Update dependency apple/swift-crypto to v5 - #106
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
from: "2.5.0"→from: "5.0.0"from: "2.4.1"→from: "5.0.0"from: "2.1.0"→from: "5.0.0"from: "2.0.5"→from: "5.0.0"Release Notes
apple/swift-crypto (apple/swift-crypto)
v5.0.0Compare Source
Swift Crypto 5.0 Release Notes
Swift Crypto 5.0 aligns the cross-platform API surface with CryptoKit as shipped in Xcode 27 (CryptoKit-383.2.1), and takes the opportunity to streamline the package for both adopters and maintainers.
Most users will be able to depend on the 1.0.0, 2.0.0, 3.0.0, 4.0.0, or 5.0.0 series of releases.
To do so, please use the following dependency in your
Package.swift:Requires Swift 6.2
The package now declares 6.2 as the minimum Swift version in its package manifest.
New span-based API
CryptoKit's new non-allocating, span-based entry points are now available cross-platform:
SymmetricKeygainsbytes: RawSpan,init(copying: RawSpan),init(copyingWithZeroing: inout MutableRawSpan), andinit(size:initializingWith:)which initializes the key through aninout OutputRawSpan.HashFunctiongainsupdate(bytes: RawSpan)andhash(bytes: RawSpan), andDigestgainsinit?(copying: RawSpan).HMACgainsauthenticationCode(for: RawSpan, using:).HKDFgainsderiveKey(inputKeyMaterial:salt:info:output:)writing into aninout OutputRawSpan, along with span-basedextractandexpand. The existingDataProtocoloverload now has a fast path for contiguous salt and info.AES.GCMandChaChaPolygain in-placeseal(inPlace:using:nonce:authenticating:tag:)andopen(inPlace:using:nonce:authenticating:tag:)overMutableRawSpan, and theirNoncetypes gainbytes: RawSpanandinit(copying: RawSpan).Single-use KEM keys
A new
KEMOneTimePrivateKeyprotocol, refining~CopyableandSendable, provides aconsuming func decapsulate(_:)so a decapsulation key cannot be reused. Conforming types areMLKEM768.OneTimePrivateKey,MLKEM1024.OneTimePrivateKey, andXWingMLKEM768X25519.OneTimePrivateKey.Extensible enums
Historically Swift Crypto needed a new major version each time CryptoKit added a case to a non-frozen enum, because Swift Crypto is not built with library evolution. All public non-frozen enums are now marked
@nonexhaustive(SE-0487), which should remove that reason for future major bumps. Adopters who do not switch over these enums should not need to widen their version constraints again.Other changes
@_spi(...) publichave been made internal; they were never intended to be available.@availableannotations have been removed fromCrypto; they are unused in all supported compilation modes.finalECDSASignature.derBytes, is removed.Build and packaging
CCryptoBoringSSLShimstarget is removed, along with allbindMemory(to:)calls..gybtemplates for nonces, digests, ECDH, ECDSA, MLDSA, and MLKEM are removed and the generated Swift is checked in. The BoringSSL backend templates for MLDSA and MLKEM remain.#if canImport(CryptoKit); branches that could never be taken are gone.-Wshorten-64-to-32for BoringSSL andmacro-redefinedfor XKCP. CI builds with-warnings-as-errors.Commits
The changes in this release were reviewed and merged to the 5.x branch during the beta period:
