[dependabot]

Bumps the cargo-updates group with 2 updates in the / directory: log and sha2.

Updates log from 0.4.34 to 0.4.35

Release notes

Sourced from log's releases.

v0.4.35

This release doesn't include source changes. It verifies log's new CI/CD processes.

Other

• rework CI/CD to align with Rust project standards

Changelog

Sourced from log's changelog.

0.4.35 - 2026-10-30

This release doesn't include source changes. It verifies log's new CI/CD processes.

Other

• rework CI/CD to align with Rust project standards

Commits

• a46450b Update CHANGELOG.md
• a715f17 chore: release v0.4.35
• b4e2b12 Merge pull request #747 from rust-lang/chore/release-plz-mgnt
• 6b490b6 run fmt
• 2c7fd52 simplify some crate release tasks for easier automation
• 5bc5545 Merge pull request #745 from marcoienibot/release-plz-disable-semver-check
• 4234b8c Disable release-plz semver check
• 95918ff Merge pull request #744 from Kobzol/trusted-publishing
• e7ed747 Fix Zizmor lints
• e87a3c6 Setup trusted publishing
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

I reviewed this lockfile bump and didn't find any bugs. sha2 is a crypto dependency, and its 0.11.1 release changes how round constants load on AArch64 (an aarch64-unknown-uefi target here). The repo's CODEOWNERS also covers every path. For those two reasons a human look is still worthwhile.

What was reviewed:

• Cargo.lock: log 0.4.34 -> 0.4.35 and sha2 0.11.0 -> 0.11.1. Both still meet the workspace requirements (log = "0.4.34", sha2 = "0.11.0"), both still come from the crates.io registry, and the sha2 dependency list is unchanged.
• sha2 0.11.1 raises its MSRV to 1.88, which is below the pinned 1.99.1 toolchain.
• Not done here: the fmt/build/clippy runs for both UEFI targets, and checking the new checksums against crates.io. CI has to settle both.

Extended reasoning...

The change touches only Cargo.lock and bumps the patch versions of log and sha2. Both bumps stay within the version requirements in the workspace Cargo.toml. sha2 is used for SHA-256 in crates/parsing and crates/boot, and its new release includes a fix to the AArch64 backend, so this change touches the crypto surface. I deferred rather than approved because the repository's CODEOWNERS file assigns every path to an owner, and the crypto crate update deserves an owner's look.