Skip to content

Update dependency apple/swift-crypto to v5 - #106

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/apple-swift-crypto-5.x
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/apple-swift-crypto-5.x

Conversation

@renovate

@renovate renovate Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
apple/swift-crypto major from: "2.5.0" → from: "5.0.0"
apple/swift-crypto major from: "2.4.1" → from: "5.0.0"
apple/swift-crypto major from: "2.1.0" → from: "5.0.0"
apple/swift-crypto major from: "2.0.5" → from: "5.0.0"

Release Notes

apple/swift-crypto (apple/swift-crypto)

v5.0.0

Compare Source

Swift Crypto 5.0 Release Notes

Swift Crypto 5.0 aligns the cross-platform API surface with CryptoKit as shipped in Xcode 27 (CryptoKit-383.2.1), and takes the opportunity to streamline the package for both adopters and maintainers.

Most users will be able to depend on the 1.0.0, 2.0.0, 3.0.0, 4.0.0, or 5.0.0 series of releases.

To do so, please use the following dependency in your Package.swift:

.package(url: "https://github.com/apple/swift-crypto.git", "1.0.0" ..< "6.0.0"),
Requires Swift 6.2

The package now declares 6.2 as the minimum Swift version in its package manifest.

New span-based API

CryptoKit's new non-allocating, span-based entry points are now available cross-platform:

  • SymmetricKey gains bytes: RawSpan, init(copying: RawSpan), init(copyingWithZeroing: inout MutableRawSpan), and init(size:initializingWith:) which initializes the key through an inout OutputRawSpan.
  • HashFunction gains update(bytes: RawSpan) and hash(bytes: RawSpan), and Digest gains init?(copying: RawSpan).
  • HMAC gains authenticationCode(for: RawSpan, using:).
  • HKDF gains deriveKey(inputKeyMaterial:salt:info:output:) writing into an inout OutputRawSpan, along with span-based extract and expand. The existing DataProtocol overload now has a fast path for contiguous salt and info.
  • AES.GCM and ChaChaPoly gain in-place seal(inPlace:using:nonce:authenticating:tag:) and open(inPlace:using:nonce:authenticating:tag:) over MutableRawSpan, and their Nonce types gain bytes: RawSpan and init(copying: RawSpan).
Single-use KEM keys

A new KEMOneTimePrivateKey protocol, refining ~Copyable and Sendable, provides a consuming func decapsulate(_:) so a decapsulation key cannot be reused. Conforming types are MLKEM768.OneTimePrivateKey, MLKEM1024.OneTimePrivateKey, and XWingMLKEM768X25519.OneTimePrivateKey.

Extensible enums

Historically Swift Crypto needed a new major version each time CryptoKit added a case to a non-frozen enum, because Swift Crypto is not built with library evolution. All public non-frozen enums are now marked @nonexhaustive (SE-0487), which should remove that reason for future major bumps. Adopters who do not switch over these enums should not need to widen their version constraints again.

Other changes
  • Symbols that were previously marked @_spi(...) public have been made internal; they were never intended to be available.
  • @available annotations have been removed from Crypto; they are unused in all supported compilation modes.
  • Some internal reference types are now marked final
  • Some unused code, e.g. ECDSASignature.derBytes, is removed.
Build and packaging
  • The CCryptoBoringSSLShims target is removed, along with all bindMemory(to:) calls.
  • The .gyb templates for nonces, digests, ECDH, ECDSA, MLDSA, and MLKEM are removed and the generated Swift is checked in. The BoringSSL backend templates for MLDSA and MLKEM remain.
  • Conditional compilation is simplified to #if canImport(CryptoKit); branches that could never be taken are gone.
  • Developing the BoringSSL backend on macOS is no longer supported. Use the Dev Container configuration now shipped in the repository, or build on the target platform.
  • Warnings are silenced for vendored C sources: -Wshorten-64-to-32 for BoringSSL and macro-redefined for XKCP. CI builds with -warnings-as-errors.
Commits

The changes in this release were reviewed and merged to the 5.x branch during the beta period:

  • 0a26a9e [5.x] Align with CryptoKit APIs from Xcode 27 beta 1 (#​442)
  • 8ee9962 [5.x] Align with CryptoKit APIs from Xcode 27 beta 2 (#​444)
  • ce8db47 [5.x] Align with CryptoKit APIs from Xcode 27 beta 4 (#​453)
  • 15b0fb5 [5.x] Adopt CheckImplementationOnly and CI with -warnings-as-errors (#​454)
  • b3746b1 [5.x] Remove bindMemory(to:) calls and the CCryptoBoringSSLShims target (#​455)
  • 57782dc [5.x] Remove duplicate imports from gyb-generated MLDSA backend code (#​458)
  • 2c45ca2 [5.x] Remove unused internal code path: ECDSASignature.derBytes (#​457)
  • 33785f6 [5.x] Mark some class types as final (#​456)
  • 2e074ef [5.x] Remove native SwiftPM build-system workaround in CI (#​461)
  • 20f9049 [5.x] Align with CryptoKit from Xcode 27 beta 6 (#​462)

Full Changelog: apple/swift-crypto@4.5.2...5.0.0

v4.5.2

Compare Source

What's Changed

SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@4.5.1...4.5.2

v4.5.1

Compare Source

What's Changed

SemVer Patch
Other Changes

Full Changelog: apple/swift-crypto@4.5.0...4.5.1

v4.5.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch
  • Adopt FoundationEssentials instead of Foundation where available by @​t089 in #​317
  • Add module anchor to fix empty dynamic framework on Xcode 26 by @​mrcararia in #​436

New Contributors

Full Changelog: apple/swift-crypto@4.4.0...4.5.0

v4.4.0

Compare Source

What's Changed

SemVer Minor
Other Changes

Full Changelog: apple/swift-crypto@4.3.1...4.4.0

v4.3.1: Swift Crypto 4.3.1

Compare Source

Security Fixes

This version contains a fix for CVE-2026-28815: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length. The X-Wing decapsulation path accepts attacker-controlled encapsulated ciphertext bytes without enforcing the required fixed ciphertext length. For more details see the advisory. We recommend updating to this release as soon as possible. (commit)

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@4.3.0...4.3.1

v4.3.0: Swift Crypto 4.3.0

Compare Source

What's Changed

SemVer Minor
Other Changes

Full Changelog: apple/swift-crypto@4.2.0...4.3.0

v4.2.0

Compare Source

What's Changed

SemVer Minor

Full Changelog: apple/swift-crypto@4.1.0...4.2.0

v4.1.0: Swift Crypto 4.1.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@4.0.0...4.1.0

v4.0.0: Swift Crypto 4.0.0

Compare Source

What's Changed

SemVer Major

Full Changelog: apple/swift-crypto@3.15.1...4.0.0

v3.15.1: Swift Crypto 3.15.1

Compare Source

What's Changed

SemVer Patch
Other Changes

Full Changelog: apple/swift-crypto@3.15.0...3.16.0

v3.15.0: Swift Crypto 3.15.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.14.0...3.15.0

v3.14.0: Swift Crypto 3.14.0

Compare Source

What's Changed

SemVer Minor
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.13.3...3.14.0

v3.13.3: Swift Crypto 3.13.3

Compare Source

What's Changed

SemVer Patch
Other Changes

Full Changelog: apple/swift-crypto@3.13.2...3.13.3

v3.13.2: Swift Crypto 3.13.2

Compare Source

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@3.13.1...3.13.2

v3.13.1: Swift Crypto 3.13.1

Compare Source

What's Changed

SemVer Patch

New Contributors

Full Changelog: apple/swift-crypto@3.13.0...3.13.1

v3.13.0: Swift Crypto 3.13.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.12.3...3.13.0

v3.12.5: Swift Crypto 3.12.5

Compare Source

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@3.12.4...3.12.5

v3.12.4: Swift Crypto 3.12.4

Compare Source

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@3.12.3...3.12.4

v3.12.3

Compare Source

What's Changed

SemVer Patch
Other Changes

Full Changelog: apple/swift-crypto@3.12.2...3.12.3

v3.12.2

Compare Source

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@3.12.1...3.12.2

v3.12.1: Swift Crypto 3.12.1

Compare Source

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@3.12.0...3.12.1

v3.12.0: Swift Crypto 3.12.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch

Full Changelog: apple/swift-crypto@3.11.2...3.12.0

v3.11.2

Compare Source

What's Changed

SemVer Patch
  • Replace platforms from Package manifest with availability guards by @​gjcairo in #​331
Other Changes

Full Changelog: apple/swift-crypto@3.11.1...3.11.2

v3.11.1: Swift Crypto 3.11.1

Compare Source

What's Changed

SemVer Patch

Full Changelog: apple/swift-crypto@3.11.0...3.11.1

v3.11.0: Swift Crypto 3.11.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch

Full Changelog: apple/swift-crypto@3.10.2...3.11.0

v3.10.2: Swift Crypto 3.10.2

Compare Source

What's Changed

SemVer Patch

New Contributors

Full Changelog: apple/swift-crypto@3.10.1...3.10.2

v3.10.1: Swift Crypto 3.10.1

Compare Source

What's Changed

SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.10.0...3.10.1

v3.10.0: Swift Crypto 3.10.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.9.1...3.10.0

v3.9.1: Swift Crypto 3.9.1

Compare Source

What's Changed

SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.9.0...3.9.1

v3.9.0: Swift Crypto 3.9.0

Compare Source

What's Changed

SemVer Minor
SemVer Patch
Other Changes

New Contributors

Full Changelog: apple/swift-crypto@3.8.1...3.9.0

v3.8.1: Swift Crypto 3.8.1

Compare Source

What's Changed

SemVer Patch

New Contributors

Full Changelog: apple/swift-crypto@3.8.0...3.8.1

v3.8.0: Swift Crypto 3.8.0

Compare Source

What's Changed

SemVer Minor
Other Changes

Full Changelog: apple/swift-crypto@3.7.1...3.8.0

v3.7.1: Swift Crypto 3.7.1

Compare Source

What's Changed

SemVer Patch
Other Changes

Full Changelog: apple/swift-crypto@3.7.0...3.7.1

v3.7.0: Swift Crypto 3.7.0

Compare Source

SemVer Minor
  • Add support for AES CFB mode in _CryptoExtras (#​252)

v3.6.1: Swift Crypto 3.6.1

Compare Source

SemVer Patch

v3.6.0: Swift Crypto 3.6.0

Compare Source

SemVer Minor
  • extras: Provide initializers for RSA keys from RSA parameters (#​247)
SemVer Patch
  • Reduce the number of heap allocations when computing hash digests (#​238, patch credit to @​baarde)

v3.5.2: Swift Crypto 3.5.2

Compare Source

SemVer Patch
  • Revert to using @​_implementationOnly for all BoringSSL modules (#​246)

v3.5.1: Swift Crypto 3.5.1

Compare Source

SemVer Patch
  • build: Add missing prefix to BoringSSL delete_if stack symbols (#​245)

v3.5.0: Swift Crypto 3.5.0

Compare Source

SemVer Minor
  • extras: Add APIs for RSA Blind Signatures (#​232)
SemVer Patch
  • add support for riscv64 (#​240, patch credit to @​futurejones)
  • Move ArbitraryPrecisionInteger type to CryptoBoringWrapper module (#​236)
  • Change inclusiveMin param of ArbitraryPrecisionInteger.random from UInt64 to UInt (#​242)
Other Changes
  • Fix broken DataProtocol.hexString test utility (#​230)
  • update README recommended versions (#​233)

v3.4.0: Swift Crypto 3.4.0

Compare Source

SemVer Minor
SemVer Patch
  • Add empty privacy manifest files (#​226)
  • Use BoringSSL implementation for _CryptoExtras.AES._CTR (#​229)

v3.3.0: Swift Crypto 3.3.0

Compare Source

SemVer Minor
  • Add support for AES CTR mode in _CryptoExtras (#​220)
  • Raise minimum Swift version to 5.7 (#​221)
SemVer Patch
Other Changes

v3.2.0: Swift Crypto 3.2.0

Compare Source

SemVer Minor
SemVer Patch
Other Changes
  • Add cxx interop build pipeline (#​212)
  • Update availability annotations in tests (#​213)

v3.1.0: Swift Crypto 3.1.0

Compare Source

SemVer Minor
  • Add support for AES-CBC in _CryptoExtras (#​200)
  • Bump minimum Swift version to 5.7 (#​201)

v3.0.0: Swift Crypto 3.0.0

Compare Source

The only meaningful breaking change in this release is the addition of new cases in the CryptoKitError enum. The overwhelming majority of users can and should express a wider version range than usual: "1.0.0" ..< "4.0.0" is the recommended version range.

SemVer Major
  • Update to CryptoKit 2023 final API (#​199)
SemVer Patch
  • Set missing Windows defines (#​197) (patch credit to @​compnerd)
  • Use SecKeyGetBlockSize instead of kSecAttrKeySizeInBits (#​198)

v2.6.0: Swift Crypto 2.6.0

Compare Source

Semver Minor
Semver Patch
Other changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants