[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
aes-gcm	dev-dependencies	minor	0.10 → 0.11

---

Release Notes

RustCrypto/AEADs (aes-gcm)

v0.11.1

Compare Source

v0.11.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 2 suggested fixes.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:43
- Cargo.toml:43

---

### [1/2] Cargo.toml:43
Issue identified during code review:
Unverified dependency bump in Cargo.toml: the aes-gcm dev-dependency moves from 0.10 to 0.11, a semver-breaking bump of a crypto crate, with no evidence that a stable 0.11.x release exists, that it has no CVE or advisory, or that Cargo.lock was updated to match. If only 0.11 release candidates are published or Cargo.lock still pins 0.10, `cargo ... --locked` in CI fails to resolve the dependency. Fix: run `cargo audit` or query OSV for aes-gcm 0.11 and paste the output in the PR description, pin the exact stable 0.11.x version, and commit the updated Cargo.lock.

---

### [2/2] Cargo.toml:43
Issue identified during code review:
API break in the aes-gcm 0.11 bump (Cargo.toml:43): aes-gcm 0.11 (aead 0.6) moves `Nonce` from generic-array to hybrid-array 0.4, but the test reader in src/store.rs:363 still calls the generic-array-style `Nonce::from_slice(nonce)`. When hybrid-array deprecates `from_slice`, `cargo clippy --locked --all-targets -- -D warnings` in CI promotes the deprecation warning to an error and the test target fails to build. Fix: in src/store.rs, replace the call with `&Nonce::try_from(nonce).unwrap()` or `<&Nonce>::try_from(nonce)`.
Reference implementation (from code review):

// Cargo.toml:43
aes-gcm = "0.11"
# and in src/store.rs frozen::open:
# .decrypt(&Nonce::try_from(nonce).ok()?, Payload { msg: sealed, aad: &aad })

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Unresolvable dependency requirement in Cargo.toml: the dev-dependency aes-gcm is bumped from 0.10 to 0.11, but 0.11 has mostly been published as pre-release (rc) versions, and Cargo's plain 0.11 requirement does not match those. If no stable 0.11.x release exists, cargo test fails to resolve aes-gcm; if one does resolve, the 0.x minor bump can change the cryptographic APIs and pull in new transitive crates such as aead and cipher without any audit evidence. Fix: pin a confirmed stable 0.11.x release explicitly, commit the updated Cargo.lock, and attach cargo audit (or OSV/SCA) output to the PR description.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 44:

Unresolvable dependency requirement in Cargo.toml: the dev-dependency `aes-gcm` is bumped from 0.10 to 0.11, but 0.11 has mostly been published as pre-release (rc) versions, and Cargo's plain `0.11` requirement does not match those. If no stable 0.11.x release exists, `cargo test` fails to resolve `aes-gcm`; if one does resolve, the 0.x minor bump can change the cryptographic APIs and pull in new transitive crates such as `aead` and `cipher` without any audit evidence. Fix: pin a confirmed stable 0.11.x release explicitly, commit the updated Cargo.lock, and attach `cargo audit` (or OSV/SCA) output to the PR description.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.