chore(deps): update rust-dev-deps

[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
proptest (source)	dev-dependencies	minor	1.11.0 → 1.12.0
serde_json	dev-dependencies	patch	1.0.149 → 1.0.154
wasm-bindgen-test	dev-dependencies	patch	=0.3.71 → =0.3.79

---

Release Notes

proptest-rs/proptest (proptest)

v1.12.0

Compare Source

serde-rs/json (serde_json)

v1.0.154

Compare Source

• Support preserve_order in no_std builds (#​1333, thanks @​razmser)

v1.0.153

Compare Source

• Report invalid UTF-8 at the first bad byte (#​1345, thanks @​00200200)

v1.0.152

Compare Source

• Preserve sign of -0 in arbitrary_precision mode (#​1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#​1347, thanks @​yuxi-liu-wired)

v1.0.151

Compare Source

• Add RawValue::from_string_unchecked (#​1331, thanks @​WonderLawrence)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: cachekit-io/cachekit-core/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3e784fc7-d708-4d46-8e89-e9ec91aac994

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 2 suggested fixes.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:68
- Cargo.toml:73

---

### [1/2] Cargo.toml:68
Issue identified during code review:
Unverified breaking bump in Cargo.toml: `blake2` moves from 0.10 to 0.11, a semver-breaking change, without CVE/supply-chain evidence or an updated Cargo.lock. When only pre-release 0.11 versions are published, as was long the case across the RustCrypto stack, the bare `"0.11"` requirement fails to resolve and the build breaks. Fix: confirm a stable 0.11 release exists, attach cargo-audit or OSV output to the PR, and commit the updated Cargo.lock.

**Also found in:**
- `Cargo.toml:73-73`
- `Cargo.toml:72-72`
- `Cargo.toml:74-74`

---

### [2/2] Cargo.toml:73
Issue identified during code review:
Version conflict in Cargo.toml [dev-dependencies]: `sha2` and `aes-gcm` are bumped to 0.11, but [dependencies] still declares `sha2 = "0.10"` (line 44) and `aes-gcm = "0.10"` (line 52), and Cargo unifies a same-named dependency and dev-dependency into one extern crate, so ^0.10 and ^0.11 conflict. Running `cargo test --features encryption` either fails dependency resolution or gives rustc two candidates for `sha2`/`aes_gcm`. If 0.11 wins, `Hkdf::<Sha256>` in src/encryption/key_derivation.rs:109 breaks because hkdf 0.12 is built on digest 0.10, and tests/wasm32_compat_tests.rs:72-113 breaks on the 0.10 GenericArray `Nonce::from_slice` API. Fix: pin the dev-dependency versions to match production (0.10), or bump sha2/aes-gcm/aes/hkdf/hmac/generic-array together in [dependencies] and migrate the code.
Reference implementation (from code review):

// Cargo.toml:73
sha2 = "0.10"
aes-gcm = { version = "0.10", features = ["zeroize"] }

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

WHAT: The wasm32 dev-dependency wasm-bindgen-test is bumped from =0.3.71 to =0.3.79. WHY: Rule 86 requires dependency manifest changes to come with vulnerability or supply-chain evidence and a matching lockfile update. The comment above this line also says the pin must move together with Cargo.lock and the CI runner pin in ci.yml. Otherwise the wasm test build may break or pull in a mismatched wasm-bindgen version. HOW: Run cargo audit or an OSV query for wasm-bindgen-test 0.3.79 and its matching wasm-bindgen version, and attach the output to the PR. Confirm Cargo.lock and the wasm-bindgen runner pin in ci.yml are updated in this same PR.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml:

Line 87:

WHAT: The wasm32 dev-dependency `wasm-bindgen-test` is bumped from =0.3.71 to =0.3.79. WHY: Rule 86 requires dependency manifest changes to come with vulnerability or supply-chain evidence and a matching lockfile update. The comment above this line also says the pin must move together with Cargo.lock and the CI runner pin in ci.yml. Otherwise the wasm test build may break or pull in a mismatched wasm-bindgen version. HOW: Run `cargo audit` or an OSV query for wasm-bindgen-test 0.3.79 and its matching wasm-bindgen version, and attach the output to the PR. Confirm Cargo.lock and the wasm-bindgen runner pin in ci.yml are updated in this same PR.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[kodus-27b]

