 		fastrand-2.3.0 \
-		file-id-0.2.2 \
+		ff-0.13.1 \
+		file-id-0.2.3 \
 		filetime-0.2.25 \
 		fixedbitset-0.5.7 \
 		flagset-0.4.7 \
-		flate2-1.1.1 \
+		flate2-1.1.2 \
 		fluent-uri-0.3.2 \
 		fnv-1.0.7 \
 		foldhash-0.1.5 \
@@ -149,6 +172,7 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		form_urlencoded-1.2.1 \
 		fraction-0.15.3 \
 		fs4-0.13.1 \
+		fs_extra-1.3.0 \
 		fsevent-sys-4.1.0 \
 		futures-0.3.31 \
 		futures-channel-0.3.31 \
@@ -162,7 +186,8 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		generic-array-0.14.7 \
 		getrandom-0.2.16 \
 		getrandom-0.3.3 \
-		gif-0.13.1 \
+		ghash-0.5.1 \
+		gif-0.13.3 \
 		gimli-0.31.1 \
 		gix-0.71.0 \
 		gix-actor-0.34.0 \
@@ -187,7 +212,7 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		gix-odb-0.68.0 \
 		gix-pack-0.58.0 \
 		gix-packetline-0.18.4 \
-		gix-path-0.10.18 \
+		gix-path-0.10.20 \
 		gix-protocol-0.49.0 \
 		gix-quote-0.5.0 \
 		gix-ref-0.51.0 \
@@ -197,7 +222,7 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		gix-sec-0.10.12 \
 		gix-shallow-0.3.0 \
 		gix-tempfile-17.1.0 \
-		gix-trace-0.1.12 \
+		gix-trace-0.1.13 \
 		gix-transport-0.46.0 \
 		gix-traverse-0.45.0 \
 		gix-url-0.30.0 \
@@ -206,19 +231,23 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		gix-validate-0.9.4 \
 		gix-validate-0.10.0 \
 		glob-0.3.2 \
-		h2-0.3.26 \
-		h2-0.4.10 \
+		group-0.13.0 \
+		h2-0.3.27 \
+		h2-0.4.11 \
 		half-1.8.3 \
 		haproxy-protocol-0.0.1 \
 		hash32-0.3.1 \
 		hashbrown-0.12.3 \
 		hashbrown-0.14.5 \
-		hashbrown-0.15.3 \
+		hashbrown-0.15.4 \
 		hashlink-0.10.0 \
 		heapless-0.8.0 \
 		heck-0.5.0 \
-		hermit-abi-0.3.9 \
+		hermit-abi-0.5.2 \
 		hex-0.4.3 \
+		hkdf-0.12.4 \
+		hmac-0.12.1 \
+		hmac-0.13.0-rc.0 \
 		home-0.5.11 \
 		hostname-validator-1.1.1 \
 		http-0.2.12 \
@@ -230,65 +259,82 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		httparse-1.10.1 \
 		httpdate-1.0.3 \
 		humansize-2.1.3 \
+		hybrid-array-0.3.1 \
 		hyper-0.14.32 \
 		hyper-1.6.0 \
-		hyper-rustls-0.27.5 \
+		hyper-rustls-0.27.7 \
 		hyper-timeout-0.5.2 \
 		hyper-tls-0.6.0 \
-		hyper-util-0.1.11 \
+		hyper-util-0.1.16 \
 		iana-time-zone-0.1.63 \
 		iana-time-zone-haiku-0.1.2 \
+		icu_collections-1.5.0 \
 		icu_collections-2.0.0 \
 		icu_locale_core-2.0.0 \
+		icu_locid-1.5.0 \
 		icu_normalizer-2.0.0 \
 		icu_normalizer_data-2.0.0 \
-		icu_properties-2.0.0 \
-		icu_properties_data-2.0.0 \
+		icu_properties-2.0.1 \
+		icu_properties_data-2.0.1 \
+		icu_provider-1.5.0 \
 		icu_provider-2.0.0 \
+		icu_provider_macros-1.5.0 \
+		icu_segmenter-1.5.0 \
+		icu_segmenter_data-1.5.1 \
 		ident_case-1.0.1 \
 		idlset-0.2.5 \
 		idna-1.0.3 \
 		idna_adapter-1.2.1 \
