From 82bd260bd7404f38553a9eb5817085d1f9add868 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 8 Nov 2026 07:16:54 +0000 Subject: [PATCH] chore(encryption): float x448 on the elliptic-curves default branch The x448 dependency was pinned to rev 739304e, the commit `master` of AdaWorldAPI/elliptic-curves currently points at. Consumers (OGAR, report-rs) already take ed448-goldilocks and p256 from the same repository on `master`, so the pin would put a second copy of the curve crates in their graph as soon as `master` moves. Internal AdaWorldAPI pins are prohibited; it now floats. Resolution is unchanged today (branch=master#739304e). cargo test, clippy -D warnings and fmt pass for -p encryption. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01XAqKMMWgnUU9g7Ldyn6sbk --- crates/encryption/Cargo.toml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/crates/encryption/Cargo.toml b/crates/encryption/Cargo.toml index a4f42277..4988dd56 100644 --- a/crates/encryption/Cargo.toml +++ b/crates/encryption/Cargo.toml @@ -24,7 +24,10 @@ ed25519-dalek = { version = "2", default-features = false, features = ["alloc", sha2 = { version = "0.10", default-features = false } # X448 key agreement — AdaWorldAPI fork of RustCrypto/elliptic-curves. No dalek, # and crypto-bigint underneath means no foreign AVX2 for the polyfill to fix. -x448 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "739304e026fdf06cd1a31606e4db487d3f47c5ae", default-features = false } +# Floats on `master` (internal pins are prohibited, 2026-11-08): consumers already take +# `ed448-goldilocks` and `p256` from the same repository on `master`, so a rev here would +# put a second copy of the curve crate in their graph as soon as `master` moved. +x448 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", branch = "master", default-features = false } zeroize = { version = "1", features = ["derive"] } # THE ONLY ENTROPY SOURCE. On wasm32 the `js` feature routes this to