Skip to content

chore(deps): update rust crate sha2 to 0.11 #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cachekit-renovate-bot wants to merge 1 commit into
base: main
Choose a base branch
from
+21 −3
Open

chore(deps): update rust crate sha2 to 0.11 #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,5 +45,5 @@ aes-gcm = "0.11"
async-trait = "0.1"
hkdf = "0.12"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.10"
sha2 = "0.11"

@kodus-27b kodus-27b Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Kody Rules high

WHAT: The sha2 dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on digest 0.11, but the existing hkdf = "0.12" (and likely aes-gcm/RustCrypto peers) depends on digest 0.10. Code like Hkdf<Sha256> would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run cargo audit or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump hkdf (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM 

File Cargo.toml:

Line 48:

WHAT: The `sha2` dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on `digest` 0.11, but the existing `hkdf = "0.12"` (and likely `aes-gcm`/RustCrypto peers) depends on `digest` 0.10. Code like `Hkdf<Sha256>` would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run `cargo audit` or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump `hkdf` (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

​

​

Comment on lines 46 to +48

@kodus-27b kodus-27b Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Bug medium

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When cargo test compiles the frozen module, the Hkdf::<Sha256>::new(...) call in src/store.rs:327 fails because sha2 0.11's Sha256 does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"
Prompt for LLM 

File Cargo.toml:

Line 46 to 48:

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When `cargo test` compiles the `frozen` module, the `Hkdf::<Sha256>::new(...)` call in src/store.rs:327 fails because sha2 0.11's `Sha256` does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.

Suggested Code:

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

​

​

@kodus-27b kodus-27b Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Kody Rules high

WHAT: The sha2 dependency is bumped from 0.10 to 0.11 in Cargo.toml, and no vulnerability or supply-chain evidence is attached. WHY: In 0.x crates a minor bump is semver-breaking. Dependency changes must be checked for known CVEs and supply-chain risk, and the lockfile must be updated to match. Related RustCrypto crates (hkdf 0.12, aes-gcm) may also pin an incompatible digest version, which can pull in duplicate trait versions. HOW: Run cargo audit and/or query OSV for sha2 0.11 and paste the output in the PR description. Commit the updated Cargo.lock, and confirm with cargo tree -d that hkdf, aes-gcm and related crates resolve compatible digest/crypto-common versions.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM 

File Cargo.toml:

Line 48:

WHAT: The `sha2` dependency is bumped from 0.10 to 0.11 in Cargo.toml, and no vulnerability or supply-chain evidence is attached. WHY: In 0.x crates a minor bump is semver-breaking. Dependency changes must be checked for known CVEs and supply-chain risk, and the lockfile must be updated to match. Related RustCrypto crates (`hkdf` 0.12, `aes-gcm`) may also pin an incompatible `digest` version, which can pull in duplicate trait versions. HOW: Run `cargo audit` and/or query OSV for sha2 0.11 and paste the output in the PR description. Commit the updated Cargo.lock, and confirm with `cargo tree -d` that `hkdf`, `aes-gcm` and related crates resolve compatible `digest`/`crypto-common` versions.

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

​

​

Comment on lines 46 to +48

@kodus-27b kodus-27b Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Bug medium

Version mismatch in Cargo.toml dev-dependencies: sha2 moves to 0.11, which uses digest 0.11, while hkdf stays at 0.12, which uses hmac 0.12 and digest 0.10 per Cargo.lock. Because sha2 0.11's Sha256 does not implement the digest 0.10 traits that Hkdf<H> requires, Hkdf::<Sha256>::new(Some(&salt), master_key) in src/store.rs:328 fails to compile and cargo test fails to build. Fix: bump hkdf to 0.13 (built on digest 0.11) in the same PR, or keep sha2 at 0.10.

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"
Prompt for LLM 

File Cargo.toml:

Line 46 to 48:

Version mismatch in Cargo.toml dev-dependencies: `sha2` moves to 0.11, which uses `digest` 0.11, while `hkdf` stays at 0.12, which uses `hmac` 0.12 and `digest` 0.10 per Cargo.lock. Because `sha2` 0.11's `Sha256` does not implement the `digest` 0.10 traits that `Hkdf<H>` requires, `Hkdf::<Sha256>::new(Some(&salt), master_key)` in src/store.rs:328 fails to compile and `cargo test` fails to build. Fix: bump `hkdf` to 0.13 (built on `digest` 0.11) in the same PR, or keep `sha2` at 0.10.

Suggested Code:

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

​

​

tempfile = "3"
Loading