Skip to content

build(deps): Bump sha2 from 0.10.9 to 0.11.0#1416

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/sha2-0.11.0
Open

build(deps): Bump sha2 from 0.10.9 to 0.11.0#1416
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/sha2-0.11.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 26, 2026

Bumps sha2 from 0.10.9 to 0.11.0.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.9 to 0.11.0.
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

---
updated-dependencies:
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Mar 26, 2026
@dependabot dependabot Bot requested a review from a team as a code owner March 26, 2026 17:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Mar 26, 2026
@tgeoghegan
Copy link
Copy Markdown
Contributor

Bumping hmac along with sha2 fixes the dependency resolution. But now we have 42k lines of audits.

Vetting Failed!

10 unvetted dependencies:
  block-buffer:0.12.0 missing ["safe-to-deploy"]
  cmov:0.5.2 missing ["safe-to-deploy"]
  const-oid:0.10.2 missing ["safe-to-deploy"]
  crypto-common:0.2.1 missing ["safe-to-deploy"]
  ctutils:0.4.0 missing ["safe-to-deploy"]
  digest:0.11.2 missing ["safe-to-deploy"]
  hmac:0.13.0 missing ["safe-to-deploy"]
  hybrid-array:0.4.8 missing ["safe-to-deploy"]
  sha2:0.11.0 missing ["safe-to-deploy"]
  typenum:1.19.0 missing ["safe-to-deploy"]

recommended audits for safe-to-deploy:
    Command                                    Publisher                       Used By                         Audit Size
    cargo vet diff crypto-common 0.1.6 0.2.1   github:RustCrypto/traits        digest                          8 files changed, 773 insertions(+), 144 deletions(-)
    cargo vet diff block-buffer 0.10.4 0.12.0  github:RustCrypto/utils         digest                          9 files changed, 825 insertions(+), 281 deletions(-)
    cargo vet diff hmac 0.12.1 0.13.0          github:RustCrypto/MACs          prio                            22 files changed, 686 insertions(+), 570 deletions(-)
    cargo vet inspect cmov 0.5.2               tarcieri                        ctutils                         2765 lines
    cargo vet diff sha2 0.10.9 0.11.0          github:RustCrypto/hashes        prio                            51 files changed, 1886 insertions(+), 976 deletions(-)
    cargo vet diff digest 0.10.7 0.11.2        github:RustCrypto/traits        hmac and sha2                   27 files changed, 2197 insertions(+), 1279 deletions(-)
    cargo vet inspect ctutils 0.4.0            tarcieri                        digest                          3903 lines
    cargo vet inspect hybrid-array 0.4.8       github:RustCrypto/hybrid-array  block-buffer and crypto-common  4065 lines
    cargo vet inspect const-oid 0.10.2         tarcieri                        digest                          7987 lines
    cargo vet diff typenum 1.17.0 1.19.0       paholg                          fixed, nalgebra, and 3 others   25 files changed, 13021 insertions(+), 1111 deletions(-)

estimated audit backlog: 42469 lines

Use |cargo vet certify| to record the audits.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant