From 3218a3d621afe2351baf6a3dcf89a1891a6e0479 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 06:54:53 +0000 Subject: [PATCH 1/3] deps: bump sha2 from 0.10.9 to 0.11.1 Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.9 to 0.11.1. - [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.10.9...sha2-v0.11.1) --- updated-dependencies: - dependency-name: sha2 dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Cargo.lock | 70 +++++++++++++++++++++++------------------------------- Cargo.toml | 2 +- 2 files changed, 31 insertions(+), 41 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 523dfe0..e8b96d6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -151,11 +151,11 @@ checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af" [[package]] name = "block-buffer" -version = "0.10.4" +version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" +checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" dependencies = [ - "generic-array", + "hybrid-array", ] [[package]] @@ -216,7 +216,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", - "cpufeatures 0.3.1", + "cpufeatures", "rand_core", ] @@ -339,6 +339,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "const-oid" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" + [[package]] name = "core-foundation" version = "0.9.4" @@ -365,15 +371,6 @@ version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" -[[package]] -name = "cpufeatures" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] - [[package]] name = "cpufeatures" version = "0.3.1" @@ -417,12 +414,11 @@ dependencies = [ [[package]] name = "crypto-common" -version = "0.1.7" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" +checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ - "generic-array", - "typenum", + "hybrid-array", ] [[package]] @@ -451,11 +447,12 @@ checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8" [[package]] name = "digest" -version = "0.10.7" +version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ "block-buffer", + "const-oid", "crypto-common", ] @@ -672,16 +669,6 @@ dependencies = [ "slab", ] -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - [[package]] name = "getrandom" version = "0.2.17" @@ -814,6 +801,15 @@ version = "1.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9" +[[package]] +name = "hybrid-array" +version = "0.4.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17" +dependencies = [ + "typenum", +] + [[package]] name = "hyper" version = "1.12.0" @@ -1874,12 +1870,12 @@ dependencies = [ [[package]] name = "sha2" -version = "0.10.9" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" +checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19" dependencies = [ "cfg-if", - "cpufeatures 0.2.17", + "cpufeatures", "digest", ] @@ -2346,9 +2342,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "typenum" -version = "1.19.0" +version = "1.20.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb" +checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" [[package]] name = "unicase" @@ -2439,12 +2435,6 @@ version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65" -[[package]] -name = "version_check" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" - [[package]] name = "wait-timeout" version = "0.2.1" diff --git a/Cargo.toml b/Cargo.toml index 28dd885..23b96ca 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -26,7 +26,7 @@ serde_json = "1" toml = "1.1" toml_edit = "0.25" keyring = { version = "3", features = ["apple-native", "linux-native", "windows-native"] } -sha2 = "0.10" +sha2 = "0.11" base64 = "0.23" getrandom = "0.3" hyper = { version = "1", features = ["server", "http1"] } From f6025fa6e0654c64eca1c8d04d5bebb7e845d6a6 Mon Sep 17 00:00:00 2001 From: Sion Smith Date: Mon, 26 Oct 2026 21:19:22 +0000 Subject: [PATCH 2/3] test: pin the PKCE S256 challenge to the RFC 7636 example sha2 is used only for the PKCE code challenge, and nothing checked its output, so a hashing or encoding change across the 0.10 -> 0.11 bump would only show up as failed browser logins. Factor the challenge into s256_challenge and test it against RFC 7636 Appendix B, plus the shape of a generated verifier. Passes on sha2 0.10.9 and 0.11.1. Co-Authored-By: Claude Opus 5.5 --- src/auth/auth_code_pkce.rs | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/src/auth/auth_code_pkce.rs b/src/auth/auth_code_pkce.rs index 64c93d4..7287dec 100644 --- a/src/auth/auth_code_pkce.rs +++ b/src/auth/auth_code_pkce.rs @@ -20,12 +20,16 @@ fn random_urlsafe_bytes(len: usize) -> Result { fn generate_pkce() -> Result<(String, String)> { let verifier = random_urlsafe_bytes(32)?; + let challenge = s256_challenge(&verifier); + Ok((verifier, challenge)) +} + +/// The S256 code challenge for a verifier (RFC 7636 section 4.2). +fn s256_challenge(verifier: &str) -> String { let mut hasher = Sha256::new(); hasher.update(verifier.as_bytes()); - let challenge = URL_SAFE_NO_PAD.encode(hasher.finalize()); - - Ok((verifier, challenge)) + URL_SAFE_NO_PAD.encode(hasher.finalize()) } /// Build the authorization URL for the browser login. @@ -212,6 +216,26 @@ mod tests { assert!(url.contains("&code_challenge_method=S256")); } + #[test] + fn s256_challenge_matches_rfc7636_example() { + // RFC 7636 Appendix B. + assert_eq!( + s256_challenge("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"), + "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" + ); + } + + #[test] + fn generated_verifier_is_43_unreserved_chars() { + let (verifier, challenge) = generate_pkce().unwrap(); + + assert_eq!(verifier.len(), 43); + assert!(verifier + .chars() + .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_')); + assert_eq!(challenge, s256_challenge(&verifier)); + } + #[test] fn authorize_url_forces_account_picker() { let url = build_authorize_url("client-1", "tenant-1", "User.Read", "s", "c"); From 7d657046982faad57866043aade640abfdf48688 Mon Sep 17 00:00:00 2001 From: Sion Smith Date: Mon, 26 Oct 2026 21:21:14 +0000 Subject: [PATCH 3/3] docs: CHANGELOG entry for sha2 0.11 Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index caad2aa..8e6a241 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ ### Changed - Updated Rust dependencies (`tokio` 1.54.1, `serde_json` 1.0.154, `uuid` 1.28.0, `webbrowser` 1.2.5) and the CI and release workflows' `Swatinem/rust-cache` pin to v2.9.3. `rust-version` in `Cargo.toml` is now 1.89, the oldest Rust the dependencies build with; it said 1.75. +- Updated `sha2` to 0.11.1 (it computes the PKCE code challenge for browser login). The challenge is now unit-tested against the RFC 7636 example, so a hashing or encoding change cannot slip through as failed logins. ### Fixed