Bump awscrt from 0.36.0 to 0.38.0 to pick up fixes for published aws-c-mqtt / s2n-tls vulnerabilities #3849

Describe the feature

Please update the pinned awscrt version used by the crt extra from 0.36.0 to 0.38.0.

Use Case

awscrt==0.36.0 bundles aws-c-mqtt 0.16.0 and s2n-tls 1.7.5, which are affected by the following published AWS security bulletins:

• 2026-147-AWS / CVE-2026-115417 / GHSA-g3x5-86mr-65p5: memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt (affected: >= 0.9.1 and < 0.16.2, fixed in v0.16.2).
• 2026-062-AWS / CVE-2026-16317, CVE-2026-16318: issues in s2n-tls (affected: <= v1.7.5, fixed in v1.7.6).

awscrt==0.38.0 bundles aws-c-mqtt 1.1.2 and s2n-tls 1.7.10, so these issues are resolved there.

Because botocore pins awscrt to an exact version, users of botocore[crt] / boto3[crt] cannot move to the fixed release without overriding the dependency constraint, and vulnerability scanners flag the affected version in downstream projects.

Proposed Solution

Update the awscrt pin for the crt extra in setup.py and setup.cfg from 0.36.0 to 0.38.0, and add a changelog entry under .changes/next-release/. This is the same set of changes as the previous bump (#3750), which updated awscrt from 0.32.2 to 0.36.0. Please also confirm the CRT-related tests pass with the new version.

Other Information

• awscrt release notes: https://github.com/awslabs/aws-crt-python/releases/tag/v0.38.0
• Submodule versions per awscrt release: I checked the submodule entries under the crt/ directory of the aws-crt-python repository at the v0.36.0 and v0.38.0 tags, and identified the bundled aws-c-mqtt and s2n-tls versions from the tags the submodule commits point to.
• Previous bump for reference: Update awscrt version to 0.36.0 #3750

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

SDK version used

N/A

Environment details (OS name and version, etc.)

N/A