[dependabot]

Bumps github.com/apple/swift-crypto from 4.5.2 to 5.0.1.

Release notes

Sourced from github.com/apple/swift-crypto's releases.

5.0.1

What's Changed

SemVer Patch

• Fix compact representability for points above the field midpoint by @​simonjbeaumont in apple/swift-crypto#477
• Make ARC presentation verification cost independent of the nonce by @​simonjbeaumont in apple/swift-crypto#478
• Require compressed encoding when deserializing OPRF elements by @​simonjbeaumont in apple/swift-crypto#479

Other Changes

• Housekeeping: replace repo-level CODE_OF_CONDUCT by @​apple-ospo[bot] in apple/swift-crypto#476

New Contributors

• @​apple-ospo[bot] made their first contribution in apple/swift-crypto#476

Full Changelog: apple/swift-crypto@5.0.0...5.0.1

5.0.0

Swift Crypto 5.0 Release Notes

Swift Crypto 5.0 aligns the cross-platform API surface with CryptoKit as shipped in Xcode 27 (CryptoKit-383.2.1), and takes the opportunity to streamline the package for both adopters and maintainers.

Most users will be able to depend on the 1.0.0, 2.0.0, 3.0.0, 4.0.0, or 5.0.0 series of releases.

To do so, please use the following dependency in your Package.swift:

.package(url: "https://github.com/apple/swift-crypto.git", "1.0.0" ..< "6.0.0"),

Requires Swift 6.2

The package now declares 6.2 as the minimum Swift version in its package manifest.

New span-based API

CryptoKit's new non-allocating, span-based entry points are now available cross-platform:

• SymmetricKey gains bytes: RawSpan, init(copying: RawSpan), init(copyingWithZeroing: inout MutableRawSpan), and init(size:initializingWith:) which initializes the key through an inout OutputRawSpan.
• HashFunction gains update(bytes: RawSpan) and hash(bytes: RawSpan), and Digest gains init?(copying: RawSpan).
• HMAC gains authenticationCode(for: RawSpan, using:).
• HKDF gains deriveKey(inputKeyMaterial:salt:info:output:) writing into an inout OutputRawSpan, along with span-based extract and expand. The existing DataProtocol overload now has a fast path for contiguous salt and info.
• AES.GCM and ChaChaPoly gain in-place seal(inPlace:using:nonce:authenticating:tag:) and open(inPlace:using:nonce:authenticating:tag:) over MutableRawSpan, and their Nonce types gain bytes: RawSpan and init(copying: RawSpan).

Single-use KEM keys

A new KEMOneTimePrivateKey protocol, refining ~Copyable and Sendable, provides a consuming func decapsulate(_:) so a decapsulation key cannot be reused. Conforming types are MLKEM768.OneTimePrivateKey, MLKEM1024.OneTimePrivateKey, and XWingMLKEM768X25519.OneTimePrivateKey.

Extensible enums

Historically Swift Crypto needed a new major version each time CryptoKit added a case to a non-frozen enum, because Swift Crypto is not built with library evolution. All public non-frozen enums are now marked @nonexhaustive (SE-0487), which should remove that reason for future major bumps. Adopters who do not switch over these enums should not need to widen their version constraints again.

... (truncated)

Commits

• 1c80d3a Require compressed encoding when deserializing OPRF elements (#479)
• 25847ff Make ARC presentation verification cost independent of the nonce (#478)
• 8c018d0 Fix compact representability for points above the field midpoint (#477)
• a629920 Housekeeping: replace repo-level CODE_OF_CONDUCT (#476)
• a9d1d5a Merge the 5.x branch for the Swift Crypto 5.0 release (#470)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps github.com/apple/swift-crypto from 4.5.2 to 5.0.1 in the Swift package.

This major update requires Swift 6.2 and aligns the API with CryptoKit from Xcode 27, adding span-based entry points and single-use KEM keys. Non-frozen enums are now @nonexhaustive, which should reduce the need for future major version bumps.

^{Written for commit 9ea8b5e. Summary will update on new commits.}

[Copilot]

🟡 Changes recommended

Swift Crypto 5.0.1 requires Swift 6.2, preventing dependency resolution on the SDK’s declared older toolchains.

1 open issue

• Allow Crypto 4.x for Swift 6.0 and 6.1 compatibility · New

What changed in this PR

Updates the Swift SDK’s Swift Crypto dependency to the 5.x release series.

Changes:

• Raises the minimum dependency version from 4.3.1 to 5.0.1.
• Leaves the SDK’s declared Swift tools minimum at 6.0.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
swift/​Package.swift	Raises the Swift Crypto dependency requirement to 5.0.1.

_{Review effort: Balanced}