Skip to content

fix(deps): update rust crate sha2 to 0.11.0 #714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
svc-secops wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

fix(deps): update rust crate sha2 to 0.11.0 #714

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion crates/apollo-mcp-rhai/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ reqwest.workspace = true
rhai = { version = "1.24.0", features = ["sync", "serde"] }
rmcp.workspace = true
serde_json.workspace = true
sha2 = "0.10.9"
sha2 = "0.11.0"
Copy link
Copy Markdown

@claude claude bot Mar 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 This PR introduces a dependency version conflict that breaks the workspace build: jsonwebtoken v10.3.0 requires sha2 = "^0.10.7" (i.e., >=0.10.7, <0.11.0), which is incompatible with the sha2 0.11.0 bump here. The Renovate bot's cargo update command already failed with this exact conflict, leaving Cargo.lock unmodified and the workspace in an inconsistent state. This PR cannot be merged until jsonwebtoken is upgraded to a version that supports sha2 0.11.0, or sha2 is kept at a 0.10.x release.

Extended reasoning...

What the bug is and how it manifests

The PR bumps sha2 from 0.10.9 to 0.11.0 in crates/apollo-mcp-rhai/Cargo.toml. However, another workspace dependency, jsonwebtoken v10.3.0 (required by apollo-mcp-server), declares sha2 = "^0.10.7". In Cargo's semver semantics for pre-1.0 crates, ^0.10.7 means >=0.10.7, <0.11.0 — it does not include 0.11.0. This creates an irreconcilable conflict: apollo-mcp-rhai demands sha2 0.11.0, while jsonwebtoken demands sha2 <0.11.0.

The specific code path that triggers it

Cargo's resolver must find a single version of sha2 satisfying both constraints simultaneously. Because the two version requirements are mutually exclusive — one requires exactly 0.11.0 and the other requires <0.11.0 — the resolver fails. This is precisely what the svc-secops bot reported: Renovate ran cargo update --package sha2@0.10.9 --precise 0.11.0, and cargo exited with error: failed to select a version for the requirement sha2 = "^0.10.7".

Why existing code doesn't prevent it

Renovate's automatic dependency-update process does not verify transitive dependency compatibility before opening a PR. The Cargo.lock file was never updated (it still pins sha2 to 0.10.9) because the update command failed. As a result, Cargo.toml and Cargo.lock are now inconsistent: any build using --locked (as is typical in CI) will fail immediately because the lock file doesn't satisfy the manifest.

Impact

Merging this PR as-is will break the workspace build for all consumers. CI pipelines using cargo build --locked or cargo test --locked will fail with the same resolver error. Any downstream release or deployment will be blocked until the conflict is resolved.

How to fix it

Two viable remedies exist: (1) Keep sha2 at a 0.10.x release (e.g., the latest 0.10.x patch) in apollo-mcp-rhai/Cargo.toml until jsonwebtoken is upgraded to a version that depends on sha2 ^0.11. (2) Upgrade jsonwebtoken to a release that declares sha2 = "^0.11" (if one exists), allowing both constraints to be satisfied simultaneously.

Step-by-step proof

  1. crates/apollo-mcp-rhai/Cargo.toml line 19: sha2 = "0.11.0" — pinned to exactly 0.11.0.
  2. crates/apollo-mcp-server/Cargo.toml (workspace): jsonwebtoken = "^10.3", locked to jsonwebtoken v10.3.0.
  3. jsonwebtoken v10.3.0's own Cargo.toml declares sha2 = "^0.10.7" — semver range [0.10.7, 0.11.0).
  4. Cargo resolver must unify: sha2 == 0.11.0 ∩ sha2 ∈ [0.10.7, 0.11.0) = ∅ (empty set).
  5. Result: error: failed to select a version for the requirement sha2 = "^0.10.7", candidate versions found which didn't match: 0.11.0 — exactly as reported by svc-secops bot on 2026-03-28.

tokio.workspace = true
tracing.workspace = true
url.workspace = true
Expand Down
Loading