From cc507da576fcec57a953a713565c126302266e7e Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Wed, 29 Jul 2026 10:01:20 +1000 Subject: [PATCH 1/2] chore(deps): bump cachekit-core 0.3 -> 0.4 (LAB-902) Encryption-only consumer; no envelope surface in this SDK (values stay plain MessagePack). Full CI matrix green locally: fmt, clippy -D warnings, tests incl. interop encryption vectors, wasm32 workers check, MSRV 1.85. --- Cargo.lock | 4 ++-- crates/cachekit/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index badd959..2bd69bb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -187,9 +187,9 @@ dependencies = [ [[package]] name = "cachekit-core" -version = "0.3.0" +version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ee6235f73aefb0dc66b9cd0d333b9da928c8192e4234357a739fe756c2f8f23" +checksum = "6aba1513135a7b92a124ad6983f7e80e5f5c78c4f9c74384079efa3fbf491eab" dependencies = [ "aes", "aes-gcm", diff --git a/crates/cachekit/Cargo.toml b/crates/cachekit/Cargo.toml index cbf1b94..30f5df2 100644 --- a/crates/cachekit/Cargo.toml +++ b/crates/cachekit/Cargo.toml @@ -43,7 +43,7 @@ reliability = ["tokio/time"] unsync = [] [dependencies] -cachekit-core = { version = "0.3", features = ["messagepack"] } +cachekit-core = { version = "0.4", features = ["messagepack"] } serde = { version = "1", features = ["derive"] } rmp-serde = "1" thiserror = "2.0" From d71b6a7f9fbfae6ff9f7d4db6dfdb1701bd90566 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Wed, 29 Jul 2026 12:15:38 +1000 Subject: [PATCH 2/2] docs(deps): drop stale core version token from encryption feature comment The comment claimed 'cachekit-core 0.2 folds aes-gcm into the encryption feature on wasm32' while the pin three lines below now reads 0.4. The underlying fact is version-independent and still true at 0.4.0 (wasm is a pure alias for encryption), so the version token was the only part that could rot -- and bumping it to 0.4 would just re-rot at 0.5. De-hardcoding it follows the LAB-866 precedent, where the same class of pinned-version prose was removed from cachekit-core's README rather than updated. Raised independently by two reviewers on the LAB-902 expert panel. --- crates/cachekit/Cargo.toml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crates/cachekit/Cargo.toml b/crates/cachekit/Cargo.toml index 30f5df2..4377a97 100644 --- a/crates/cachekit/Cargo.toml +++ b/crates/cachekit/Cargo.toml @@ -27,8 +27,10 @@ memcached = ["dep:memcache", "tokio/rt", "tokio/time"] # constants and rustix provides safe flock/geteuid on unix. file = ["tokio/rt", "tokio/sync", "dep:libc", "dep:rustix"] workers = ["dep:worker", "dep:js-sys", "dep:getrandom", "dep:serde_json"] -# cachekit-core 0.2 folds aes-gcm into the `encryption` feature automatically on wasm32. -# No separate `cachekit-core/wasm` activation needed. +# cachekit-core's `encryption` feature folds aes-gcm in automatically on wasm32 +# (`wasm` is a pure alias for `encryption`). No separate `cachekit-core/wasm` +# activation needed. Deliberately version-free: the fact is version-independent, +# and a pinned version in prose is the only part that rots (LAB-866 precedent). encryption = ["cachekit-core/encryption"] # tokio/rt provides Handle::try_current + spawn for the L1 stale-while- # revalidate background refresh (native only — `workers`+`l1` is a compile