deps(deps): bump the crypto-stack group with 4 updates

[dependabot]

Bumps the crypto-stack group with 4 updates: blake3, aes, cipher and sha2.

Updates blake3 from 1.8.3 to 1.8.5

Release notes

Sourced from blake3's releases.

1.8.5

version 1.8.5

Changes since 1.8.4:

• Forcibly disable LTO when compiling C intrinsics from the Rust build. This fixes a build break on Arch Linux ARM: BLAKE3-team/BLAKE3#550

1.8.4

version 1.8.4

Changes since 1.8.3:

• Updated the digest dependency from v0.10 to v0.11. THIS IS A POTENTIALLY BREAKING CHANGE for callers using the traits-preview Cargo feature. But this is not considered a breaking change for the blake3 crate itself; see the docs for traits-preview.
• Performance for WASM SIMD targets is improved by ~20% when the wasm32_simd feature is enabled. Contributed by @​lamb356.

Commits

• 93a431c version 1.8.5
• 299b1e2 fix LTO builds by disabling LTO
• 6a45fee add LTO builds to CI
• 15e83a5 c: Use correct SIMD flags when compiling with Clang-Cl (#549)
• 2e3727d cargo fmt everywhere
• b97a24f version 1.8.4
• 0ebe469 update to new rustcrypto trait releases
• d4b005a wasm32_simd: use i8x16_shuffle for rot8 and rot16
• 6eebbbd fix a struct size mismatch in tests
• fb1411e c: use SIZE_MAX instead of -1 for size_t sentinels, add <stdint.h>
• See full diff in compare view

Updates aes from 0.8.4 to 0.9.0

Commits

• 001e740 Adopt Trusted Publishing (#552)
• d908618 Release aes v0.9.0 (#539)
• b612904 aes: remove zeroize_works test (#551)
• 042fa86 Update Cargo.lock (#547)
• 7290b2b ci: use Dependabot to update Cargo.lock (#546)
• d1910c1 ci: bump actions/checkout to v6 (#545)
• 1120a51 Bump Clippy to 1.94 and fix clippy::manual_rotate (#544)
• d52b5b6 aes: remove weak key test entry from changelog (#543)
• 6531730 aes: replace aes_compact configuration flag with `aes_backend_soft="compact...
• f102c4f aes: consolidate backend configuration under aes_backend (#541)
• Additional commits viewable in compare view

Updates cipher from 0.4.4 to 0.5.1

Commits

• 3044082 crypto-common: remove BlockSizes trait (#2309)
• e42238d elliptic-curve: enable and fix workspace-level lints (#2308)
• f239f73 aead: remove lints from lib.rs (#2307)
• 7c11746 build(deps): bump the all-deps group across 1 directory with 8 updates (#2305)
• d92139e aead: enable and fix workspace-level lints (#2306)
• 593a0ea digest v0.11.0 (#2300)
• cb66cff elliptic-curve: bump crypto-bigint to v0.7.0-rc.27 (#2303)
• 0d0fdbe digest: use dep: for block-buffer and const-oid (#2302)
• c1a51d4 digest: replace subtle with ctutils (#2301)
• 5802c8f digest v0.11.0-rc.12 (#2299)
• Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

• ffe0939 Release sha2 0.11.0 (#806)
• 8991b65 Use the standard order of the [package] section fields (#807)
• 3d2bc57 sha2: refactor backends (#802)
• faa55fb sha3: bump keccak to v0.2 (#803)
• d3e6489 sha3 v0.11.0-rc.9 (#801)
• bbf6f51 sha2: tweak backend docs (#800)
• 155dbbf sha3: add default value for the DS generic parameter on TurboShake128/256...
• ed514f2 Use published version of keccak v0.2 (#799)
• 702bcd8 Migrate to closure-based keccak (#796)
• 827c043 sha3 v0.11.0-rc.8 (#794)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[augmentcode]

🤖 Augment PR Summary

Summary: This PR updates the workspace crypto dependency set via a Dependabot group bump.

Changes:

• Upgraded blake3 from 1.8.3 → 1.8.5
• Upgraded aes from 0.8.4 → 0.9.0 (major)
• Upgraded cipher from 0.4.4 → 0.5.1 (major)
• Upgraded sha2 from 0.10.9 → 0.11.0 (major)

Technical Notes: The major bumps (aes/cipher/sha2) may require ecosystem version alignment (e.g., shared trait crates like cipher/digest) to keep the encryption + KDF modules compiling and behaving consistently.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

cipher was bumped across a major version; please double-check crates/encryption/src/xts.rs (Xts128::<Aes256> + KeyInit) is still using the same cipher trait version that xts-mode is built against. If xts-mode and aes end up pulling different cipher major versions, Aes256 may no longer satisfy xts-mode’s trait bounds and break encryption/decryption.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

Bumping sha2 to 0.11 likely moves it onto the digest 0.11 trait stack, while hmac remains pinned to 0.12.1; please verify Hmac<Sha256> in crates/encryption/src/keymanager.rs still typechecks with a single digest version. A digest major-version split in the dependency graph commonly causes hard-to-diagnose trait/type incompatibilities in KDF codepaths.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[github-actions]

This PR has merge conflicts. Please rebase on the latest main.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.