 		image-0.25.6 \
-		image-webp-0.2.1 \
+		image-webp-0.2.3 \
 		indexmap-1.9.3 \
-		indexmap-2.9.0 \
-		inotify-0.11.0 \
+		indexmap-2.10.0 \
+		inotify-0.10.2 \
 		inotify-sys-0.1.5 \
+		inout-0.1.4 \
+		instant-0.1.13 \
+		io-uring-0.7.9 \
 		ipnet-2.11.0 \
+		iri-string-0.7.8 \
 		is_terminal_polyfill-1.70.1 \
+		itertools-0.12.1 \
 		itertools-0.13.0 \
 		itertools-0.14.0 \
 		itoa-1.0.15 \
-		jiff-0.2.13 \
-		jiff-static-0.2.13 \
+		jiff-0.2.15 \
+		jiff-static-0.2.15 \
 		jiff-tzdb-0.1.4 \
 		jiff-tzdb-platform-0.1.3 \
+		jobserver-0.1.33 \
 		js-sys-0.3.77 \
 		jsonschema-0.30.0 \
-		kanidm-hsm-crypto-0.2.0 \
+		kanidm-hsm-crypto-0.3.4 \
+		kbkdf-0.0.1 \
 		kqueue-1.1.1 \
 		kqueue-sys-1.0.4 \
-		lambert_w-1.2.19 \
+		lambert_w-1.2.24 \
 		lazy_static-1.5.0 \
 		lazycell-1.3.0 \
 		lber-0.4.2 \
 		ldap3_client-0.5.2 \
 		ldap3_proto-0.5.2 \
-		libc-0.2.172 \
-		libloading-0.8.7 \
+		libc-0.2.174 \
+		libloading-0.8.8 \
 		libm-0.2.15 \
-		libmimalloc-sys-0.1.42 \
-		libredox-0.1.3 \
+		libmimalloc-sys-0.1.43 \
+		libnss-0.9.0 \
+		libredox-0.1.9 \
 		libsqlite3-sys-0.33.0 \
 		libudev-0.2.0 \
 		libudev-sys-0.1.4 \
+		libz-rs-sys-0.5.1 \
 		linux-raw-sys-0.4.15 \
 		linux-raw-sys-0.9.4 \
+		litemap-0.7.5 \
 		litemap-0.8.0 \
-		litrs-0.4.1 \
-		lock_api-0.4.12 \
-		lodepng-3.11.0 \
+		litrs-0.4.2 \
+		lock_api-0.4.13 \
+		lodepng-3.12.1 \
 		log-0.4.27 \
 		lru-0.13.0 \
 		lru-0.14.0 \
@@ -301,39 +347,41 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		maybe-async-0.2.10 \
 		md-5-0.10.6 \
 		md4-0.10.2 \
-		memchr-2.7.4 \
-		memmap2-0.9.5 \
+		memchr-2.7.5 \
+		memmap2-0.9.7 \
 		memoffset-0.8.0 \
-		mimalloc-0.1.46 \
+		mimalloc-0.1.47 \
 		mime-0.3.17 \
 		mime_guess-2.0.5 \
 		minimal-lexical-0.2.1 \
-		miniz_oxide-0.8.8 \
+		miniz_oxide-0.8.9 \
 		mintex-0.1.4 \
-		mio-1.0.3 \
+		mio-1.0.4 \
 		multer-3.1.0 \
 		native-tls-0.2.14 \
 		nix-0.30.1 \
 		nom-7.1.3 \
 		nom-8.0.0 \
 		nonempty-0.11.0 \
-		notify-8.0.0 \
-		notify-debouncer-full-0.5.0 \
-		notify-types-2.0.0 \
+		notify-7.0.0 \
+		notify-debouncer-full-0.4.0 \
+		notify-types-1.0.1 \
 		nu-ansi-term-0.46.0 \
 		num-0.4.3 \
 		num-bigint-0.4.6 \
+		num-bigint-dig-0.8.4 \
 		num-cmp-0.1.0 \
 		num-complex-0.4.6 \
 		num-conv-0.1.0 \
 		num-derive-0.3.3 \
+		num-derive-0.4.2 \
 		num-integer-0.1.46 \
 		num-iter-0.1.45 \
 		num-rational-0.4.2 \
 		num-traits-0.2.19 \
-		num_cpus-1.16.0 \
-		num_enum-0.7.3 \
-		num_enum_derive-0.7.3 \
+		num_cpus-1.17.0 \
+		num_enum-0.7.4 \
+		num_enum_derive-0.7.4 \
 		num_threads-0.1.7 \
 		oauth2-4.4.2 \
 		oauth2-5.0.0 \
@@ -341,10 +389,12 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		oid-0.2.1 \