Version mismatch in the wasm32 CI job: bumping wasm-bindgen-test to 0.3.79 locks wasm-bindgen 0.2.129 in Cargo.lock, but .github/workflows/ci.yml:93 still pins WASM_BINDGEN_VERSION to "0.2.121" with the 0.2.121 tarball's SHA256. On every run, the guard step at ci.yml:111-117 compares locked=0.2.129 against the 0.2.121 pin and runs exit 1, failing the wasm32 / ratio-product vector job; even without the guard, the 0.2.121 wasm-bindgen-test-runner would reject the 0.2.129-built test binary because the two share a private ABI. Fix: in ci.yml, set WASM_BINDGEN_VERSION to "0.2.129" and WASM_BINDGEN_SHA256 to the checksum of wasm-bindgen-0.2.129-x86_64-unknown-linux-musl.tar.gz, as the comment on lines 81-85 requires.

wasm-bindgen-test = "=0.3.79"
# and in .github/workflows/ci.yml:
#   WASM_BINDGEN_VERSION: "0.2.129"
#   WASM_BINDGEN_SHA256: "<sha256 of wasm-bindgen-0.2.129-x86_64-unknown-linux-musl.tar.gz>"

Prompt for LLM

File Cargo.toml:

Line 87:

Version mismatch in the wasm32 CI job: bumping wasm-bindgen-test to 0.3.79 locks wasm-bindgen 0.2.129 in Cargo.lock, but .github/workflows/ci.yml:93 still pins WASM_BINDGEN_VERSION to "0.2.121" with the 0.2.121 tarball's SHA256. On every run, the guard step at ci.yml:111-117 compares locked=0.2.129 against the 0.2.121 pin and runs `exit 1`, failing the wasm32 / ratio-product vector job; even without the guard, the 0.2.121 wasm-bindgen-test-runner would reject the 0.2.129-built test binary because the two share a private ABI. Fix: in ci.yml, set WASM_BINDGEN_VERSION to "0.2.129" and WASM_BINDGEN_SHA256 to the checksum of wasm-bindgen-0.2.129-x86_64-unknown-linux-musl.tar.gz, as the comment on lines 81-85 requires.

Suggested Code:

wasm-bindgen-test = "=0.3.79"
# and in .github/workflows/ci.yml:
#   WASM_BINDGEN_VERSION: "0.2.129"
#   WASM_BINDGEN_SHA256: "<sha256 of wasm-bindgen-0.2.129-x86_64-unknown-linux-musl.tar.gz>"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Stale cargo-vet exemptions in supply-chain/config.toml: the bump to wasm-bindgen-test 0.3.79 locks the wasm-bindgen family at 0.2.129 / 0.3.79 / 0.4.79, but lines 321-351 still exempt only 0.2.121, 0.3.71 and 0.4.71, and each exemption covers one exact version. The cargo vet step in .github/workflows/security.yml:371-372 then reports wasm-bindgen, wasm-bindgen-macro, wasm-bindgen-macro-support, wasm-bindgen-shared, wasm-bindgen-futures, wasm-bindgen-test, wasm-bindgen-test-macro and wasm-bindgen-test-shared as unvetted and fails. Fix: update the exemption versions in supply-chain/config.toml to the newly locked versions, or run cargo vet regenerate exemptions.

wasm-bindgen-test = "=0.3.79"
# and in supply-chain/config.toml update the exemptions, e.g.:
# [[exemptions.wasm-bindgen-test]]
# version = "0.3.79"
# criteria = "safe-to-run"
# (likewise wasm-bindgen*/0.2.129, wasm-bindgen-futures/0.4.79, wasm-bindgen-test-macro/0.3.79, wasm-bindgen-test-shared/0.2.129)

Prompt for LLM

File Cargo.toml:

Line 87:

Stale cargo-vet exemptions in supply-chain/config.toml: the bump to wasm-bindgen-test 0.3.79 locks the wasm-bindgen family at 0.2.129 / 0.3.79 / 0.4.79, but lines 321-351 still exempt only 0.2.121, 0.3.71 and 0.4.71, and each exemption covers one exact version. The `cargo vet` step in .github/workflows/security.yml:371-372 then reports wasm-bindgen, wasm-bindgen-macro, wasm-bindgen-macro-support, wasm-bindgen-shared, wasm-bindgen-futures, wasm-bindgen-test, wasm-bindgen-test-macro and wasm-bindgen-test-shared as unvetted and fails. Fix: update the exemption versions in supply-chain/config.toml to the newly locked versions, or run `cargo vet regenerate exemptions`.

Suggested Code:

wasm-bindgen-test = "=0.3.79"
# and in supply-chain/config.toml update the exemptions, e.g.:
# [[exemptions.wasm-bindgen-test]]
# version = "0.3.79"
# criteria = "safe-to-run"
# (likewise wasm-bindgen*/0.2.129, wasm-bindgen-futures/0.4.79, wasm-bindgen-test-macro/0.3.79, wasm-bindgen-test-shared/0.2.129)

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.