deps(deps): bump argon2 from 0.5.3 to 0.6.0

[dependabot]

Bumps argon2 from 0.5.3 to 0.6.0.

Commits

• b1e0ad6 argon2 v0.6.0 (#931)
• c0d2aca argon2: bump blake2 to v0.11 (#929)
• d9c628b Cargo.lock: bump dependencies (#930)
• 0b31c1c Cargo.toml: use password-hash crate release (#920)
• 420cbc9 build(deps): bump rust-lang/crates-io-auth-action from 1.0.4 to 1.0.5 (#912)
• 3a88540 build(deps): bump actions/checkout from 6 to 7 (#913)
• 90b974f build(deps): bump the all-deps group with 5 updates (#914)
• 82c688f build(deps): bump the all-deps group across 1 directory with 18 updates (#911)
• b2cef17 build(deps): bump the all-deps group with 6 updates (#902)
• 2c16e5a build(deps): bump the all-deps group with 7 updates (#901)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b9fddf99-5db3-4813-b000-eec7ab205be5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

This bump does not compile: argon2 0.6.0 pulls password-hash 0.6.1, which is a breaking API change, and crates/perry-stdlib/src/argon2.rs still uses the 0.5 surface.

error[E0432]: unresolved imports `argon2::password_hash::rand_core`, `argon2::password_hash::SaltString`
  --> crates/perry-stdlib/src/argon2.rs:9:21
error[E0061]: this method takes 1 argument but 2 arguments were supplied
  --> crates/perry-stdlib/src/argon2.rs:35:22
  --> crates/perry-stdlib/src/argon2.rs:63:18

Three call sites need migrating: the rand_core/SaltString re-export paths (lines 9, 103, 137, 164) and the two hash_password calls (lines 35, 63) whose salt argument moved into the builder.

That is why check, warnings, gc-stress, gap-suite-build and security-audit are all red here — none of them are inherited from main.

I took this into merge train 207 on the strength of a clean cherry-pick and no file overlap, and the train's release build caught it. It has been dropped from that train; the train landed the rest. This PR needs the call-site migration before it can go in.

[proggeramlug]

Follow-up with the concrete 0.6 API, since the migration is not a pure rename.

In password-hash 0.6.1 the surface moved:

• SaltString is no longer at argon2::password_hash::SaltString — it lives in the phc crate, re-exported as password_hash::phc.
• rand_core is still re-exported but is now behind the rand_core feature.
• PasswordHasher::hash_password takes one argument and generates a large random salt itself (RECOMMENDED_SALT_LEN), behind the getrandom feature. Explicit control is available via hash_password_with_salt(password, &salt) and hash_password_with_rng(rng, password).

So the two call sites in crates/perry-stdlib/src/argon2.rs (js_argon2_hash at :35 and js_argon2_hash_sync at :63) currently do:

let salt = SaltString::generate(&mut OsRng);
argon2.hash_password(password.as_bytes(), &salt)

and there is a real choice to make rather than one obvious rewrite:

1. hash_password(password.as_bytes()) — drop the manual salt, enable getrandom. Shortest, and uses the crate's recommended salt length.
2. hash_password_with_rng(&mut OsRng, password.as_bytes()) — keep an explicit RNG, enable rand_core.
3. hash_password_with_salt(...) — keep a SaltString, importing it from password_hash::phc.

I am deliberately not picking one as a merge-train repair: it changes where salt entropy comes from in a password-hashing path, and which feature gets enabled is a decision for whoever owns this module.

Whichever is chosen, the verification that matters is a round-trip — hash, then PasswordVerifier::verify_password against the produced PHC string — plus a check that existing stored hashes from 0.5.3 still verify, since the stored format is what users have on disk.

[proggeramlug]

Closing this for now — not worth the migration cost at present.

This is a routine version bump, not a security update: no advisory affects argon2 0.5.3, and the only real finding in security-audit on main is RUSTSEC-2026-0285 against rustls, which is unrelated and resolves itself once .cargo/config.toml's global-min-publish-age = "7 days" lets the resolver take 0.23.45.

The bump does not compile, and the work needed is a real API migration rather than a version edit. argon2 0.6.0 pulls password-hash 0.6.1, which moved SaltString into the phc crate, put rand_core behind a feature, and changed PasswordHasher::hash_password to take one argument (it now generates a RECOMMENDED_SALT_LEN salt itself). The two call sites in crates/perry-stdlib/src/argon2.rs — js_argon2_hash and js_argon2_hash_sync — need rewriting, and there are three viable shapes that differ in where salt entropy comes from and which cargo feature gets enabled. Details are in the earlier comment on this PR.

That is a decision for whoever owns password hashing, not something to settle inside a dependency bump. Reopening this later is cheap; landing the wrong salt source is not.

Dependabot will re-raise the bump on its next run if the dependency is still behind.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.