 		oid-registry-0.7.1 \
 		once_cell-1.21.3 \
-		openssl-0.10.72 \
+		once_cell_polyfill-1.70.1 \
+		opaque-debug-0.3.1 \
+		openssl-0.10.73 \
 		openssl-macros-0.1.1 \
 		openssl-probe-0.1.6 \
-		openssl-sys-0.9.108 \
+		openssl-sys-0.9.109 \
 		opentelemetry-0.27.1 \
 		opentelemetry-http-0.27.0 \
 		opentelemetry-otlp-0.27.0 \
@@ -354,17 +404,20 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		option-ext-0.2.0 \
 		outref-0.5.2 \
 		overload-0.1.1 \
-		parking_lot-0.12.3 \
-		parking_lot_core-0.9.10 \
+		p256-0.13.2 \
+		p384-0.13.1 \
+		parking_lot-0.12.4 \
+		parking_lot_core-0.9.11 \
 		password-hash-0.5.0 \
 		paste-1.0.15 \
+		pastey-0.1.0 \
 		peeking_take_while-0.1.2 \
 		peg-0.8.5 \
 		peg-macros-0.8.5 \
 		peg-runtime-0.8.5 \
 		pem-rfc7468-0.7.0 \
 		percent-encoding-2.3.1 \
-		petgraph-0.7.1 \
+		petgraph-0.8.2 \
 		picky-asn1-0.8.0 \
 		picky-asn1-der-0.4.1 \
 		picky-asn1-x509-0.12.0 \
@@ -372,14 +425,18 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		pin-project-internal-1.1.10 \
 		pin-project-lite-0.2.16 \
 		pin-utils-0.1.0 \
+		pkcs1-0.7.5 \
+		pkcs8-0.10.2 \
 		pkg-config-0.3.32 \
-		portable-atomic-1.11.0 \
+		polyval-0.6.2 \
+		portable-atomic-1.11.1 \
 		portable-atomic-util-0.2.4 \
 		potential_utf-0.1.2 \
 		powerfmt-0.2.0 \
 		ppv-lite86-0.2.21 \
 		prctl-1.0.0 \
-		prettyplease-0.2.32 \
+		prettyplease-0.2.36 \
+		primeorder-0.13.6 \
 		proc-macro-crate-3.3.0 \
 		proc-macro-error-1.0.4 \
 		proc-macro-error-attr-1.0.4 \
@@ -393,18 +450,18 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		quick-error-2.0.1 \
 		quinn-0.11.8 \
 		quinn-proto-0.11.12 \
-		quinn-udp-0.5.12 \
+		quinn-udp-0.5.13 \
 		quote-1.0.40 \
-		r-efi-5.2.0 \
+		r-efi-5.3.0 \
 		rand-0.8.5 \
-		rand-0.9.1 \
+		rand-0.9.2 \
 		rand_chacha-0.3.1 \
 		rand_chacha-0.9.0 \
 		rand_core-0.6.4 \
 		rand_core-0.9.3 \
 		rawpointer-0.2.1 \
-		redox_syscall-0.5.12 \
-		redox_users-0.5.0 \
+		redox_syscall-0.5.17 \
+		redox_users-0.5.2 \
 		ref-cast-1.0.24 \
 		ref-cast-impl-1.0.24 \
 		referencing-0.30.0 \
@@ -414,74 +471,82 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		regex-syntax-0.6.29 \
 		regex-syntax-0.8.5 \
 		reqwest-0.11.27 \
-		reqwest-0.12.15 \
-		rgb-0.8.50 \
+		reqwest-0.12.22 \
+		rfc6979-0.4.0 \
+		rgb-0.8.52 \
 		ring-0.17.14 \
 		rpassword-5.0.1 \
+		rsa-0.9.8 \
 		runloop-0.1.0 \
 		rusqlite-0.35.0 \
-		rust-embed-8.7.1 \
-		rust-embed-impl-8.7.0 \
-		rust-embed-utils-8.7.0 \
-		rustc-demangle-0.1.24 \
+		rust-embed-8.7.2 \
+		rust-embed-impl-8.7.2 \
+		rust-embed-utils-8.7.2 \
+		rustc-demangle-0.1.26 \
 		rustc-hash-1.1.0 \
 		rustc-hash-2.1.1 \
 		rusticata-macros-4.1.0 \
