[dependabot]

Bumps sha2 from 0.10.9 to 0.11.1.

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sionsmith]

Verified. sha2 is used only for the PKCE S256 code challenge in browser login (src/auth/auth_code_pkce.rs). That code compiles unchanged on 0.11: finalize() now returns a hybrid-array Array, which still implements AsRef<[u8]> for base64. sha2 0.11.1 needs Rust 1.88, which the rust-version = "1.89" set in #128 covers.

Extended: nothing pinned the challenge to a known answer, so a hashing or encoding regression would only have shown up as failed logins. I factored out s256_challenge and added two tests: one against the RFC 7636 Appendix B vector (dBjftJeZ… → E9Melhoa…), and one on the shape of a generated verifier (43 unreserved characters). Both pass on 0.10.9 (main) and on 0.11.1, which confirms the output is identical. I also added a CHANGELOG entry. Locally, fmt, clippy -D warnings, the full test suite and cargo audit all pass, and CI is green.