[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
blake2	dependencies	minor	0.10 → 0.11

---

Release Notes

RustCrypto/hashes (blake2)

v0.11.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 1 suggested fix.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:30

---

### [1/1] Cargo.toml:30
Issue identified during code review:
Build break in Cargo.toml: bumping blake2 to 0.11 pulls in digest 0.11, which moves `new_from_slice` from the `Mac` trait to `KeyInit`, but src/keys.rs:11-12 still imports only `blake2::digest::Mac` while src/keys.rs:173 calls `Blake2bMac::<U32>::new_from_slice(&self.0)`. When the crate builds against 0.11, `new_from_slice` fails to resolve and compilation stops; if 0.11 also rejects the 32-byte key, the `unreachable!` at src/keys.rs:174 panics on every value_key call. Fix: import `blake2::digest::KeyInit` alongside `Mac`, confirm that `cargo build` and the key-derivation tests pass with 0.11, or keep the dependency at 0.10.
Reference implementation (from code review):

// Cargo.toml:30
blake2 = "0.11"
# and in src/keys.rs:
# use blake2::digest::{consts::U32, KeyInit, Mac};

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[kodus-27b]

WHAT: The blake2 dependency is bumped from 0.10 to 0.11 in Cargo.toml.
WHY: Dependency changes need supply-chain review. A minor-version jump in a 0.x crate is semver-breaking. blake2 0.11 has mostly shipped as pre-release (rc) versions, and the plain "0.11" requirement will not match pre-releases. It may also pull in new digest/crypto-common transitive versions that conflict with cachekit-core/cachekit-rs.
HOW: Run cargo audit (RustSec/OSV) against the new version and attach the output to the PR. Confirm that a stable 0.11.x release resolves. Commit the updated Cargo.lock. Verify that transitive digest versions stay compatible with the other crypto dependencies.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 30:

WHAT: The blake2 dependency is bumped from 0.10 to 0.11 in Cargo.toml.
WHY: Dependency changes need supply-chain review. A minor-version jump in a 0.x crate is semver-breaking. blake2 0.11 has mostly shipped as pre-release (rc) versions, and the plain "0.11" requirement will not match pre-releases. It may also pull in new digest/crypto-common transitive versions that conflict with cachekit-core/cachekit-rs.
HOW: Run `cargo audit` (RustSec/OSV) against the new version and attach the output to the PR. Confirm that a stable 0.11.x release resolves. Commit the updated Cargo.lock. Verify that transitive digest versions stay compatible with the other crypto dependencies.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Unvalidated dependency upgrade in Cargo.toml: the change bumps blake2 from 0.10 to the semver-incompatible 0.11 without supply-chain validation of the crate or its new transitive dependencies, such as updated digest and crypto-common. If blake2 0.11 or one of those transitive crates resolves to an rc pre-release or carries a known advisory, it ships unreviewed into the cryptographic hashing path. Fix: run cargo audit and cargo deny check (or an OSV query) against blake2 0.11 and its new transitive dependencies, attach the output to the PR description, confirm the version resolves to a stable release rather than an rc, and commit the matching Cargo.lock update.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 30:

Unvalidated dependency upgrade in Cargo.toml: the change bumps blake2 from 0.10 to the semver-incompatible 0.11 without supply-chain validation of the crate or its new transitive dependencies, such as updated digest and crypto-common. If blake2 0.11 or one of those transitive crates resolves to an rc pre-release or carries a known advisory, it ships unreviewed into the cryptographic hashing path. Fix: run `cargo audit` and `cargo deny check` (or an OSV query) against blake2 0.11 and its new transitive dependencies, attach the output to the PR description, confirm the version resolves to a stable release rather than an rc, and commit the matching Cargo.lock update.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.