From a5c28a3ecde095e7c82719d32f49a882ef0145dd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:21:14 +0000 Subject: [PATCH 1/2] Bump the dev-dependencies group in /hofmann-typescript with 3 updates Bumps the dev-dependencies group in /hofmann-typescript with 3 updates: [@noble/curves](https://github.com/paulmillr/noble-curves), [@noble/hashes](https://github.com/paulmillr/noble-hashes) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Updates `@noble/curves` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/paulmillr/noble-curves/releases) - [Changelog](https://github.com/paulmillr/noble-curves/blob/main/CHANGELOG.md) - [Commits](https://github.com/paulmillr/noble-curves/compare/2.3.0...2.4.0) Updates `@noble/hashes` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/paulmillr/noble-hashes/releases) - [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md) - [Commits](https://github.com/paulmillr/noble-hashes/compare/2.3.0...2.4.0) Updates `@types/node` from 26.2.0 to 26.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@noble/curves" dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@noble/hashes" dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] --- hofmann-typescript/package-lock.json | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/hofmann-typescript/package-lock.json b/hofmann-typescript/package-lock.json index 9ea0661..fe1c39e 100644 --- a/hofmann-typescript/package-lock.json +++ b/hofmann-typescript/package-lock.json @@ -72,12 +72,12 @@ } }, "node_modules/@noble/curves": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-2.3.0.tgz", - "integrity": "sha512-v7cY+4oWYPQszRj6ZFGzTVL7uP2TaLo1xMhWHzYC5wj0ZhOXQ5x+sBre8rF3hi8cAoi0bh1qXoovoOkdFtvqEg==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-2.4.0.tgz", + "integrity": "sha512-P4/62zrgfH33CneE3Dn4WhJVA22YUU0eR51wKIan4NVRvwsA0YnPTwWGpNbpuacSujmSFLvyzpyuR30+fbq2Ew==", "license": "MIT", "dependencies": { - "@noble/hashes": "2.3.0" + "@noble/hashes": "2.4.0" }, "engines": { "node": ">= 20.19.0" @@ -87,9 +87,9 @@ } }, "node_modules/@noble/hashes": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.3.0.tgz", - "integrity": "sha512-oN+QwyX7VSHotibwubG3kpzbwKrfnyR6OOO+3Nk/53ADL7FmgHHz4TgrbaYKvvOw09u6QTx0oiH1cNCIOuN0CQ==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz", + "integrity": "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==", "license": "MIT", "engines": { "node": ">= 20.19.0" @@ -444,9 +444,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.2.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz", - "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==", + "version": "26.4.0", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz", + "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==", "dev": true, "license": "MIT", "dependencies": { From 0660ad0ad043cae83ec2f700221cc0c00b7c6730 Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Tue, 1 Sep 2026 06:43:33 -0700 Subject: [PATCH 2/2] Update chacha20 to 0.10.2 to clear the yanked-crate audit failure chacha20 0.10.1 and 0.10.0 were both yanked from crates.io, so the rust job's `cargo audit --deny warnings` step fails on every branch that locks 0.10.1, including ones that touch no Rust code. The crate arrives transitively through rand 0.10, and 0.10.2 is the current unyanked release, so this is a lockfile-only bump. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015jn8V6BupxuYT5Jzsnn4f7 --- hofmann-rust/Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hofmann-rust/Cargo.lock b/hofmann-rust/Cargo.lock index f6de747..cbc39f6 100644 --- a/hofmann-rust/Cargo.lock +++ b/hofmann-rust/Cargo.lock @@ -67,9 +67,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0",