0a26a9e[5.x] Align with CryptoKit APIs from Xcode 27 beta 1 (#442)8ee9962[5.x] Align with CryptoKit APIs from Xcode 27 beta 2 (#444)ce8db47[5.x] Align with CryptoKit APIs from Xcode 27 beta 4 (#453)15b0fb5[5.x] Adopt CheckImplementationOnly and CI with -warnings-as-errors (#454)b3746b1[5.x] Remove bindMemory(to:) calls and the CCryptoBoringSSLShims target (#455)57782dc[5.x] Remove duplicate imports from gyb-generated MLDSA backend code (#458)2c45ca2[5.x] Remove unused internal code path: ECDSASignature.derBytes (#457)33785f6[5.x] Mark some class types as final (#456)2e074ef[5.x] Remove native SwiftPM build-system workaround in CI (#461)20f9049[5.x] Align with CryptoKit from Xcode 27 beta 6 (#462)Full Changelog: apple/swift-crypto@4.5.2...5.0.0
v4.5.2Compare Source
What's Changed
SemVer Patch
Other Changes
New Contributors
Full Changelog: apple/swift-crypto@4.5.1...4.5.2
v4.5.1Compare Source
What's Changed
SemVer Patch
47d3869Other Changes
Full Changelog: apple/swift-crypto@4.5.0...4.5.1
v4.5.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
New Contributors
Full Changelog: apple/swift-crypto@4.4.0...4.5.0
v4.4.0Compare Source
What's Changed
SemVer Minor
Other Changes
Full Changelog: apple/swift-crypto@4.3.1...4.4.0
v4.3.1: Swift Crypto 4.3.1Compare Source
Security Fixes
This version contains a fix for CVE-2026-28815: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length. The X-Wing decapsulation path accepts attacker-controlled encapsulated ciphertext bytes without enforcing the required fixed ciphertext length. For more details see the advisory. We recommend updating to this release as soon as possible. (commit)
What's Changed
SemVer Patch
bb4ba81Full Changelog: apple/swift-crypto@4.3.0...4.3.1
v4.3.0: Swift Crypto 4.3.0Compare Source
What's Changed
SemVer Minor
Other Changes
actions/checkoutfrom v4 to v6 by @rnro in #431Full Changelog: apple/swift-crypto@4.2.0...4.3.0
v4.2.0Compare Source
What's Changed
SemVer Minor
Full Changelog: apple/swift-crypto@4.1.0...4.2.0
v4.1.0: Swift Crypto 4.1.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
Other Changes
New Contributors
Full Changelog: apple/swift-crypto@4.0.0...4.1.0
v4.0.0: Swift Crypto 4.0.0Compare Source
What's Changed
SemVer Major
Full Changelog: apple/swift-crypto@3.15.1...4.0.0
v3.15.1: Swift Crypto 3.15.1Compare Source
What's Changed
SemVer Patch
0226f30by @gwynne in #406tryto fix warnings by @ptoffy in #412Other Changes
Full Changelog: apple/swift-crypto@3.15.0...3.16.0
v3.15.0: Swift Crypto 3.15.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.14.0...3.15.0
v3.14.0: Swift Crypto 3.14.0Compare Source
What's Changed
SemVer Minor
Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.13.3...3.14.0
v3.13.3: Swift Crypto 3.13.3Compare Source
What's Changed
SemVer Patch
Other Changes
Full Changelog: apple/swift-crypto@3.13.2...3.13.3
v3.13.2: Swift Crypto 3.13.2Compare Source
What's Changed
SemVer Patch
Full Changelog: apple/swift-crypto@3.13.1...3.13.2
v3.13.1: Swift Crypto 3.13.1Compare Source
What's Changed
SemVer Patch
New Contributors
Full Changelog: apple/swift-crypto@3.13.0...3.13.1
v3.13.0: Swift Crypto 3.13.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
035e720by @Lukasa in #356Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.12.3...3.13.0
v3.12.5: Swift Crypto 3.12.5Compare Source
What's Changed
SemVer Patch
Full Changelog: apple/swift-crypto@3.12.4...3.12.5
v3.12.4: Swift Crypto 3.12.4Compare Source
What's Changed
SemVer Patch
Full Changelog: apple/swift-crypto@3.12.3...3.12.4
v3.12.3Compare Source
What's Changed
SemVer Patch
Other Changes
