[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
sha2	dev-dependencies	minor	0.10 → 0.11

---

Release Notes

RustCrypto/hashes (sha2)

v0.11.1

Compare Source

v0.11.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 2 suggested fixes.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:48
- Cargo.toml:48

---

### [1/2] Cargo.toml:48
Issue identified during code review:
WHAT: The `sha2` dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on `digest` 0.11, but the existing `hkdf = "0.12"` (and likely `aes-gcm`/RustCrypto peers) depends on `digest` 0.10. Code like `Hkdf<Sha256>` would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run `cargo audit` or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump `hkdf` (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

---

### [2/2] Cargo.toml:48
Issue identified during code review:
Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When `cargo test` compiles the `frozen` module, the `Hkdf::<Sha256>::new(...)` call in src/store.rs:327 fails because sha2 0.11's `Sha256` does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.
Reference implementation (from code review):

// Cargo.toml:48
hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[kodus-27b]

WHAT: The sha2 dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on digest 0.11, but the existing hkdf = "0.12" (and likely aes-gcm/RustCrypto peers) depends on digest 0.10. Code like Hkdf<Sha256> would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run cargo audit or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump hkdf (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 48:

WHAT: The `sha2` dependency moves from 0.10 to 0.11. This diff has no evidence of a CVE or supply-chain check, and no matching Cargo.lock update is visible.
WHY: For 0.x crates, a minor version bump is semver-breaking. sha2 0.11 depends on `digest` 0.11, but the existing `hkdf = "0.12"` (and likely `aes-gcm`/RustCrypto peers) depends on `digest` 0.10. Code like `Hkdf<Sha256>` would then fail to compile, or the build would pull in duplicate digest versions. Dependency changes also need audit evidence before merge.
HOW: Run `cargo audit` or check OSV for sha2 0.11 and add the output to the PR description. Commit the updated Cargo.lock. Either bump `hkdf` (and any other digest-0.10 consumers) to versions built on digest 0.11, or keep sha2 at 0.10 until the whole RustCrypto set can move together.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When cargo test compiles the frozen module, the Hkdf::<Sha256>::new(...) call in src/store.rs:327 fails because sha2 0.11's Sha256 does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

Prompt for LLM

File Cargo.toml:

Line 46 to 48:

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 implements digest 0.11 traits, while hkdf 0.12 depends on digest 0.10.7 through hmac 0.12.1 (per Cargo.lock). When `cargo test` compiles the `frozen` module, the `Hkdf::<Sha256>::new(...)` call in src/store.rs:327 fails because sha2 0.11's `Sha256` does not satisfy hkdf 0.12's digest 0.10 trait bounds. Fix: bump hkdf to 0.13 (hmac 0.13 / digest 0.11) in the same change, or keep sha2 at 0.10.

Suggested Code:

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

WHAT: The sha2 dependency is bumped from 0.10 to 0.11 in Cargo.toml, and no vulnerability or supply-chain evidence is attached. WHY: In 0.x crates a minor bump is semver-breaking. Dependency changes must be checked for known CVEs and supply-chain risk, and the lockfile must be updated to match. Related RustCrypto crates (hkdf 0.12, aes-gcm) may also pin an incompatible digest version, which can pull in duplicate trait versions. HOW: Run cargo audit and/or query OSV for sha2 0.11 and paste the output in the PR description. Commit the updated Cargo.lock, and confirm with cargo tree -d that hkdf, aes-gcm and related crates resolve compatible digest/crypto-common versions.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 48:

WHAT: The `sha2` dependency is bumped from 0.10 to 0.11 in Cargo.toml, and no vulnerability or supply-chain evidence is attached. WHY: In 0.x crates a minor bump is semver-breaking. Dependency changes must be checked for known CVEs and supply-chain risk, and the lockfile must be updated to match. Related RustCrypto crates (`hkdf` 0.12, `aes-gcm`) may also pin an incompatible `digest` version, which can pull in duplicate trait versions. HOW: Run `cargo audit` and/or query OSV for sha2 0.11 and paste the output in the PR description. Commit the updated Cargo.lock, and confirm with `cargo tree -d` that `hkdf`, `aes-gcm` and related crates resolve compatible `digest`/`crypto-common` versions.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Version mismatch in Cargo.toml dev-dependencies: sha2 moves to 0.11, which uses digest 0.11, while hkdf stays at 0.12, which uses hmac 0.12 and digest 0.10 per Cargo.lock. Because sha2 0.11's Sha256 does not implement the digest 0.10 traits that Hkdf<H> requires, Hkdf::<Sha256>::new(Some(&salt), master_key) in src/store.rs:328 fails to compile and cargo test fails to build. Fix: bump hkdf to 0.13 (built on digest 0.11) in the same PR, or keep sha2 at 0.10.

