[dependabot]

Bumps github.com/apple/swift-crypto from 4.5.2 to 5.0.0.

Release notes

Sourced from github.com/apple/swift-crypto's releases.

5.0.0

Swift Crypto 5.0 Release Notes

Swift Crypto 5.0 aligns the cross-platform API surface with CryptoKit as shipped in Xcode 27 (CryptoKit-383.2.1), and takes the opportunity to streamline the package for both adopters and maintainers.

Most users will be able to depend on the 1.0.0, 2.0.0, 3.0.0, 4.0.0, or 5.0.0 series of releases.

To do so, please use the following dependency in your Package.swift:

.package(url: "https://github.com/apple/swift-crypto.git", "1.0.0" ..< "6.0.0"),

Requires Swift 6.2

The package now declares 6.2 as the minimum Swift version in its package manifest.

New span-based API

CryptoKit's new non-allocating, span-based entry points are now available cross-platform:

• SymmetricKey gains bytes: RawSpan, init(copying: RawSpan), init(copyingWithZeroing: inout MutableRawSpan), and init(size:initializingWith:) which initializes the key through an inout OutputRawSpan.
• HashFunction gains update(bytes: RawSpan) and hash(bytes: RawSpan), and Digest gains init?(copying: RawSpan).
• HMAC gains authenticationCode(for: RawSpan, using:).
• HKDF gains deriveKey(inputKeyMaterial:salt:info:output:) writing into an inout OutputRawSpan, along with span-based extract and expand. The existing DataProtocol overload now has a fast path for contiguous salt and info.
• AES.GCM and ChaChaPoly gain in-place seal(inPlace:using:nonce:authenticating:tag:) and open(inPlace:using:nonce:authenticating:tag:) over MutableRawSpan, and their Nonce types gain bytes: RawSpan and init(copying: RawSpan).

Single-use KEM keys

A new KEMOneTimePrivateKey protocol, refining ~Copyable and Sendable, provides a consuming func decapsulate(_:) so a decapsulation key cannot be reused. Conforming types are MLKEM768.OneTimePrivateKey, MLKEM1024.OneTimePrivateKey, and XWingMLKEM768X25519.OneTimePrivateKey.

Extensible enums

Historically Swift Crypto needed a new major version each time CryptoKit added a case to a non-frozen enum, because Swift Crypto is not built with library evolution. All public non-frozen enums are now marked @nonexhaustive (SE-0487), which should remove that reason for future major bumps. Adopters who do not switch over these enums should not need to widen their version constraints again.

Other changes

• Symbols that were previously marked @_spi(...) public have been made internal; they were never intended to be available.
• @available annotations have been removed from Crypto; they are unused in all supported compilation modes.
• Some internal reference types are now marked final
• Some unused code, e.g. ECDSASignature.derBytes, is removed.

Build and packaging

• The CCryptoBoringSSLShims target is removed, along with all bindMemory(to:) calls.
• The .gyb templates for nonces, digests, ECDH, ECDSA, MLDSA, and MLKEM are removed and the generated Swift is checked in. The BoringSSL backend templates for MLDSA and MLKEM remain.
• Conditional compilation is simplified to #if canImport(CryptoKit); branches that could never be taken are gone.
• Developing the BoringSSL backend on macOS is no longer supported. Use the Dev Container configuration now shipped in the repository, or build on the target platform.
• Warnings are silenced for vendored C sources: -Wshorten-64-to-32 for BoringSSL and macro-redefined for XKCP. CI builds with -warnings-as-errors.

... (truncated)

Commits

• a9d1d5a Merge the 5.x branch for the Swift Crypto 5.0 release (#470)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Updates swift-crypto from 4.5.2 to 5.0.0 in the Swift package. This major release adds span-based and one-time KEM key APIs, but now requires Swift 6.2 as the minimum version.

^{Written for commit 143a93c. Summary will update on new commits.}

[Copilot]

Copilot review overview

🟡 Changes recommended

The dependency requires Swift 6.2, while the package and contributor documentation still advertise Swift 6.0 compatibility.

Review effort: Balanced
Findings: 1

Open (1)

• Dependency requires Swift 6.2 despite package supporting Swift 6.0+ · New

What changed in this PR

Updates Swift Crypto from 4.x to 5.0.0.

Changes:

• Raises the Swift Crypto dependency to 5.0.0.
• Introduces an effective Swift 6.2 minimum requirement.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
swift/​Package.swift	Updates the Swift Crypto dependency constraint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dependabot]

Superseded by #220.