[bnusunny]

Summary

Lockfile-only bump that clears the 8 open advisories filed by the nightly Security audit. Every bump stays within the same SemVer range, so Cargo.toml is unchanged.

None of these crates is in the shipped lambda-adapter binary. hyper is built without http2, and rustls only arrives through dev-dependencies (hyper-rustls, httpmock, criterion). So this is hygiene, not a runtime fix.

Issue	Advisory	Package	Locked → patched	Pulled in by
#898	RUSTSEC-2026-0382	rustls-webpki	0.103.13 → 0.103.16	hyper-rustls (dev)
#897	RUSTSEC-2026-0346	rustls	0.23.36 → 0.23.46	hyper-rustls (dev)
#896	RUSTSEC-2026-0349	rustls	0.23.36 → 0.23.46	hyper-rustls (dev)
#895	RUSTSEC-2026-0348	rustls	0.23.36 → 0.23.46	hyper-rustls (dev); brotli feature not enabled
#845	RUSTSEC-2026-0285	rustls	0.23.36 → 0.23.46	hyper-rustls (dev)
#828	RUSTSEC-2026-0258	h2	0.4.13 → 0.4.20	hyper http2 via hyper-rustls/httpmock (dev)
#814	RUSTSEC-2026-0221	event-listener	5.4.1 → 5.4.2	httpmock (dev)
#788	RUSTSEC-2026-0204	crossbeam-epoch	0.9.18 → 0.9.21	criterion (dev)

The update also moves aws-lc-rs 1.16.2 → 1.18.2 and aws-lc-sys 0.39.0 → 0.46.0, which rustls 0.23.46 requires.

Produced with:

cargo update -p rustls -p rustls-webpki -p h2 -p event-listener -p crossbeam-epoch

Test plan

• cargo nextest run --locked --profile ci: 98 passed, 4 skipped (the #[ignore] e2e tests), same as main
• Next nightly Security audit run reports no advisories

Closes #898
Closes #897
Closes #896
Closes #895
Closes #845
Closes #828
Closes #814
Closes #788