chore(deps): bump sha2 from 0.10.9 to 0.11.1

crates/browser-session/Cargo.toml

@@ -21,7 +21,7 @@ argon2 = "0.6"
 base64 = "0.22"
 rand = "0.10"
 serde_json = "1"
-sha2 = "0.10"
+sha2 = "0.11"
 hex = "0.4"
 zeroize = "1"
 clap = { version = "4", features = ["derive"], optional = true }

crates/core/Cargo.toml

@@ -6,8 +6,8 @@ license-file = "../../LICENSE"
 
 [dependencies]
 schemars = { version = "1", optional = true }
-hmac = "0.12"
-sha2 = "0.10"
+hmac = "0.13"
+sha2 = "0.11"
 subtle = "2"
 getrandom = "0.4"
 base64 = "0.22"

crates/core/src/auth.rs

@@ -3,7 +3,7 @@
 /// Token format: `exp:nonce:sig`
 /// where `sig = base64url_nopad(HMAC_SHA256(secret, "exp:nonce"))`.
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use sha2::Sha256;
 use subtle::ConstantTimeEq;
 

crates/core/src/runner_auth.rs

@@ -20,7 +20,7 @@
 //! [`MAX_SKEW_SECS`] of its own clock, so a captured request cannot be
 //! replayed or altered.
 
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq;
 

crates/mcp/Cargo.toml

@@ -50,7 +50,7 @@ libc = "0.2"
 base64 = "0.22"
 
 # Registry checksums (flow update verifies every file against index.json)
-sha2 = "0.10"
+sha2 = "0.11"
 hex = "0.4"
 
 # `flow publish` clones the registry into a scratch directory

crates/mcp/src/task.rs

@@ -369,7 +369,7 @@ pub fn start(
     }
     use sha2::{Digest, Sha256};
     // Keep only the digest; model keys and return parameters are never exposed.
-    let request_fingerprint = format!("{:x}", Sha256::digest(format!("{request:?}").as_bytes()));
+    let request_fingerprint = hex::encode(Sha256::digest(format!("{request:?}").as_bytes()));
     let id = new_id();
     let task = Arc::new(Task {
         state: Mutex::new(State {
@@ -1496,7 +1496,7 @@ mod tests {
     async fn request_id_deduplicates_and_pause_is_nonterminal() {
         let request=TaskRequest {goal:"synthetic goal".into(),client_request_id:Some("fixture-client".into()),..Default::default()};
         use sha2::{Digest, Sha256};
-        let request_fingerprint=format!("{:x}",Sha256::digest(format!("{request:?}").as_bytes()));
+        let request_fingerprint=hex::encode(Sha256::digest(format!("{request:?}").as_bytes()));
         let task=Arc::new(Task {
             state: Mutex::new(State {request_fingerprint,id:"fixture-dedup".into(),goal:"synthetic goal".into(),client_request_id:Some("fixture-client".into()),status:Status::Running,phase:"observing",planned_action:None,flow:None,steps:vec![],confirm:None,summary:None,error:None,started_at_ms:unix_ms(),started:Instant::now(),finished_ms:None,models_used:json!({})}),
             cancel:AtomicBool::new(false),paused:AtomicBool::new(false),cancel_signal:tokio::sync::Notify::new(),answer:Mutex::new(None),

crates/server/Cargo.toml

@@ -57,7 +57,8 @@ tempfile = "3"
 
 # runner (L2 element-tree control): screenshots arrive base64-encoded.
 base64 = "0.22"
-sha2 = "0.10"
+sha2 = "0.11"
+hex = "0.4"
 # ES256 tokens for the App Store Connect API (legacy iOS signing) and the
 # SHA-1 codesign takes; already in the tree through rustls.
 ring = "0.17"

crates/server/src/setup/embed.rs

@@ -170,9 +170,17 @@ fn usable(path: &Path) -> Result<EmbedLib, String> {
 }
 
 fn file_sha256(path: &Path) -> Option<String> {
+    use std::io::Read;
     let mut file = std::fs::File::open(path).ok()?;
     let mut digest = Sha256::new();
-    std::io::copy(&mut file, &mut digest).ok()?;
+    let mut buf = vec![0u8; 64 * 1024];
+    loop {
+        let n = file.read(&mut buf).ok()?;
+        if n == 0 {
+            break;
+        }
+        digest.update(&buf[..n]);
+    }
     Some(
         digest
             .finalize()
@@ -322,7 +330,7 @@ mod tests {
         );
         assert_eq!(
             cache_component(Some(&first)),
-            format!("embed:{:x}", Sha256::digest(b"one"))
+            format!("embed:{}", hex::encode(Sha256::digest(b"one")))
         );
         assert_eq!(cache_component(None), "embed:none");
         assert_eq!(

crates/server/src/setup/runner.rs

@@ -1481,7 +1481,7 @@ mod tests {
             std::fs::write(&path, bytes).unwrap();
             super::super::embed::EmbedLib {
                 path: path.clone(),
-                sha256: format!("{:x}", <sha2::Sha256 as sha2::Digest>::digest(bytes)),
+                sha256: hex::encode(<sha2::Sha256 as sha2::Digest>::digest(bytes)),
             }
         };
         let component = super::super::embed::cache_component;