deps(server): version bump

server/crates/arbiter-server/Cargo.toml

@@ -9,8 +9,8 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.9.0", features = [
+diesel = { version = "2.3.10", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel-async = { version = "0.9.2", features = [
     "bb8",
     "migrations",
     "sqlite",
@@ -44,7 +44,7 @@ hmac.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.102"
+anyhow = "1.0.103"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true

server/crates/arbiter-server/tests/client/auth.rs

@@ -16,7 +16,7 @@ use arbiter_server::{
 
 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 
 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
     ClientMetadata {
@@ -73,7 +73,7 @@ async fn insert_registered_client(
 
 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
     let challenge = challenge.format();
-    key.signing_key()
+    key.expanded_key()
         .sign_deterministic(&challenge, CLIENT_CONTEXT)
         .unwrap()
         .into()
@@ -81,7 +81,7 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -
 
 async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
     let mut conn = db.get().await.unwrap();
-    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
+    let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
         .encode()
         .0
         .to_vec();
@@ -120,7 +120,7 @@ pub async fn unregistered_pubkey_rejected() {
         connect_client(props, &mut server_transport).await;
     });
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
 
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
@@ -140,7 +140,7 @@ pub async fn challenge_auth() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
 
     Box::pin(insert_registered_client(
         &db,
@@ -206,7 +206,7 @@ pub async fn challenge_auth() {
 pub async fn metadata_unchanged_does_not_append_history() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     Box::pin(insert_registered_client(
@@ -269,7 +269,7 @@ pub async fn metadata_unchanged_does_not_append_history() {
 pub async fn metadata_change_appends_history_and_repoints_binding() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
 
     Box::pin(insert_registered_client(
         &db,
@@ -357,7 +357,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
     let db = db::create_test_pool().await;
     let actors = spawn_test_actors(&db).await;
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let requested = metadata("client", Some("desc"), Some("1.0.0"));
 
     {

server/crates/arbiter-server/tests/operator/auth.rs

@@ -14,7 +14,7 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;
 
 fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
@@ -26,7 +26,7 @@ fn sign_operator_challenge(
     challenge: &AuthChallenge,
 ) -> authn::Signature {
     let challenge = challenge.format();
-    key.signing_key()
+    key.expanded_key()
         .sign_deterministic(&challenge, OPERATOR_CONTEXT)
         .unwrap()
         .into()
@@ -170,7 +170,7 @@ pub async fn bootstrap_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -227,7 +227,7 @@ pub async fn bootstrap_invalid_token_auth() {
         auth::authenticate(&mut props, &mut server_transport).await
     });
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     test_transport
         .send(auth::Inbound::AuthChallengeRequest {
             pubkey: verifying_key(&new_key).into(),
@@ -280,7 +280,7 @@ pub async fn challenge_auth() {
         .await
         .unwrap();
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
@@ -366,7 +366,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
         .await
         .unwrap();
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {
@@ -439,7 +439,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
         .await
         .unwrap();
 
-    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    let new_key = SigningKey::<MlDsa87>::generate();
     let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
 
     {