[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
sha2	dev-dependencies	minor	0.10 → 0.11

---

Release Notes

RustCrypto/hashes (sha2)

v0.11.1

Compare Source

v0.11.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 2 suggested fixes.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:48
- Cargo.toml:48

---

### [1/2] Cargo.toml:48
Issue identified during code review:
WHAT: The `sha2` dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on `digest` 0.11, but the existing `hkdf = "0.12"` (and likely `aes-gcm`/RustCrypto peers) depends on `digest` 0.10. Code like `Hkdf<Sha256>` would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run `cargo audit` or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump `hkdf` (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

---

### [2/2] Cargo.toml:48
Issue identified during code review:
Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When `cargo test` compiles the `frozen` module, the `Hkdf::<Sha256>::new(...)` call in src/store.rs:327 fails because sha2 0.11's `Sha256` does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.
Reference implementation (from code review):

// Cargo.toml:48
hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[kodus-27b]

WHAT: The sha2 dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on digest 0.11, but the existing hkdf = "0.12" (and likely aes-gcm/RustCrypto peers) depends on digest 0.10. Code like Hkdf<Sha256> would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run cargo audit or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump hkdf (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 48:

WHAT: The `sha2` dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on `digest` 0.11, but the existing `hkdf = "0.12"` (and likely `aes-gcm`/RustCrypto peers) depends on `digest` 0.10. Code like `Hkdf<Sha256>` would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run `cargo audit` or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump `hkdf` (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When cargo test compiles the frozen module, the Hkdf::<Sha256>::new(...) call in src/store.rs:327 fails because sha2 0.11's Sha256 does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

Prompt for LLM

File Cargo.toml:

Line 46 to 48:

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When `cargo test` compiles the `frozen` module, the `Hkdf::<Sha256>::new(...)` call in src/store.rs:327 fails because sha2 0.11's `Sha256` does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.

Suggested Code:

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​