deps(server): version bump

server/Cargo.toml

@@ -6,11 +6,11 @@ resolver = "3"
 
 
 [workspace.dependencies]
-alloy = "2.1.0"
-async-trait = "0.1.89"
-base64 = "0.22.1"
+alloy = "2.4.1"
+async-trait = "0.1.92"
+base64 = "0.23.1"
 chrono = { version = "0.4.45", features = ["serde"] }
-futures = "0.3.32"
+futures = "0.3.34"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
@@ -20,19 +20,19 @@ ml-dsa = { version = "0.1.1", features = ["zeroize"] }
 mutants = "0.0.4"
 prost = "0.14.4"
 prost-types = { version = "0.14.4", features = ["chrono"] }
-rand = "0.10.1"
-rcgen = { version = "0.14.8", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+rand = "0.10.2"
+rcgen = { version = "0.14.9", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.41", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
-rustls-pki-types = "1.14.1"
+rustls = { version = "0.23.43", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls-pki-types = "1.15.1"
 sha2 = "0.11"
 smlang = "0.8.0"
-thiserror = "2.0.18"
-tokio = { version = "1.52.3", features = ["full"] }
-tokio-stream = { version = "0.1.18", features = ["full"] }
+thiserror = "2.0.20"
+tokio = { version = "1.53.1", features = ["full"] }
+tokio-stream = { version = "0.1.19", features = ["full"] }
 tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
 tracing = "0.1.44"
-x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
+x25519-dalek = { version = "3.0.0", features = ["getrandom"] }
 
 [workspace.lints.rust]
 missing_unsafe_on_extern = "deny"

server/crates/arbiter-client/Cargo.toml

@@ -20,8 +20,8 @@ tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
-http = "1.4.2"
-rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
+http = "1.5.0"
+rustls-webpki = { version = "0.103.15", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true
 

server/crates/arbiter-crypto/Cargo.toml

@@ -6,10 +6,10 @@ edition = "2024"
 [dependencies]
 ml-dsa = {workspace = true, optional = true }
 rand = {workspace = true, optional = true}
-memsafe = {version = "0.4.0", optional = true}
+memsafe = {version = "1.0.2", optional = true}
 hmac.workspace = true
 alloy.workspace = true
-x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
+x-wing = { version = "0.1.0", features = ["zeroize"] }
 chrono.workspace = true
 thiserror.workspace = true
 

server/crates/arbiter-macros/Cargo.toml

@@ -10,7 +10,7 @@ doctest = false
 [dependencies]
 proc-macro2 = "1.0"
 quote = "1.0"
-syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
+syn = { version = "3.0", features = ["derive", "fold", "full", "visit-mut"] }
 
 [dev-dependencies]
 arbiter-crypto = { path = "../arbiter-crypto" }

server/crates/arbiter-server/Cargo.toml

@@ -9,7 +9,13 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.10", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel = { version = "2.3.12", features = [
+    "chrono",
+    "returning_clauses_for_sqlite_3_35",
+    "serde_json",
+    "time",
+    "uuid",
+] }
 diesel-async = { version = "0.9.2", features = [
     "bb8",
     "migrations",
@@ -34,17 +40,17 @@ rand.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
-chacha20poly1305 = { version = "0.10.1", features = ["std"] }
-argon2 = { version = "0.5.3", features = ["zeroize"] }
+chacha20poly1305 = { version = "0.11.0" }
+argon2 = { version = "0.6.0", features = ["zeroize"] }
 restructed = "0.2.2"
 strum = { version = "0.28.0", features = ["derive"] }
-pem = "3.0.6"
+pem = "4.0.0"
 sha2.workspace = true
 hmac.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.103"
+anyhow = "1.0.104"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true

server/crates/arbiter-server/src/crypto/encryption/v1.rs

@@ -1,4 +1,3 @@
-use argon2::password_hash::Salt as ArgonSalt;
 use rand::{
     Rng as _, SeedableRng,
     rngs::{StdRng, SysRng},
@@ -42,7 +41,7 @@ impl<'a> TryFrom<&'a [u8]> for Nonce {
     }
 }
 
-pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
+pub type Salt = [u8; argon2::RECOMMENDED_SALT_LEN];
 
 pub fn generate_salt() -> Salt {
     let mut salt = Salt::default();

server/crates/arbiter-server/src/crypto/mod.rs

@@ -3,8 +3,8 @@ use encryption::v1::{Nonce, Salt};
 
 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
-    AeadInPlace, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
-    aead::{AeadMut, Error, Payload},
+    AeadInOut, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
+    aead::{Aead, Error, Payload},
 };
 use rand::{
     Rng as _, SeedableRng as _,
@@ -54,9 +54,9 @@ impl KeyCell {
     ) -> Result<(), Error> {
         let key_reader = self.0.read();
         let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
+        let nonce = XNonce::from(nonce.0);
         let buffer = buffer.as_mut();
-        cipher.encrypt_in_place(nonce, associated_data, buffer)
+        cipher.encrypt_in_place(&nonce, associated_data, buffer)
     }
     pub fn decrypt_in_place(
         &mut self,
@@ -66,10 +66,10 @@ impl KeyCell {
     ) -> Result<(), Error> {
         let key_reader = self.0.read();
         let cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
+        let nonce = XNonce::from(nonce.0);
         let mut buffer = buffer.write();
         let buffer: &mut Vec<u8> = buffer.as_mut();
-        cipher.decrypt_in_place(nonce, associated_data, buffer)
+        cipher.decrypt_in_place(&nonce, associated_data, buffer)
     }
 
     pub fn encrypt(
@@ -79,11 +79,11 @@ impl KeyCell {
         plaintext: impl AsRef<[u8]>,
     ) -> Result<Vec<u8>, Error> {
         let key_reader = self.0.read();
-        let mut cipher = XChaCha20Poly1305::new(&key_reader);
-        let nonce = XNonce::from_slice(nonce.0.as_ref());
+        let cipher = XChaCha20Poly1305::new(&key_reader);
+        let nonce = XNonce::from(nonce.0);
 
         let ciphertext = cipher.encrypt(
-            nonce,
+            &nonce,
             Payload {
                 msg: plaintext.as_ref(),
                 aad: associated_data,

server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs

@@ -10,7 +10,7 @@ use crate::{
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use state::State;
 
-use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
+use chacha20poly1305::{AeadInOut, KeyInit as _, XChaCha20Poly1305, XNonce};
 use kameo::{Actor, error::SendError, messages, prelude::Message};
 use kameo_actors::message_bus::Register;
 use tokio::sync::oneshot;
@@ -99,14 +99,17 @@ impl VaultGate {
         ciphertext: &[u8],
         associated_data: &[u8],
     ) -> Result<SafeCell<Vec<u8>>, ()> {
-        let nonce = XNonce::from_slice(nonce);
+        let Ok(nonce) = XNonce::try_from(nonce) else {
+            error!("Encrypted key material carries a nonce of the wrong length");
+            return Err(());
+        };
 
         let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
 
         let mut key_buffer = SafeCell::new(ciphertext.to_vec());
 
         let decryption_result = key_buffer.write_inline(|write_handle| {
-            cipher.decrypt_in_place(nonce, associated_data, write_handle)
+            cipher.decrypt_in_place(&nonce, associated_data, write_handle)
         });
 
         match decryption_result {

server/crates/arbiter-server/tests/operator/unseal.rs

@@ -16,7 +16,7 @@ use arbiter_server::{
     },
 };
 
-use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use chacha20poly1305::{AeadInOut, XChaCha20Poly1305, XNonce, aead::KeyInit};
 use kameo::actor::Spawn as _;
 use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};