From aa637acf31031e62eabe1d49bb863b6229c63bcd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 16:19:52 +0000
Subject: [PATCH] chore(deps): bump sha3 from 0.11.0 to 0.12.0

Bumps [sha3](https://github.com/RustCrypto/hashes) from 0.11.0 to 0.12.0.
- [Commits](https://github.com/RustCrypto/hashes/compare/sha3-v0.11.0...sha3-v0.12.0)

---
updated-dependencies:
- dependency-name: sha3
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock | 24 ++++++++++++++++++++++--
 Cargo.toml |  2 +-
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 578a161..80735e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -502,7 +502,7 @@ dependencies = [
  "module-lattice",
  "pkcs8",
  "rand_core 0.10.1",
- "sha3",
+ "sha3 0.11.0",
  "zeroize",
 ]
 
@@ -806,6 +806,17 @@ dependencies = [
  "keccak",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
+dependencies = [
+ "digest",
+ "keccak",
+ "sponge-cursor",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -850,7 +861,7 @@ dependencies = [
  "serde_bytes",
  "serde_json",
  "sha2",
- "sha3",
+ "sha3 0.12.0",
  "snafu",
  "subtle",
  "toml",
@@ -868,6 +879,15 @@ dependencies = [
  "der",
 ]
 
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+dependencies = [
+ "zeroize",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
diff --git a/Cargo.toml b/Cargo.toml
index 43b8187..fcbe133 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -77,7 +77,7 @@ ciborium = "0.2" # kanon:ignore TOML/missing-workspace-inheritance -- standalone
 serde_bytes = "0.11" # kanon:ignore TOML/missing-workspace-inheritance -- standalone [package], no workspace ancestor (kanon#3088)
 # WHY: sha3 0.11 (ml-kem's own digest generation) — its `zeroize` feature wipes
 # hasher + XOF-reader state on drop; 0.10 offers no digest-state zeroization.
-sha3 = { version = "0.11", features = ["zeroize"], optional = true }
+sha3 = { version = "0.12", features = ["zeroize"], optional = true }
 # WHY: sha2 0.11 `zeroize` wipes Sha256 core state + block buffers on drop
 # (digest 0.11 generation, shared with sha3 0.11 / ml-kem); hkdf 0.13 + its
 # hmac 0.13 drop-cascade through those impls, so the HKDF PRK-keyed HMAC state