From 09f411d3196b09213940cb29bd129ed96b0c9b5f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Apr 2026 18:21:47 +0000
Subject: [PATCH] build(deps): bump sha2 from 0.10.9 to 0.11.0

Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.9 to 0.11.0.
- [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.10.9...sha2-v0.11.0)

---
updated-dependencies:
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

We now need a dedicated crate (base16ct) for the conversion to
hexadecimal (Base16), since the trait `LowerHex` isn't implemented
anymore for `hybrid_array`.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Michael Weiss <michael.weiss@bull.com>
---
 Cargo.lock            | 15 +++++++++++++--
 Cargo.toml            |  2 +-
 src/package/source.rs |  4 ++--
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index fc390ca1..bc2c37a7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -257,7 +257,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha1",
- "sha2",
+ "sha2 0.11.0",
  "shiplift",
  "syntect",
  "tar",
@@ -2118,7 +2118,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
 dependencies = [
  "pest",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -2693,6 +2693,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
diff --git a/Cargo.toml b/Cargo.toml
index ff25be58..492c73e0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,7 +65,7 @@ semver = "1"
 serde = "1"
 serde_json = "1"
 sha1 = "0.11"
-sha2 = "0.10"
+sha2 = "0.11"
 shiplift = "0.7"
 syntect = "5"
 tar = "0.4"
diff --git a/src/package/source.rs b/src/package/source.rs
index e62185b7..4b024f9c 100644
--- a/src/package/source.rs
+++ b/src/package/source.rs
@@ -152,7 +152,7 @@ impl HashType {
 
                     m.update(&buffer[..count]);
                 }
-                let h = format!("{:x}", m.finalize());
+                let h = format!("{:x}", base16ct::HexDisplay(&m.finalize()));
                 trace!("Hash = {:?}", h);
                 Ok(HashValue(h))
             }
@@ -174,7 +174,7 @@ impl HashType {
 
                     m.update(&buffer[..count]);
                 }
-                let h = format!("{:x}", m.finalize());
+                let h = format!("{:x}", base16ct::HexDisplay(&m.finalize()));
                 trace!("Hash = {:?}", h);
                 Ok(HashValue(h))
             }