cloudflare/boring v5.0.0

v5.0.0

Repository: cloudflare/boring

Tag: v5.0.0

Published: 2026-02-10T17:48:06Z

Prerelease: no

Release notes:

Breaking changes

Upgrade to 4.21.1 first and fix any deprecation warnings.

Cargo features removed/simplified

• FIPS only needs the fips Cargo feature, and the rest is customized via env vars (like BORING_BSSL_FIPS_PATH): https://github.com/cloudflare/boring/pull/383
• Removed the "kx-*" features https://github.com/cloudflare/boring/pull/393
• Post-quantum is enabled by default (X25519MLKEM768 and P256Kyber768Draft00) and the "pq-experimental" Cargo feature flag is not used any more.

Other semver changes

• Updated BoringSSL to a newer version with updated patches by @nox in https://github.com/cloudflare/boring/pull/419
• Removed SslCurve API. Identifying curves by name is more reliable across different builds of BoringSSL. Use SslRef::curve_name() instead https://github.com/cloudflare/boring/pull/390 https://github.com/cloudflare/boring/pull/396
• Removed deprecated X509CheckFlags https://github.com/cloudflare/boring/pull/425
• X509Store is now cheaply cloneable, but immutable. SslContextBuilder.cert_store_mut() can't be used after .set_cert_store(). If you need .cert_store_mut(), either don't overwrite the default store, or use .set_cert_store_builder() https://github.com/cloudflare/boring/pull/426
• X509StoreBuilder::add_cert takes a reference.
• Hyper version upgraded from v0 to v1
• set_ex_data() will always Drop previous values https://github.com/cloudflare/boring/pull/424
• Removed blanket Eq from FFI types
• BIO_set_retry_write on WouldBlock @ihciah in https://github.com/cloudflare/boring/pull/118

Added

• Added ML-KEM-768 and ML-KEM-1024 support https://github.com/cloudflare/boring/pull/455 https://github.com/cloudflare/boring/pull/456 https://github.com/cloudflare/boring/pull/462
• Added init-update-finalize API for HMAC https://github.com/cloudflare/boring/pull/459
• set_strict_cipher_list by @abernardeau-wallix in https://github.com/cloudflare/boring/pull/416
• Added set_ticket_key_callback by @toidiu in https://github.com/cloudflare/boring/pull/330
• SslCipherRef::protocol_id by @nox in https://github.com/cloudflare/boring/pull/409

Full Changelog: https://github.com/cloudflare/boring/compare/v4.20.0...v5.0.0