chore(#2510): bump indicatif/tower-http/hmac/sha2 to latest majors

Bumps the feature (major) versions that update cleanly without breaking the
build: indicatif 0.17->0.18, tower-http 0.6->0.7, hmac 0.12->0.13,
sha2 0.10->0.11. Only adaptation needed: import hmac's KeyInit trait in
webhook_secret (new_from_slice moved from Mac to KeyInit in hmac 0.13).

Held back (require dedicated code-change PRs, out of scope for a
non-breaking bump):
- reqwest 0.13: renames the rustls-tls feature and conflicts with
  forgejo-api 0.11 + matrix-sdk 0.14 which pin reqwest 0.12.
- rusqlite 0.40: libsqlite3-sys 0.38 clashes with matrix-sdk-sqlite 0.14's
  0.35 (single links=sqlite3) — coupled to the matrix-sdk bump.
- rmcp 2.2, matrix-sdk 0.18: major API rewrites across the MCP/matrix crates.
This commit is contained in:
atlas 2026-07-16 10:09:31 +02:00 committed by mara
commit d04c86e9ac
3 changed files with 126 additions and 54 deletions

170
Cargo.lock generated
View file

@ -389,6 +389,15 @@ dependencies = [
"generic-array",
]
[[package]]
name = "block-buffer"
version = "0.12.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
dependencies = [
"hybrid-array",
]
[[package]]
name = "block-padding"
version = "0.3.3"
@ -611,6 +620,12 @@ dependencies = [
"cc",
]
[[package]]
name = "cmov"
version = "0.5.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
[[package]]
name = "colorchoice"
version = "1.0.5"
@ -655,15 +670,14 @@ dependencies = [
[[package]]
name = "console"
version = "0.15.11"
version = "0.16.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
checksum = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c"
dependencies = [
"encode_unicode",
"libc",
"once_cell",
"unicode-width",
"windows-sys 0.59.0",
"windows-sys 0.61.2",
]
[[package]]
@ -684,6 +698,12 @@ version = "0.9.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
[[package]]
name = "const-oid"
version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
[[package]]
name = "const_panic"
version = "0.2.15"
@ -787,6 +807,15 @@ dependencies = [
"cipher 0.4.4",
]
[[package]]
name = "ctutils"
version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
dependencies = [
"cmov",
]
[[package]]
name = "curve25519-dalek"
version = "4.1.3"
@ -796,7 +825,7 @@ dependencies = [
"cfg-if",
"cpufeatures 0.2.17",
"curve25519-dalek-derive",
"digest",
"digest 0.10.7",
"fiat-crypto",
"rustc_version",
"serde",
@ -930,7 +959,7 @@ version = "0.7.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
dependencies = [
"const-oid",
"const-oid 0.9.6",
"zeroize",
]
@ -949,11 +978,23 @@ version = "0.10.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
dependencies = [
"block-buffer",
"block-buffer 0.10.4",
"crypto-common 0.1.7",
"subtle",
]
[[package]]
name = "digest"
version = "0.11.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
dependencies = [
"block-buffer 0.12.1",
"const-oid 0.10.2",
"crypto-common 0.2.2",
"ctutils",
]
[[package]]
name = "displaydoc"
version = "0.2.6"
@ -998,7 +1039,7 @@ dependencies = [
"ed25519",
"rand_core 0.6.4",
"serde",
"sha2",
"sha2 0.10.9",
"subtle",
"zeroize",
]
@ -1480,7 +1521,7 @@ dependencies = [
"time",
"tokio",
"tokio-stream",
"tower-http",
"tower-http 0.7.0",
"tracing",
"tracing-subscriber",
"url",
@ -1549,7 +1590,7 @@ dependencies = [
"hive-host-sock",
"hive-priv-sock",
"hive-sh4re",
"hmac",
"hmac 0.13.0",
"indicatif",
"libc",
"listenfd",
@ -1562,7 +1603,7 @@ dependencies = [
"rusqlite",
"serde",
"serde_json",
"sha2",
"sha2 0.11.0",
"tempfile",
"tokio",
"tokio-stream",
@ -1687,7 +1728,7 @@ version = "0.12.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
dependencies = [
"hmac",
"hmac 0.12.1",
]
[[package]]
@ -1696,7 +1737,16 @@ version = "0.12.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
dependencies = [
"digest",
"digest 0.10.7",
]
[[package]]
name = "hmac"
version = "0.13.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
dependencies = [
"digest 0.11.3",
]
[[package]]
@ -2061,14 +2111,14 @@ dependencies = [
[[package]]
name = "indicatif"
version = "0.17.11"
version = "0.18.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
checksum = "9433806cd6b4ec1aba79c021c7e4c58fb4c3b9977c085062e611ac929998fb0c"
dependencies = [
"console",
"number_prefix",
"portable-atomic",
"unicode-width",
"unit-prefix",
"web-time",
]
@ -2471,7 +2521,7 @@ dependencies = [
"serde",
"serde_html_form",
"serde_json",
"sha2",
"sha2 0.10.9",
"tempfile",
"thiserror 2.0.18",
"tokio",
@ -2554,7 +2604,7 @@ dependencies = [
"futures-core",
"futures-util",
"hkdf",
"hmac",
"hmac 0.12.1",
"itertools 0.14.0",
"js_option",
"matrix-sdk-common",
@ -2564,7 +2614,7 @@ dependencies = [
"ruma",
"serde",
"serde_json",
"sha2",
"sha2 0.10.9",
"subtle",
"thiserror 2.0.18",
"time",
@ -2598,7 +2648,7 @@ dependencies = [
"serde",
"serde-wasm-bindgen",
"serde_json",
"sha2",
"sha2 0.10.9",
"thiserror 2.0.18",
"tokio",
"tracing",
@ -2642,13 +2692,13 @@ dependencies = [
"base64",
"blake3",
"chacha20poly1305",
"hmac",
"hmac 0.12.1",
"pbkdf2",
"rand 0.8.7",
"rmp-serde",
"serde",
"serde_json",
"sha2",
"sha2 0.10.9",
"thiserror 2.0.18",
"zeroize",
]
@ -2742,12 +2792,6 @@ dependencies = [
"libc",
]
[[package]]
name = "number_prefix"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
[[package]]
name = "oauth2"
version = "5.0.0"
@ -2763,7 +2807,7 @@ dependencies = [
"serde",
"serde_json",
"serde_path_to_error",
"sha2",
"sha2 0.10.9",
"thiserror 1.0.69",
"url",
]
@ -2907,8 +2951,8 @@ version = "0.12.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
dependencies = [
"digest",
"hmac",
"digest 0.10.7",
"hmac 0.12.1",
]
[[package]]
@ -3457,7 +3501,7 @@ dependencies = [
"tokio-rustls",
"tokio-util",
"tower",
"tower-http",
"tower-http 0.6.11",
"tower-service",
"url",
"wasm-bindgen",
@ -3496,7 +3540,7 @@ dependencies = [
"tokio",
"tokio-rustls",
"tower",
"tower-http",
"tower-http 0.6.11",
"tower-service",
"url",
"wasm-bindgen",
@ -3753,7 +3797,7 @@ dependencies = [
"rand 0.8.7",
"ruma-common",
"serde_json",
"sha2",
"sha2 0.10.9",
"thiserror 2.0.18",
]
@ -4094,7 +4138,7 @@ checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
dependencies = [
"cfg-if",
"cpufeatures 0.2.17",
"digest",
"digest 0.10.7",
]
[[package]]
@ -4105,7 +4149,18 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
dependencies = [
"cfg-if",
"cpufeatures 0.2.17",
"digest",
"digest 0.10.7",
]
[[package]]
name = "sha2"
version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
dependencies = [
"cfg-if",
"cpufeatures 0.3.0",
"digest 0.11.3",
]
[[package]]
@ -4605,6 +4660,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
dependencies = [
"async-compression",
"bitflags",
"bytes",
"futures-core",
"futures-util",
"http",
"http-body",
"http-body-util",
"pin-project-lite",
"tokio",
"tokio-util",
"tower",
"tower-layer",
"tower-service",
"url",
]
[[package]]
name = "tower-http"
version = "0.7.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233"
dependencies = [
"bitflags",
"bytes",
"futures-core",
@ -4620,10 +4697,8 @@ dependencies = [
"pin-project-lite",
"tokio",
"tokio-util",
"tower",
"tower-layer",
"tower-service",
"url",
]
[[package]]
@ -4786,6 +4861,12 @@ version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
[[package]]
name = "unit-prefix"
version = "0.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
[[package]]
name = "universal-hash"
version = "0.5.1"
@ -4884,14 +4965,14 @@ dependencies = [
"ed25519-dalek",
"getrandom 0.2.17",
"hkdf",
"hmac",
"hmac 0.12.1",
"matrix-pickle",
"prost 0.13.5",
"rand 0.8.7",
"serde",
"serde_bytes",
"serde_json",
"sha2",
"sha2 0.10.9",
"subtle",
"thiserror 2.0.18",
"x25519-dalek",
@ -5154,15 +5235,6 @@ dependencies = [
"windows-targets",
]
[[package]]
name = "windows-sys"
version = "0.59.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
dependencies = [
"windows-targets",
]
[[package]]
name = "windows-sys"
version = "0.61.2"

