chore(deps): Bump the cargo-deps group with 7 updates

crates/overslash-api/Cargo.toml

@@ -44,7 +44,7 @@ async-trait = { workspace = true }
 anyhow = { workspace = true }
 dotenvy = { workspace = true }
 rand = { workspace = true }
-argon2 = "0.5"
+argon2 = "0.6"
 hmac = "0.13"
 sha2 = "0.11"
 hex = "0.4"
@@ -57,9 +57,9 @@ jsonwebtoken = { workspace = true }
 futures-util = "0.3"
 redis = { workspace = true }
 dashmap = { workspace = true }
-jaq-core = "=3.1.0"
-jaq-std = "=3.0.2"
-jaq-json = { version = "=2.0.2", features = ["serde"] }
+jaq-core = "=3.1.1"
+jaq-std = "=3.0.3"
+jaq-json = { version = "=2.0.3", features = ["serde"] }
 
 [dev-dependencies]
 overslash-fakes = { path = "../overslash-fakes" }

crates/overslash-api/src/routes/api_keys.rs

@@ -198,15 +198,12 @@ pub(crate) fn generate_api_key()
     let raw_key = format!("osk_{encoded}");
     let key_prefix = raw_key[..12].to_string();
 
-    let salt =
-        argon2::password_hash::SaltString::generate(&mut argon2::password_hash::rand_core::OsRng);
-    let hash = argon2::PasswordHasher::hash_password(
-        &argon2::Argon2::default(),
-        raw_key.as_bytes(),
-        &salt,
-    )
-    .map_err(|e| crate::error::AppError::Internal(format!("hash error: {e}")))?
-    .to_string();
+    // argon2 0.6 generates the salt itself (16 random bytes, the PHC
+    // recommended length) — the caller no longer threads one in.
+    let hash =
+        argon2::PasswordHasher::hash_password(&argon2::Argon2::default(), raw_key.as_bytes())
+            .map_err(|e| crate::error::AppError::Internal(format!("hash error: {e}")))?
+            .to_string();
 
     Ok((raw_key, hash, key_prefix))
 }

crates/overslash-api/tests/common/mod.rs

@@ -2151,13 +2151,9 @@ pub async fn seed_org_user_key(pool: &PgPool, opts: SeedOptions) -> (Uuid, Uuid,
     let raw_key = format!("osk_{suffix}");
     let prefix = raw_key[..12].to_string();
 
-    use argon2::{
-        Argon2,
-        password_hash::{PasswordHasher, SaltString, rand_core::OsRng},
-    };
-    let salt = SaltString::generate(&mut OsRng);
+    use argon2::{Argon2, PasswordHasher};
     let hash = Argon2::default()
-        .hash_password(raw_key.as_bytes(), &salt)
+        .hash_password(raw_key.as_bytes())
         .unwrap()
         .to_string();
 

crates/overslash-core/Cargo.toml

@@ -37,7 +37,7 @@ glob-match = "0.2"
 # Lexer + parser only: credential templates are analysed at compile time to
 # learn which secret slots they read. Evaluation (jaq-std/jaq-json) stays in
 # overslash-api so core never runs a jq program.
-jaq-core = "=3.1.0"
+jaq-core = "=3.1.1"
 serde_yaml = { version = "0.9", optional = true }
 tracing = { workspace = true }
 async-trait = { workspace = true }