chore(deps): bump sha2 from 0.10.9 to 0.11.0

[dependabot]

Bumps sha2 from 0.10.9 to 0.11.0.

Commits

• ffe0939 Release sha2 0.11.0 (#806)
• 8991b65 Use the standard order of the [package] section fields (#807)
• 3d2bc57 sha2: refactor backends (#802)
• faa55fb sha3: bump keccak to v0.2 (#803)
• d3e6489 sha3 v0.11.0-rc.9 (#801)
• bbf6f51 sha2: tweak backend docs (#800)
• 155dbbf sha3: add default value for the DS generic parameter on TurboShake128/256...
• ed514f2 Use published version of keccak v0.2 (#799)
• 702bcd8 Migrate to closure-based keccak (#796)
• 827c043 sha3 v0.11.0-rc.8 (#794)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 62be4d17-e52c-4dd5-a8ef-5728ad411d36

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[senamakel]

Dependency update verified: Rust SDK checks are green.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 1 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: medium
Reviewed head: 92c70454cc8a
Updated: 1789842667 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	5	Active findings	1
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• medium · critique · Gate hex behind the host and store features — `hex` is used only by `caps::host` and `store`, but this declaration makes it a dependency of every default `tinyflows` build. That bypasses the repository rule that host/store fun (crates/tinyflows/Cargo\.toml:38)

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 7 files; 1 finding. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: crates/tinyflows/Cargo\.toml — Gate hex behind the host and store features

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 7 files; 0 findings. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This pull request bumps the `sha2` dependency from 0.10 to 0.11, adds the `hex` crate, and replaces `format!("{:x}", ...)` calls with `hex::encode(...)` in five files. The behaviour is unchanged; this is a pure refactoring of hex-encoded output. No test changes are needed because no new logic, branches, or public APIs are introduced. The change is safe to merge. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Updates sha2 to 0.11 and adapts hash output formatting using the hex crate. The code changes are correct, but the new hex dependency should be optional and gated behind the features that use it. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This pull request replaces `format!("{:x}", ...)` with `hex::encode(...)` across five internal helper functions and bumps the `sha2` dependency from 0.10 to 0.11. The external behaviour of every changed function is identical — all produce the same lowercase hex digest string. No new routes, commands, flags, screens, persisted formats, or messages are introduced, and no existing end-to-end test is weakened. The change is a pure internal refactor with no external surface, so no end-to-end coverage is required. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

Evidence and run details

• Models: gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.008717
• Tokens: 170084 input · 15173 output · 17548 cached · 0 embedding

Head	State	Pass summary
92c70454cc8a	ready for maintainer review	1 active finding(s), 0 resolved finding(s) (at 1789842667)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0087 · 170,084 in / 15,173 out · 17,548 cached (10%) · gpt-5.6-luna, deepseek-v4-flash
critique:    $0.0042 · 78,612 in  / 3,465 out  · 8,103 cached (10%)  · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0037 · 63,424 in  / 2,654 out  · 5,349 cached (8%)   · gpt-5.6-luna
tests:       $0.0002 · 7,898 in   / 2,096 out  · 1,536 cached (19%)  · deepseek-v4-flash
description: $0.0002 · 8,273 in   / 3,040 out  · 1,024 cached (12%)  · deepseek-v4-flash
e2e:         $0.0002 · 8,706 in   / 631 out    · 1,536 cached (18%)  · deepseek-v4-flash

[tinysweeper]

Gate hex behind the host and store features

hex is used only by caps::host and store, but this declaration makes it a dependency of every default tinyflows build. That bypasses the repository rule that host/store functionality and their dependencies remain behind default-off features, and forces the engine to resolve and compile an otherwise unused dependency. Make hex optional and add dep:hex to each feature that uses it (host-caps and store).

[RULE] feature-gating ·