View file

@ -41,13 +41,13 @@ chrono = { version = "0.4", default-features = false, features = [
] }
clap = { version = "4", features = ["derive"] }
clap_complete = "4"
indicatif = "0.17"
indicatif = "0.18"
hive-sh4re = { path = "hive-sh4re" }
hive-claude = { path = "hive-claude" }
hive-host-sock = { path = "hive-host-sock" }
hive-priv-sock = { path = "hive-priv-sock" }
thiserror = "2"
tower-http = { version = "0.6", features = ["fs"] }
tower-http = { version = "0.7", features = ["fs"] }
rmcp = { version = "1.7", default-features = false, features = [
"server",
"macros",
@ -96,5 +96,5 @@ matrix-sdk = { version = "0.14", default-features = false, features = [
"e2e-encryption",
] }
futures-util = "0.3"
hmac = "0.12"
sha2 = "0.10"
hmac = "0.13"
sha2 = "0.11"

View file

@ -66,7 +66,7 @@ fn hex_encode(bytes: &[u8]) -> String {
///
/// Forgejo sends: `sha256=<hex>`.
pub fn verify_signature(secret: &str, body: &[u8], header: &str) -> Result<()> {
use hmac::{Hmac, Mac};
use hmac::{Hmac, KeyInit, Mac};
use sha2::Sha256;
let sig_hex = header