From b221a49b771cc5b2d484ae1ea3c94d47c6cdf2bf Mon Sep 17 00:00:00 2001 From: Henry-Hiles Date: Fri, 11 Sep 2026 15:20:43 -0400 Subject: [PATCH] chore: upgrade argon2 --- Cargo.lock | 47 +++++++++++++++++++++--------------- Cargo.toml | 4 +-- src/core/Cargo.toml | 2 -- src/core/utils/hash/argon.rs | 7 +++--- 4 files changed, 33 insertions(+), 27 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ec9d4d3f5..a58005b76 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -112,13 +112,13 @@ dependencies = [ [[package]] name = "argon2" -version = "0.5.3" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072" +checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c" dependencies = [ "base64ct", "blake2", - "cpufeatures 0.2.17", + "cpufeatures 0.3.0", "password-hash", ] @@ -475,11 +475,11 @@ checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8" [[package]] name = "blake2" -version = "0.10.6" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe" +checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f" dependencies = [ - "digest 0.10.7", + "digest 0.11.3", ] [[package]] @@ -972,7 +972,6 @@ dependencies = [ "openidconnect", "parking_lot", "rand 0.10.2", - "rand_core 0.6.4", "regex", "reqwest 0.13.5", "resolvematrix", @@ -1853,7 +1852,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -3517,7 +3516,7 @@ version = "5.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d" dependencies = [ - "base64 0.21.7", + "base64 0.22.1", "chrono", "getrandom 0.2.17", "http", @@ -3905,13 +3904,12 @@ dependencies = [ [[package]] name = "password-hash" -version = "0.5.0" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166" +checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b" dependencies = [ - "base64ct", - "rand_core 0.6.4", - "subtle", + "getrandom 0.4.3", + "phc", ] [[package]] @@ -3968,6 +3966,17 @@ dependencies = [ "indexmap 2.14.0", ] +[[package]] +name = "phc" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892" +dependencies = [ + "base64ct", + "ctutils", + "getrandom 0.4.3", +] + [[package]] name = "phf" version = "0.11.3" @@ -4308,7 +4317,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4913,7 +4922,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4972,7 +4981,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5283,7 +5292,7 @@ checksum = "7bd22781911de0ca6debda95f073c8f18bec65d1a94f1fa9573f3102e514cea4" dependencies = [ "ahash", "annotate-snippets", - "base64 0.21.7", + "base64 0.22.1", "encoding_rs_io", "getrandom 0.3.4", "granit-parser", @@ -6766,7 +6775,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 40aa93b8b..2080c0f90 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -176,8 +176,8 @@ version = "0.4.0" # Used for password hashing [workspace.dependencies.argon2] -version = "0.5.3" -features = ["alloc", "rand"] +version = "0.6.0" +features = ["alloc", "getrandom"] default-features = false # Used to generate thumbnails for images diff --git a/src/core/Cargo.toml b/src/core/Cargo.toml index 042fa798c..dc9f7b35d 100644 --- a/src/core/Cargo.toml +++ b/src/core/Cargo.toml @@ -88,8 +88,6 @@ log.workspace = true lettre.workspace = true num-traits.workspace = true rand.workspace = true -# tied to passwordhash 0.5.0 -rand_core = { version = "0.6.4", features = ["getrandom"] } regex.workspace = true reqwest.workspace = true sha2.workspace = true diff --git a/src/core/utils/hash/argon.rs b/src/core/utils/hash/argon.rs index 3ec3fcd54..450a9d2e2 100644 --- a/src/core/utils/hash/argon.rs +++ b/src/core/utils/hash/argon.rs @@ -2,7 +2,7 @@ use argon2::{ Algorithm, Argon2, Params, PasswordHash, PasswordHasher, PasswordVerifier, Version, - password_hash, password_hash::SaltString, + password_hash, }; use crate::{Error, Result, err}; @@ -28,16 +28,15 @@ fn init_argon() -> Argon2<'static> { } pub(super) fn password(password: &str) -> Result { - let salt = SaltString::generate(rand_core::OsRng); ARGON .get_or_init(init_argon) - .hash_password(password.as_bytes(), &salt) + .hash_password(password.as_bytes()) .map(|it| it.to_string()) .map_err(map_err) } pub(super) fn verify_password(password: &str, password_hash: &str) -> Result<()> { - let password_hash = PasswordHash::new(password_hash).map_err(map_err)?; + let password_hash = PasswordHash::new(password_hash).map_err(|e| map_err(e.into()))?; ARGON .get_or_init(init_argon) .verify_password(password.as_bytes(), &password_hash)