 		rustix-0.38.44 \
-		rustix-1.0.7 \
-		rustls-0.23.27 \
+		rustix-1.0.8 \
+		rustls-0.23.31 \
 		rustls-native-certs-0.8.1 \
-		rustls-pemfile-2.2.0 \
 		rustls-pki-types-1.12.0 \
-		rustls-webpki-0.103.3 \
-		rustversion-1.0.20 \
+		rustls-webpki-0.103.4 \
+		rustversion-1.0.21 \
 		ryu-1.0.20 \
 		same-file-1.0.6 \
 		schannel-0.1.27 \
+		schemars-0.9.0 \
+		schemars-1.0.4 \
 		scopeguard-1.2.0 \
 		sd-notify-0.4.5 \
+		sec1-0.7.3 \
 		security-framework-2.11.1 \
 		security-framework-3.2.0 \
 		security-framework-sys-2.14.0 \
-		selinux-0.5.1 \
-		selinux-sys-0.6.14 \
+		selinux-0.5.3 \
+		selinux-sys-0.6.15 \
 		semver-1.0.26 \
 		serde-1.0.219 \
 		serde_bytes-0.11.17 \
 		serde_cbor-0.11.2 \
 		serde_cbor_2-0.12.0-dev \
 		serde_derive-1.0.219 \
-		serde_json-1.0.140 \
+		serde_html_form-0.2.7 \
+		serde_json-1.0.142 \
 		serde_path_to_error-0.1.17 \
-		serde_spanned-0.6.8 \
+		serde_spanned-0.6.9 \
 		serde_urlencoded-0.7.1 \
-		serde_with-3.12.0 \
-		serde_with_macros-3.12.0 \
+		serde_with-3.14.0 \
+		serde_with_macros-3.14.0 \
 		sha-crypt-0.5.0 \
 		sha1-0.10.6 \
 		sha1-checked-0.10.0 \
 		sha2-0.10.9 \
+		sha2-0.11.0-rc.0 \
 		sharded-slab-0.1.7 \
 		shell-words-1.1.0 \
 		shellexpand-3.1.1 \
 		shlex-1.3.0 \
-		signal-hook-registry-1.4.5 \
-		slab-0.4.9 \
-		smallvec-1.15.0 \
+		signal-hook-registry-1.4.6 \
+		signature-2.2.0 \
+		slab-0.4.10 \
+		smallvec-1.15.1 \
 		smartstring-1.0.1 \
 		smolset-1.3.1 \
-		socket2-0.5.9 \
+		socket2-0.5.10 \
+		socket2-0.6.0 \
 		spin-0.9.8 \
 		spki-0.7.3 \
 		sptr-0.3.2 \
-		sshkey-attest-0.5.0 \
+		sshkey-attest-0.5.2 \
 		stable_deref_trait-1.2.0 \
 		static_assertions-1.1.0 \
 		strsim-0.11.1 \
 		subtle-2.6.1 \
 		svg-0.18.0 \
 		syn-1.0.109 \
-		syn-2.0.101 \
+		syn-2.0.104 \
 		sync_wrapper-0.1.2 \
 		sync_wrapper-1.0.2 \
 		synstructure-0.13.2 \
@@ -495,36 +560,37 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		thiserror-impl-2.0.12 \
 		thousands-0.2.0 \
 		thread-tree-0.3.3 \
-		thread_local-1.1.8 \
+		thread_local-1.1.9 \
 		time-0.3.41 \
 		time-core-0.1.4 \
 		time-macros-0.2.22 \
+		tinystr-0.7.6 \
 		tinystr-0.8.1 \
 		tinyvec-1.9.0 \
 		tinyvec_macros-0.1.1 \
 		tls_codec-0.4.2 \
 		tls_codec_derive-0.4.2 \
-		tokio-1.45.0 \
+		tokio-1.47.1 \
 		tokio-macros-2.5.0 \
 		tokio-native-tls-0.3.1 \
 		tokio-openssl-0.6.5 \
 		tokio-rustls-0.26.2 \
 		tokio-stream-0.1.17 \
-		tokio-util-0.7.15 \
-		toml-0.8.22 \
-		toml_datetime-0.6.9 \
-		toml_edit-0.22.26 \
-		toml_write-0.1.1 \
+		tokio-util-0.7.16 \
+		toml-0.8.23 \
+		toml_datetime-0.6.11 \
+		toml_edit-0.22.27 \
+		toml_write-0.1.2 \
 		tonic-0.12.3 \
 		tower-0.4.13 \
 		tower-0.5.2 \
-		tower-http-0.6.4 \
+		tower-http-0.6.6 \
 		tower-layer-0.3.3 \
 		tower-service-0.3.3 \
 		tracing-0.1.41 \
-		tracing-attributes-0.1.28 \
-		tracing-core-0.1.33 \
-		tracing-forest-0.1.6 \
+		tracing-attributes-0.1.30 \
+		tracing-core-0.1.34 \
+		tracing-forest-0.2.0 \
 		tracing-log-0.2.0 \
 		tracing-opentelemetry-0.28.0 \
 		tracing-subscriber-0.3.19 \
@@ -536,8 +602,8 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		unicode-bom-2.0.3 \
 		unicode-ident-1.0.18 \
 		unicode-normalization-0.1.24 \
-		unicode-segmentation-1.12.0 \
-		unicode-width-0.2.0 \
+		unicode-width-0.2.1 \
+		universal-hash-0.5.1 \
 		untrusted-0.9.0 \
 		url-2.5.4 \
 		urlencoding-2.1.3 \
@@ -546,7 +612,7 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		utoipa-4.2.3 \
 		utoipa-gen-4.3.1 \
 		utoipa-swagger-ui-6.0.0 \
-		uuid-1.16.0 \
+		uuid-1.17.0 \
 		uuid-simd-0.8.0 \
 		valuable-0.1.1 \
 		vcpkg-0.2.15 \
@@ -554,7 +620,7 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		vsimd-0.8.0 \
 		walkdir-2.5.0 \
 		want-0.3.1 \
-		wasi-0.11.0+wasi-snapshot-preview1 \
+		wasi-0.11.1+wasi-snapshot-preview1 \
 		wasi-0.14.2+wasi-0.2.4 \
 		wasite-0.1.0 \
 		wasm-bindgen-0.2.100 \
@@ -565,15 +631,14 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		wasm-bindgen-shared-0.2.100 \
 		web-sys-0.3.77 \
 		web-time-1.1.0 \
-		webauthn-attestation-ca-0.5.1 \
-		webauthn-authenticator-rs-0.5.1 \
-		webauthn-rs-0.5.1 \
-		webauthn-rs-core-0.5.1 \
-		webauthn-rs-proto-0.5.1 \
-		webdriver-0.50.0 \
-		webpki-roots-0.26.11 \
-		webpki-roots-1.0.0 \
-		weezl-0.1.8 \
+		webauthn-attestation-ca-0.5.2 \
+		webauthn-authenticator-rs-0.5.2 \
+		webauthn-rs-0.5.2 \
+		webauthn-rs-core-0.5.2 \
+		webauthn-rs-proto-0.5.2 \
+		webdriver-0.53.0 \
+		webpki-roots-1.0.2 \
+		weezl-0.1.10 \
 		which-4.4.2 \
 		whoami-1.6.0 \
 		winapi-0.3.9 \
@@ -581,20 +646,19 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		winapi-util-0.1.9 \
 		winapi-x86_64-pc-windows-gnu-0.4.0 \
 		windows-0.41.0 \
-		windows-core-0.61.0 \
+		windows-core-0.61.2 \
 		windows-implement-0.60.0 \
 		windows-interface-0.59.1 \
-		windows-link-0.1.1 \
-		windows-registry-0.4.0 \
-		windows-result-0.3.2 \
-		windows-strings-0.3.1 \
-		windows-strings-0.4.0 \
+		windows-link-0.1.3 \
+		windows-result-0.3.4 \
+		windows-strings-0.4.2 \
 		windows-sys-0.48.0 \
 		windows-sys-0.52.0 \
 		windows-sys-0.59.0 \
+		windows-sys-0.60.2 \
 		windows-targets-0.48.5 \
 		windows-targets-0.52.6 \
-		windows-targets-0.53.0 \
+		windows-targets-0.53.3 \
 		windows_aarch64_gnullvm-0.41.0 \
 		windows_aarch64_gnullvm-0.48.5 \
 		windows_aarch64_gnullvm-0.52.6 \
@@ -626,27 +690,31 @@ CARGO_CRATES=	addr2line-0.24.2 \
