Skip to content

Bump constant_time_eq from 0.3.1 to 0.5.0 in /codex-rs - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/codex-rs/main/constant_time_eq-0.5.0
Open

Bump constant_time_eq from 0.3.1 to 0.5.0 in /codex-rs#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/codex-rs/main/constant_time_eq-0.5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown

Bumps constant_time_eq from 0.3.1 to 0.5.0.

Changelog

Sourced from constant_time_eq's changelog.

0.5.0

  • Unfortunately, the Rust-version aware resolver only has an effect if the main crate being compiled is using edition 2024 or opts in, it's not enough to have edition 2024 in a dependency. Yanked 0.4.3 and released 0.5.0; no changes other than the version number. Being able to add new inline assembly architectures without requiring a manual version update in all dependent crates will have to wait until most of the ecosystem is using edition 2024.

0.4.3 (yanked)

  • Rust 1.95.0 stabilized inline assembly for PowerPC. Increase the Rust minimum version to allow its use. Cargo's version-aware dependency resolution should prevent this from being a breaking change.

0.4.2

  • Refactor detection of the DIT feature on ARM. For builds without the "std" feature, there's now an undocumented function to force the use of the DIT bit.

0.4.1

  • Simplify code to make it easier to review.

0.4.0

BREAKING CHANGE: this crate now has a "std" feature which is enabled by default. Disable it if you need to use this crate as a no_std crate.

Previous versions of this crate protected against the optimizer doing an early exit when the accumulator becomes non-zero (found a difference), but not against a sufficiently smart optimizer doing an early exit when the accumulator has all bits set (the accumulator never clears a bit, so having all bits set means it will no longer change).

Protecting against that also prevents autovectorization, so this release does manual vectorization to recover most of the speed lost. Where there is enough compiler support (stable vector intrinsics), it uses a mix of vector intrinsics and inline assembly for inputs which are a multiple of the vector size, while for other architectures and for the remainder of an input which is not a multiple of the vector size, it uses a generic word-at-a-time implementation with the native word size.

Some newer implementations of the ARM architecture do not guarantee the timing of instructions unless the DIT bit is set. Fortunately, that bit can be set on all privilege levels; unfortunately, that bit only exists on these newer implementations of the ARM architecture, and the flag to detect whether it exists is not accessible on all privilege levels. How

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 28, 2026
@dependabot
dependabot Bot requested a review from bproject07 as a code owner July 28, 2026 21:40
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 28, 2026
Bumps [constant_time_eq](https://github.com/cesarb/constant_time_eq) from 0.3.1 to 0.5.0.
- [Changelog](https://github.com/cesarb/constant_time_eq/blob/main/CHANGES)
- [Commits](cesarb/constant_time_eq@0.3.1...0.5.0)

---
updated-dependencies:
- dependency-name: constant_time_eq
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/codex-rs/main/constant_time_eq-0.5.0 branch from 255a00e to 1779356 Compare July 29, 2026 04:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants