[dependabot]

Bumps the cargo-updates group with 1 update: sha2.

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

I reviewed this lockfile-only bump and didn't find any bugs. sha2 is the hashing crate used by the boot and parsing crates, and every path in the repo has a code owner, so the owner should still take a look.

What was reviewed:

• Cargo.lock: only sha2's version (0.11.0 to 0.11.1) and checksum change. Its dependency list (cfg-if, cpufeatures, ...) and all other packages are unchanged.
• MSRV: the upstream bump to 1.88 is fine, because rust-toolchain.toml pins 1.99.1.
• I couldn't check the new checksum against the crates.io index from this environment. Cargo will verify it when CI fetches the crate.

Extended reasoning...

The change touches only Cargo.lock, moving the registry crate sha2 to the semver-compatible patch 0.11.1 with a new checksum and no change to its dependencies. sha2 is a cryptographic dependency used by crates/boot and crates/parsing, and the upstream release includes a fix to AArch64 round-constant loading, which matters for the aarch64-unknown-uefi target. .github/CODEOWNERS assigns every path to a code owner, so this can't be auto-approved. No source or manifest files change.

[dependabot]

Looks like sha2 is updatable in another way, so this is no longer needed.