 		windows_x86_64_msvc-0.52.6 \
 		windows_x86_64_msvc-0.53.0 \
 		winnow-0.6.26 \
-		winnow-0.7.10 \
+		winnow-0.7.12 \
 		winreg-0.50.0 \
 		wit-bindgen-rt-0.39.0 \
+		writeable-0.5.5 \
 		writeable-0.6.1 \
 		x509-cert-0.2.5 \
 		x509-parser-0.16.0 \
+		yoke-0.7.5 \
 		yoke-0.8.0 \
+		yoke-derive-0.7.5 \
 		yoke-derive-0.8.0 \
-		zerocopy-0.8.25 \
-		zerocopy-derive-0.8.25 \
+		zerocopy-0.8.26 \
+		zerocopy-derive-0.8.26 \
 		zerofrom-0.1.6 \
 		zerofrom-derive-0.1.6 \
 		zeroize-1.8.1 \
 		zeroize_derive-1.4.2 \
 		zerotrie-0.2.2 \
-		zerovec-0.11.2 \
+		zerovec-0.10.4 \
+		zerovec-0.11.3 \
+		zerovec-derive-0.10.3 \
 		zerovec-derive-0.11.1 \
 		zip-0.6.6 \
+		zlib-rs-0.5.1 \
 		zune-core-0.4.12 \
-		zune-jpeg-0.4.14 \
+		zune-jpeg-0.4.20 \
 		zxcvbn-3.1.0 \
-		sshkeys@git+https://github.com/Firstyear/rust-sshkeys.git?rev=49cb53232115d3aea86cd059b151e376293805fc\#49cb53232115d3aea86cd059b151e376293805fc \
-		libnss@git+https://github.com/Firstyear/libnss-rs.git?branch=20250207-freebsd\#763da4beaadc1e475b89ed876de31a5e393f6d30 \
-		compact_jwt@git+https://github.com/Firstyear/compact-jwt.git?rev=043976842773dd035fe394261347edeb644e3091\#043976842773dd035fe394261347edeb644e3091
+		sshkeys@git+https://github.com/dnaeon/rust-sshkeys.git?rev=d736693769b9c4abebad8050fba92271f3c50226\#d736693769b9c4abebad8050fba92271f3c50226
diff --git a/security/kanidm/distinfo b/security/kanidm/distinfo
index d4f4a09b5062..bc3b96860339 100644
--- a/security/kanidm/distinfo
+++ b/security/kanidm/distinfo
@@ -1,8 +1,16 @@
-TIMESTAMP = 1751495652
+TIMESTAMP = 1755915791
 SHA256 (rust/crates/addr2line-0.24.2.crate) = dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1
 SIZE (rust/crates/addr2line-0.24.2.crate) = 39015
-SHA256 (rust/crates/adler2-2.0.0.crate) = 512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627
-SIZE (rust/crates/adler2-2.0.0.crate) = 13529
+SHA256 (rust/crates/adler2-2.0.1.crate) = 320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa
+SIZE (rust/crates/adler2-2.0.1.crate) = 13366
+SHA256 (rust/crates/aead-0.5.2.crate) = d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0
+SIZE (rust/crates/aead-0.5.2.crate) = 15509
+SHA256 (rust/crates/aes-0.8.4.crate) = b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0
+SIZE (rust/crates/aes-0.8.4.crate) = 124812
+SHA256 (rust/crates/aes-gcm-0.10.3.crate) = 831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1
+SIZE (rust/crates/aes-gcm-0.10.3.crate) = 148991
+SHA256 (rust/crates/aes-kw-0.2.1.crate) = 69fa2b352dcefb5f7f3a5fb840e02665d311d878955380515e4fd50095dd3d8c
+SIZE (rust/crates/aes-kw-0.2.1.crate) = 14088
 SHA256 (rust/crates/ahash-0.8.12.crate) = 5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75
 SIZE (rust/crates/ahash-0.8.12.crate) = 43413
 SHA256 (rust/crates/aho-corasick-1.1.3.crate) = 8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916
@@ -13,16 +21,16 @@ SHA256 (rust/crates/android-tzdata-0.1.1.crate) = e999941b234f3131b00bc13c22d06e
 SIZE (rust/crates/android-tzdata-0.1.1.crate) = 7674
 SHA256 (rust/crates/android_system_properties-0.1.5.crate) = 819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311
 SIZE (rust/crates/android_system_properties-0.1.5.crate) = 5243
-SHA256 (rust/crates/anstream-0.6.18.crate) = 8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b
-SIZE (rust/crates/anstream-0.6.18.crate) = 29681
-SHA256 (rust/crates/anstyle-1.0.10.crate) = 55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9
-SIZE (rust/crates/anstyle-1.0.10.crate) = 15725
-SHA256 (rust/crates/anstyle-parse-0.2.6.crate) = 3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9
-SIZE (rust/crates/anstyle-parse-0.2.6.crate) = 22343
-SHA256 (rust/crates/anstyle-query-1.1.2.crate) = 79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c
-SIZE (rust/crates/anstyle-query-1.1.2.crate) = 9969
-SHA256 (rust/crates/anstyle-wincon-3.0.7.crate) = ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e
-SIZE (rust/crates/anstyle-wincon-3.0.7.crate) = 12400
+SHA256 (rust/crates/anstream-0.6.20.crate) = 3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192
+SIZE (rust/crates/anstream-0.6.20.crate) = 28797
+SHA256 (rust/crates/anstyle-1.0.11.crate) = 862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd
+SIZE (rust/crates/anstyle-1.0.11.crate) = 15880
+SHA256 (rust/crates/anstyle-parse-0.2.7.crate) = 4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2
+SIZE (rust/crates/anstyle-parse-0.2.7.crate) = 21707
+SHA256 (rust/crates/anstyle-query-1.1.4.crate) = 9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2
+SIZE (rust/crates/anstyle-query-1.1.4.crate) = 10192
+SHA256 (rust/crates/anstyle-wincon-3.0.10.crate) = 3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a
+SIZE (rust/crates/anstyle-wincon-3.0.10.crate) = 12558
 SHA256 (rust/crates/anyhow-1.0.98.crate) = e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487
 SIZE (rust/crates/anyhow-1.0.98.crate) = 53334
 SHA256 (rust/crates/arc-swap-1.7.1.crate) = 69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457
@@ -45,8 +53,8 @@ SHA256 (rust/crates/asn1-rs-derive-0.5.1.crate) = 965c2d33e53cb6b267e148a4cb0760
 SIZE (rust/crates/asn1-rs-derive-0.5.1.crate) = 9692
 SHA256 (rust/crates/asn1-rs-impl-0.2.0.crate) = 7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7
*** 1363 LINES SKIPPED ***