Full Changelog: apple/swift-crypto@3.12.2...3.12.3
v3.12.2Compare Source
What's Changed
SemVer Patch
Full Changelog: apple/swift-crypto@3.12.1...3.12.2
v3.12.1: Swift Crypto 3.12.1Compare Source
What's Changed
SemVer Patch
Full Changelog: apple/swift-crypto@3.12.0...3.12.1
v3.12.0: Swift Crypto 3.12.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
Full Changelog: apple/swift-crypto@3.11.2...3.12.0
v3.11.2Compare Source
What's Changed
SemVer Patch
Other Changes
Full Changelog: apple/swift-crypto@3.11.1...3.11.2
v3.11.1: Swift Crypto 3.11.1Compare Source
What's Changed
SemVer Patch
Full Changelog: apple/swift-crypto@3.11.0...3.11.1
v3.11.0: Swift Crypto 3.11.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
Full Changelog: apple/swift-crypto@3.10.2...3.11.0
v3.10.2: Swift Crypto 3.10.2Compare Source
What's Changed
SemVer Patch
New Contributors
Full Changelog: apple/swift-crypto@3.10.1...3.10.2
v3.10.1: Swift Crypto 3.10.1Compare Source
What's Changed
SemVer Patch
aefa5d2by @Lukasa in #303 and #312Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.10.0...3.10.1
v3.10.0: Swift Crypto 3.10.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.9.1...3.10.0
v3.9.1: Swift Crypto 3.9.1Compare Source
What's Changed
SemVer Patch
Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.9.0...3.9.1
v3.9.0: Swift Crypto 3.9.0Compare Source
What's Changed
SemVer Minor
SemVer Patch
2587c49by @Lukasa in #279Other Changes
New Contributors
Full Changelog: apple/swift-crypto@3.8.1...3.9.0
v3.8.1: Swift Crypto 3.8.1Compare Source
What's Changed
SemVer Patch
76968bbby @Lukasa in #271New Contributors
Full Changelog: apple/swift-crypto@3.8.0...3.8.1
v3.8.0: Swift Crypto 3.8.0Compare Source
What's Changed
SemVer Minor
Other Changes
Full Changelog: apple/swift-crypto@3.7.1...3.8.0
v3.7.1: Swift Crypto 3.7.1Compare Source
What's Changed
SemVer Patch
6a2ccdcby @Lukasa in #255Other Changes
Full Changelog: apple/swift-crypto@3.7.0...3.7.1
v3.7.0: Swift Crypto 3.7.0Compare Source
SemVer Minor
v3.6.1: Swift Crypto 3.6.1Compare Source
SemVer Patch
v3.6.0: Swift Crypto 3.6.0Compare Source
SemVer Minor
SemVer Patch
v3.5.2: Swift Crypto 3.5.2Compare Source
SemVer Patch
v3.5.1: Swift Crypto 3.5.1Compare Source
SemVer Patch
v3.5.0: Swift Crypto 3.5.0Compare Source
SemVer Minor
SemVer Patch
Other Changes
DataProtocol.hexStringtest utility (#230)v3.4.0: Swift Crypto 3.4.0Compare Source
SemVer Minor
SemVer Patch
_CryptoExtras.AES._CTR(#229)v3.3.0: Swift Crypto 3.3.0Compare Source
SemVer Minor
SemVer Patch
dbad745(#222)Other Changes
v3.2.0: Swift Crypto 3.2.0Compare Source
SemVer Minor
pkcs8PEMRepresenationfor RSA private keys (#203, patch credit to @bjhomer)SemVer Patch
BoringSSLRSAPublicKeyto useEVP_PKEYAPI (#205)7a81362(#207, #215)Other Changes
v3.1.0: Swift Crypto 3.1.0Compare Source
SemVer Minor
_CryptoExtras(#200)v3.0.0: Swift Crypto 3.0.0Compare Source
The only meaningful breaking change in this release is the addition of new cases in the
CryptoKitErrorenum. The overwhelming majority of users can and should express a wider version range than usual: "1.0.0" ..< "4.0.0" is the recommended version range.SemVer Major
SemVer Patch
SecKeyGetBlockSizeinstead ofkSecAttrKeySizeInBits(#198)v2.6.0: Swift Crypto 2.6.0Compare Source
Semver Minor
Semver Patch
7ae2b91(#190, #193)Other changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.