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

Prompt for LLM

File Cargo.toml:

Line 46 to 48:

Version mismatch in Cargo.toml dev-dependencies: `sha2` moves to 0.11, which uses `digest` 0.11, while `hkdf` stays at 0.12, which uses `hmac` 0.12 and `digest` 0.10 per Cargo.lock. Because `sha2` 0.11's `Sha256` does not implement the `digest` 0.10 traits that `Hkdf<H>` requires, `Hkdf::<Sha256>::new(Some(&salt), master_key)` in src/store.rs:328 fails to compile and `cargo test` fails to build. Fix: bump `hkdf` to 0.13 (built on `digest` 0.11) in the same PR, or keep `sha2` at 0.10.

Suggested Code:

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

WHAT: The sha2 dependency moves from 0.10 to 0.11 in Cargo.toml with no supply-chain evidence attached.
WHY: Dependency manifest changes must be checked for known vulnerabilities and must come with an updated lockfile. sha2 0.11 is a semver-breaking release that pulls in the new digest 0.11 ecosystem. That can cause transitive version jumps or duplicate crate versions alongside other RustCrypto crates still on 0.10 (e.g., hkdf 0.12).
HOW: Run cargo audit (or an OSV/SCA query) for sha2 0.11 and its new transitives, and attach the output to the PR description. Commit the updated Cargo.lock. Confirm with cargo tree -d that no duplicate digest versions are introduced, or bump the related crates (e.g., hkdf) together.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 48:

WHAT: The `sha2` dependency moves from 0.10 to 0.11 in Cargo.toml with no supply-chain evidence attached.
WHY: Dependency manifest changes must be checked for known vulnerabilities and must come with an updated lockfile. sha2 0.11 is a semver-breaking release that pulls in the new `digest` 0.11 ecosystem. That can cause transitive version jumps or duplicate crate versions alongside other RustCrypto crates still on 0.10 (e.g., `hkdf` 0.12).
HOW: Run `cargo audit` (or an OSV/SCA query) for sha2 0.11 and its new transitives, and attach the output to the PR description. Commit the updated Cargo.lock. Confirm with `cargo tree -d` that no duplicate `digest` versions are introduced, or bump the related crates (e.g., `hkdf`) together.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 depends on digest 0.11, while hkdf 0.12 still depends on hmac 0.12 and digest 0.10 (Cargo.lock: hkdf 0.12.4 -> hmac 0.12.1 -> digest 0.10.7; sha2 0.11.1 -> digest 0.11.3). When cargo test compiles the test-only frozen module, Hkdf::<Sha256>::new(Some(&salt), master_key) at src/store.rs:328 fails hkdf's digest 0.10 trait bounds, so the build fails. Fix: bump hkdf to 0.13 (hmac 0.13, digest 0.11) in the same change.

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

Prompt for LLM

File Cargo.toml:

Line 46 to 48:

Version mismatch in Cargo.toml dev-dependencies: sha2 0.11 depends on digest 0.11, while hkdf 0.12 still depends on hmac 0.12 and digest 0.10 (Cargo.lock: hkdf 0.12.4 -> hmac 0.12.1 -> digest 0.10.7; sha2 0.11.1 -> digest 0.11.3). When `cargo test` compiles the test-only `frozen` module, `Hkdf::<Sha256>::new(Some(&salt), master_key)` at src/store.rs:328 fails hkdf's digest 0.10 trait bounds, so the build fails. Fix: bump hkdf to 0.13 (hmac 0.13, digest 0.11) in the same change.

Suggested Code:

hkdf = "0.13"
rustix = { version = "1", features = ["pty"] }
sha2 = "0.11"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.