chore(deps): bump sha2 from 0.10.9 to 0.11.0

Cargo.toml

@@ -33,6 +33,6 @@ thiserror = "2"
 tracing = { version = "0.1", default-features = false, features = ["std"] }
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "time"] }
 rusqlite = { version = "0.40", features = ["bundled"] }
-sha2 = "0.10"
+sha2 = "0.11"
 chrono = { version = "0.4", default-features = false, features = ["clock", "serde", "std"] }
 uuid = { version = "1", features = ["v4", "serde"] }

crates/tinyflows/Cargo.toml

@@ -34,7 +34,8 @@ tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "time"
 reqwest = { version = "0.13", default-features = false, features = ["json"], optional = true }
 # `caps::host` only: hashing an author-supplied state key (and namespace) into
 # one safe path component, and staging a script in a temporary directory.
-sha2 = { version = "0.10", optional = true }
+sha2 = { version = "0.11", optional = true }
+hex = "0.4"
 tempfile = { version = "3", optional = true }
 # `store` only: the advisory file lock that keeps two processes from deciding
 # the same proposal at once.
@@ -81,7 +82,7 @@ proptest = "1"
 # `host-caps` feature is on (the same rule `caps::mock` follows), so what that
 # feature would switch on has to be present for a test build too. An optional
 # dependency is not activated by `cfg(test)`, hence these.
-sha2 = "0.10"
+sha2 = "0.11"
 tempfile = "3"
 fs2 = "0.4"
 reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }

crates/tinyflows/src/caps/host/state.rs

@@ -49,7 +49,7 @@ impl FileStateStore {
 fn digest(value: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(value.as_bytes());
-    format!("{:x}", hasher.finalize())
+    hex::encode(hasher.finalize())
 }
 
 #[async_trait]

crates/tinyflows/src/store/file/dirs.rs

@@ -26,10 +26,7 @@ pub fn workflow_dirs(home: &Path, cwd: &Path, project_dir: &str) -> Vec<PathBuf>
 /// State shared by stores writing the same catalog, beneath the caller's root.
 pub(crate) fn definition_state_dir(state_root: &Path, dirs: &[PathBuf]) -> PathBuf {
     let write_dir = catalog_identity(dirs);
-    let scope = format!(
-        "{:x}",
-        Sha256::digest(write_dir.as_os_str().as_encoded_bytes())
-    );
+    let scope = hex::encode(Sha256::digest(write_dir.as_os_str().as_encoded_bytes()));
     state_root.join("definitions").join(scope)
 }
 

crates/tinyflows/src/store/file/mod.rs

@@ -90,8 +90,8 @@ fn scoped_state_dir(state_dir: &Path, workspace: &Path) -> PathBuf {
 /// drift.
 pub fn workspace_scope(workspace: &Path) -> String {
     let identity = std::fs::canonicalize(workspace).unwrap_or_else(|_| absolute_path(workspace));
-    let digest = Sha256::digest(identity.to_string_lossy().as_bytes());
-    format!("{digest:x}")[..16].to_string()
+    let digest = hex::encode(Sha256::digest(identity.to_string_lossy().as_bytes()));
+    digest[..16].to_string()
 }
 
 /// A file-backed proposal decision claim released when dropped.

crates/tinyflows/src/store/types/proposal.rs

@@ -125,7 +125,7 @@ impl WorkflowProposal {
 pub fn fingerprint(graph: &crate::model::WorkflowGraph) -> String {
     use sha2::{Digest, Sha256};
     match serde_json::to_vec(graph) {
-        Ok(canonical) => format!("{:x}", Sha256::digest(&canonical)),
+        Ok(canonical) => hex::encode(Sha256::digest(&canonical)),
         // A graph that fails to serialize (a non-finite `Position`, for
         // instance) must not fingerprint the same as every other graph that
         // also fails to serialize. Hashing empty bytes would do exactly that,

crates/tinyflows/src/store/types/workflow.rs

@@ -128,7 +128,7 @@ pub fn record_fingerprint(record: &WorkflowRecord) -> String {
     let mut persisted = record.clone();
     persisted.source_path = None;
     match serde_json::to_vec(&persisted) {
-        Ok(canonical) => format!("{:x}", Sha256::digest(&canonical)),
+        Ok(canonical) => hex::encode(Sha256::digest(&canonical)),
         // Same reasoning as `proposal::fingerprint`: hashing empty bytes on a
         // serialization failure would let a compare-and-swap write accept a
         // stale record whenever both the expected and current record happen