chore(deps): bump the rust-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the rust-dependencies group with 2 updates in the / directory: age and getrandom.

Updates age from 0.11.5 to 0.12.1

Release notes

Sourced from age's releases.

rage v0.12.1

rage

Fixed

• Armored files that contain an empty final line are now correctly rejected.

age

Fixed

• age::armor::ArmoredReader:
  • It now correctly implements the intended strict parsing profile (initially implemented in 0.9.0) by rejecting an empty final line.
  • The async API now correctly rejects some classes of truncated files that previously would cause it to hang.

rage v0.12.0

rage

Added

• Support for the new native age recipient types:
  • age1tag1..
  • age1tagpq1..

Changed

• MSRV is now 1.74.0.

age

Added

• Support for new native age recipient types:
  • age::tag::Recipient (encryption-only)
  • age::tagpq::Recipient (encryption-only)
• age::encrypted::EncryptedIdentity
• age::plugin::ResolveError

Changed

• MSRV is now 1.74.0.
• Migrated to base64 0.22, i18n-embed 0.16.
• age::IdentityFile::into_identities now returns Result<Vec<Box<dyn crate::Identity + Send + Sync>>, DecryptError> instead of Result<Vec<Box<dyn crate::Identity>>, DecryptError>. This re-enables cross-thread uses of IdentityFile, which were unintentionally disabled in 0.11.0.
• age::plugin:
  • The following methods now returns Result<Self, ResolveError>:
    • Identity::default_for_plugin
    • RecipientPluginV1::new
    • IdentityPluginV1::new
• All existing error enums nameable in the public API are now non-exhaustive:
  • age::{EncryptError, DecryptError}
  • age::IdentityFileConvertError
  • age::armor::ArmoredReadError
  • age::cli_common::ReadError
  • age::ssh::ParseRecipientKeyError
• Removed the following error enum variants:
  • age::DecryptError::MissingPlugin
  • age::EncryptError::MissingPlugin
  • age::cli_common::ReadError::MissingPlugin

age-plugin 0.7.0

... (truncated)

Commits

• 7a854c9 v0.12.1
• c5aeafe Merge branch 'rage-0.11.4' into release-0.12.1
• 55ab2e9 v0.11.4
• 717a2f5 Merge pull request #633 from str4d/age-0.11.5
• f6383f3 v0.12.0
• 6417286 Merge pull request #629 from str4d/rage-0.11.3
• a7593e4 Merge branch 'main' into rage-0.11.3
• 61b1f49 v0.11.3
• 1c2e1cb Merge pull request #628 from str4d/age-0.11.4
• e29569f Merge pull request #627 from str4d/update-deps-yet-again
• Additional commits viewable in compare view

Updates getrandom from 0.2.17 to 0.3.4

Changelog

Sourced from getrandom's changelog.

0.3.4 - 2025-10-14

Major change to wasm_js backend

Now, when the wasm_js feature is enabled, the wasm_js backend will be used by default. Users of wasm32-unknown-unknown targeting JavaScript environments like the Web and Node.js will no longer need to specify:

--cfg getrandom_backend="wasm_js"

in RUSTFLAGS for the crate to compile. They can now simple enable a feature.

Note: this should not affect non-JS users of the wasm32-unknown-unknown target. Using --cfg getrandom_backend will still override the source of randomness even if the wasm_js feature is enabled. This includes --cfg getrandom_backend=custom and --cfg getrandom_backend=unsupported.

For more information, see the discussions in #671, #675, and #730.

Added

• unsupported opt-in backend #667
• windows_legacy opt-in backend #724

Changed

• Implement Memory Sanitizer unpoisoning more precisely #678
• Relax MSRV for the linux_raw opt-in backend on ARM targets #688
• Use getrandom syscall on all RISC-V Linux targets #699
• Replaced wasi dependency with wasip2 #721
• Enable wasm_js backend by default if the wasm_js feature is enabled #730

Removed

• Unstable rustc-dep-of-std crate feature #694

#667: rust-random/getrandom#667 #671: rust-random/getrandom#671 #675: rust-random/getrandom#675 #678: rust-random/getrandom#678 #688: rust-random/getrandom#688 #694: rust-random/getrandom#694 #699: rust-random/getrandom#699 #721: rust-random/getrandom#721 #724: rust-random/getrandom#724 #730: rust-random/getrandom#730

[0.3.3] - 2025-05-09

Changed

• Doc improvements #632 #634 #635
• Add crate version to docs.rs links used in compile_error!s #639

... (truncated)

Commits

• 38e4ad3 Update version number to v0.3.4 (#736)
• 2d033b7 Release Version v0.3.4 (#735)
• ccb0ca9 build(deps): bump the all-deps group across 1 directory with 5 updates (#734)
• 1af2510 Implement #675: let wasm_js enable the backend by default (#730)
• 18d8984 Don't run doctests with -Zsanitizer=memory
• c904801 Change removed doc_auto_cfg feature
• d4cb6a2 Update all nightly toolchains to latest nightly
• 9b78fcc Update Cargo.lock (#731)
• b6ac385 ci: re-enable NetBSD job (#729)
• 3983e0f Add windows_legacy opt-in backend (#724)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[Onwcan]

@dependabot rebase

[Onwcan]

@dependabot rebase

[Onwcan]

Closing this PR by design under the current DireWolf dependency and TCB policy.

ADR-0046 explicitly pins age 0.11.5 and already records age 0.12.1 as measured and rejected due to its larger trusted closure and pre-release post-quantum KEM dependencies. Its revisit conditions have not fired: age 0.12.1 still carries the localisation stack and kem 0.3.0-pre.0 remains in the dependency closure.

The accompanying getrandom 0.3.4 update also does not replace 0.2.17 in the authority closure; rand_core 0.6.4 still requires 0.2.17. The PR additionally fails to compile because the authority still uses the 0.2 API (getrandom::getrandom), while 0.3 exposes getrandom::fill.

The rebased PR also fails the reviewed dependency-boundary and cargo-deny gates. Accepting these changes would therefore require a deliberate new TCB review and an ADR amendment rather than a routine Dependabot merge.

Current main remains green, including the hosted M5a sandbox-foundation acceptance gate.

No changes from this PR are being accepted. The age dependency should be reconsidered when one of ADR-0046's recorded revisit conditions is actually met.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml