Repository navigation
chore(deps): update rust crate hkdf to 0.13 #37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,7 +43,7 @@ tokio = { version = "1", default-features = false, features = ["macros", "rt", " | |
| [dev-dependencies] | ||
| aes-gcm = "0.11" | ||
| async-trait = "0.1" | ||
| hkdf = "0.12" | ||
| hkdf = "0.13" | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. WHAT: The Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Dependency mismatch in Cargo.toml: the Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. WHAT: The dev-dependency Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. WHAT: The Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. WHAT: This PR bumps the
Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. WHAT: The Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ |
||
| rustix = { version = "1", features = ["pty"] } | ||
| sha2 = "0.10" | ||
|
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Version mismatch in Cargo.toml [dev-dependencies]: hkdf 0.13 depends on hmac 0.13 / digest 0.11 (per Cargo.lock), while sha2 stays at 0.10, whose Sha256 implements only digest 0.10 traits. Running hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Build break in Cargo.toml dev-dependencies: hkdf 0.13 depends on hmac 0.13 / digest 0.11 (see Cargo.lock), but sha2 stays pinned to 0.10, which implements digest 0.10's traits, so hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Build break in the Cargo.toml dev-dependencies: hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Version mismatch in Cargo.toml dev-dependencies: hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Build break in Cargo.toml dev-dependencies: hkdf is bumped to 0.13 while sha2 stays at 0.10, and the two crates depend on incompatible digest versions (Cargo.lock resolves hkdf 0.13.0 β hmac 0.13.0 β digest 0.11.3, but sha2 0.10.9 β digest 0.10.7). When hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Build break in the Cargo.toml dev-dependencies: hkdf 0.13 is built on hmac 0.13 and digest 0.11 (Cargo.lock:537-560), but sha2 stays pinned to 0.10, which is built on digest 0.10.7 (Cargo.lock:1250-1258). When the tests compile, hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ
Comment on lines
+46
to
48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Dependency version mismatch in Cargo.toml dev-dependencies: the bump to hkdf 0.13 (which uses hmac 0.13 and digest 0.11 per Cargo.lock) keeps sha2 at 0.10 (sha2 0.10.9 uses digest 0.10.7). That leaves hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"Prompt for LLMTalk to Kody by mentioning @kody Was this suggestion helpful? React with π or π to help Kody learn from this interaction. ββ |
||
| tempfile = "3" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
WHAT: The hkdf dev-dependency moves from 0.12 to 0.13 (a semver-breaking bump for 0.x crates) with no visible audit or SCA evidence. WHY: This is a dependency manifest change. It needs a CVE/advisory check (cargo audit / OSV) and an updated Cargo.lock. hkdf 0.13 also moves to the digest 0.11 / hmac 0.13 ecosystem, but sha2 stays at 0.10 (digest 0.10). That is an unexpected transitive jump, and
Hkdf<Sha256>may no longer compile or may pull in duplicate digest versions. HOW: Runcargo audit(or query OSV) and attach the output to the PR. Commit the updated Cargo.lock. Either bump sha2 (and related RustCrypto crates such as aes-gcm) to versions compatible with hkdf 0.13, or keep hkdf at 0.12.Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk
Prompt for LLM
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with π or π to help Kody learn from this interaction.
ββ