From 6d4c88f283ee7ab78ee676472e6bdce73e7dec2c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 18:08:18 +0000
Subject: [PATCH 1/3] fix(deps-rust): update rust dependencies

---
 Cargo.lock                                    | 160 ++++++++++++------
 Cargo.toml                                    |   8 +-
 crates/application/rook-usecases/Cargo.toml   |   4 +-
 crates/infrastructure/audit-sqlite/Cargo.toml |   2 +-
 4 files changed, 115 insertions(+), 59 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 33c8b51e..15c0525a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,12 +4,12 @@ version = 4
 
 [[package]]
 name = "aead"
-version = "0.5.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
- "crypto-common 0.1.7",
- "generic-array",
+ "crypto-common 0.2.2",
+ "inout 0.2.5",
 ]
 
 [[package]]
@@ -19,22 +19,33 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "aes"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
+dependencies = [
+ "cipher 0.5.2",
+ "cpubits",
+ "cpufeatures 0.3.1",
+]
+
 [[package]]
 name = "aes-gcm"
-version = "0.10.3"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
 dependencies = [
  "aead",
- "aes",
- "cipher",
+ "aes 0.9.3",
+ "cipher 0.5.2",
  "ctr",
+ "ctutils",
  "ghash",
- "subtle",
 ]
 
 [[package]]
@@ -161,13 +172,13 @@ dependencies = [
 
 [[package]]
 name = "argon2"
-version = "0.5.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c"
 dependencies = [
  "base64ct",
  "blake2",
- "cpufeatures 0.2.17",
+ "cpufeatures 0.3.1",
  "password-hash",
 ]
 
@@ -578,11 +589,11 @@ checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "blake2"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -749,7 +760,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -814,7 +825,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout",
+ "inout 0.1.4",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.5",
 ]
 
 [[package]]
@@ -866,6 +888,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -988,6 +1016,12 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1056,7 +1090,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -1066,16 +1099,27 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "ctr"
-version = "0.9.2"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+checksum = "fe3e9d21d39e6f39ff46e03d5b621424f88ee23d8a1672c6bfc9ccc7f2da4f6a"
 dependencies = [
- "cipher",
+ "cmov",
 ]
 
 [[package]]
@@ -1164,7 +1208,7 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
 dependencies = [
- "aes",
+ "aes 0.8.4",
  "block-padding",
  "cbc",
  "dbus",
@@ -1265,6 +1309,7 @@ dependencies = [
  "block-buffer 0.12.1",
  "const-oid",
  "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -1786,11 +1831,10 @@ dependencies = [
 
 [[package]]
 name = "ghash"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
 dependencies = [
- "opaque-debug",
  "polyval",
 ]
 
@@ -2320,6 +2364,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b5cf4372d022092674a83b8febf5865f7a573cc0c5baec5e49c879b6a20978f"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "instability"
 version = "0.3.14"
@@ -2546,9 +2599,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.2"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
+checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3"
 dependencies = [
  "cc",
  "pkg-config",
@@ -2968,12 +3021,6 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.2"
@@ -3153,13 +3200,12 @@ dependencies = [
 
 [[package]]
 name = "password-hash"
-version = "0.5.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b"
 dependencies = [
- "base64ct",
- "rand_core 0.6.4",
- "subtle",
+ "getrandom 0.4.3",
+ "phc",
 ]
 
 [[package]]
@@ -3201,6 +3247,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "phc"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892"
+dependencies = [
+ "base64ct",
+ "ctutils",
+ "getrandom 0.4.3",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -3240,13 +3297,12 @@ dependencies = [
 
 [[package]]
 name = "polyval"
-version = "0.6.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
 dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "opaque-debug",
+ "cpubits",
+ "cpufeatures 0.3.1",
  "universal-hash",
 ]
 
@@ -4094,9 +4150,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.40.2"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
+checksum = "9c026b4444579e8d754556c6c75d040d69c4a44283cdb648ab8a8d5965c2cfa8"
 dependencies = [
  "bitflags 2.13.2",
  "fallible-iterator",
@@ -4328,7 +4384,7 @@ version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4d35ad99a181be0a60ffcbe85d680d98f87bdc4d7644ade319b87076b9dbfd4"
 dependencies = [
- "aes",
+ "aes 0.8.4",
  "cbc",
  "futures-util",
  "generic-array",
@@ -5219,7 +5275,7 @@ dependencies = [
  "hex",
  "http-body-util",
  "models-catalog",
- "parking_lot 0.12.5",
+ "parking_lot 0.13.0",
  "providers-anthropic",
  "providers-ollama",
  "providers-openai",
@@ -5348,12 +5404,12 @@ checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
- "crypto-common 0.1.7",
- "subtle",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 2a6fff61..c7383f77 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -97,7 +97,7 @@ dashmap = "6"
 ttl_cache = "0.5"
 
 # Database
-rusqlite = { version = "0.40", features = ["bundled"] }
+rusqlite = { version = "0.41", features = ["bundled"] }
 
 # HTTP clients
 reqwest = { version = "0.13", features = ["form", "json", "rustls"], default-features = false }
@@ -109,7 +109,7 @@ figment = { version = "0.10", features = ["toml"] }
 
 # Utils
 once_cell = "1"
-parking_lot = "0.12"
+parking_lot = "0.13"
 dirs = "7"
 rand = { version = "0.10", features = ["std_rng"] }
 
@@ -117,8 +117,8 @@ rand = { version = "0.10", features = ["std_rng"] }
 clap = { version = "4", features = ["derive", "env"] }
 
 # Encryption
-aes-gcm = "0.10.3"
-argon2 = "0.5.3"
+aes-gcm = "0.11.0"
+argon2 = "0.6.0"
 base64 = "0.23"
 
 tempfile = "=3.27.0"
diff --git a/crates/application/rook-usecases/Cargo.toml b/crates/application/rook-usecases/Cargo.toml
index d9f1a043..5e52a8ba 100644
--- a/crates/application/rook-usecases/Cargo.toml
+++ b/crates/application/rook-usecases/Cargo.toml
@@ -55,6 +55,6 @@ hex = "0.4"
 
 [dev-dependencies]
 cortex-test-support = { path = "../../test-support" }
-tokio = { version = "1", features = ["test-util"] }
+tokio = { version = "=1.54.1", features = ["test-util"] }
 wiremock = "=0.6.5"
-serde_json = "1"
+serde_json = "=1.0.154"
diff --git a/crates/infrastructure/audit-sqlite/Cargo.toml b/crates/infrastructure/audit-sqlite/Cargo.toml
index 56ed7f07..e357f413 100644
--- a/crates/infrastructure/audit-sqlite/Cargo.toml
+++ b/crates/infrastructure/audit-sqlite/Cargo.toml
@@ -15,7 +15,7 @@ tokio = { version = "1", features = ["rt", "sync", "fs", "time"] }
 serde = { version = "1", features = ["derive"] }
 
 # Database
-rusqlite = { version = "0.40", features = ["bundled"] }
+rusqlite = { version = "0.41", features = ["bundled"] }
 
 # Time
 chrono = { version = "0.4", features = ["serde"] }

From 119734cd8a7aaf060e5f65110f54e4026476baf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yuniel=20Acosta=20P=C3=A9rez?=
 <33158051+yacosta738@users.noreply.github.com>
Date: Tue, 27 Oct 2026 21:42:46 +0100
Subject: [PATCH 2/3] fix(deps-rust): update crypto API usage for aes-gcm and
 argon2 (#491)

---
 Cargo.lock                                    | 66 +++++++++++++++++++
 crates/huginn/presentation/Cargo.toml         |  1 +
 crates/huginn/presentation/src/event.rs       | 16 ++---
 crates/huginn/presentation/tests/event.rs     |  6 +-
 crates/huginn/runtime/Cargo.toml              |  2 +-
 .../encryption-inmemory/src/key_manager.rs    | 16 ++---
 .../encryption-inmemory/src/password.rs       | 14 ++--
 7 files changed, 94 insertions(+), 27 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 15c0525a..25337844 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1216,6 +1216,7 @@ dependencies = [
  "hkdf",
  "num",
  "once_cell",
+ "openssl",
  "sha2 0.10.9",
  "zeroize",
 ]
@@ -1628,6 +1629,21 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -2069,6 +2085,7 @@ dependencies = [
  "huginn-plugin-api",
  "huginn-reference-extension",
  "portable-pty",
+ "rand 0.10.3",
  "ratatui",
  "rustix",
  "serde",
@@ -2544,6 +2561,7 @@ checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
 dependencies = [
  "dbus-secret-service",
  "log",
+ "openssl",
  "secret-service",
  "security-framework 2.11.1",
  "security-framework 3.7.0",
@@ -2579,6 +2597,7 @@ version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
 dependencies = [
+ "cc",
  "pkg-config",
 ]
 
@@ -3021,12 +3040,59 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
+[[package]]
+name = "openssl"
+version = "0.10.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e036b411754132fd6b74e94b74e9a13c5cf606fa93d1885c35860d3060820b1"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "opentelemetry"
 version = "0.33.1"
diff --git a/crates/huginn/presentation/Cargo.toml b/crates/huginn/presentation/Cargo.toml
index ba9f659e..969f1dbd 100644
--- a/crates/huginn/presentation/Cargo.toml
+++ b/crates/huginn/presentation/Cargo.toml
@@ -36,6 +36,7 @@ uuid.workspace = true
 ratatui = { version = "=0.30.2", default-features = false, features = ["crossterm"] }
 crossterm = { version = "=0.29.0", features = ["event-stream"] }
 unicode-width = "0.2"
+rand.workspace = true
 zeroize = "1"
 
 [target.'cfg(unix)'.dependencies]
diff --git a/crates/huginn/presentation/src/event.rs b/crates/huginn/presentation/src/event.rs
index f66dee3c..905af564 100644
--- a/crates/huginn/presentation/src/event.rs
+++ b/crates/huginn/presentation/src/event.rs
@@ -1,8 +1,6 @@
 //! Explicit UI event categories. UI-only events are never conversation entries.
-use aes_gcm::{
-    aead::{Aead, OsRng},
-    Aes256Gcm, KeyInit, Nonce,
-};
+use aes_gcm::{aead::Aead, Aes256Gcm, KeyInit, Nonce};
+use rand::RngExt;
 use std::collections::VecDeque;
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
@@ -108,11 +106,11 @@ impl ErrorDeduplicator {
         // Generate a fresh AES-256 key from the OS CSPRNG for this instance.
         // Nonces need uniqueness under this key, not randomness or separation
         // from the nonces used by other instances with independently generated keys.
-        let key = Aes256Gcm::generate_key(&mut OsRng);
+        let key_bytes: [u8; 32] = rand::rng().random();
         Self {
             clock,
             hash_message,
-            cipher: Aes256Gcm::new(&key),
+            cipher: Aes256Gcm::new_from_slice(&key_bytes).expect("32-byte key"),
             nonce_prefix: [0; 4],
             nonce_counter: 0,
             entries: VecDeque::new(),
@@ -136,8 +134,8 @@ impl ErrorDeduplicator {
             if entry.key != key {
                 return None;
             }
-            let nonce = Nonce::from_slice(&entry.fingerprint[..12]);
-            let plaintext = self.cipher.decrypt(nonce, &entry.fingerprint[12..]).ok()?;
+            let nonce = Nonce::try_from(&entry.fingerprint[..12]).ok()?;
+            let plaintext = self.cipher.decrypt(&nonce, &entry.fingerprint[12..]).ok()?;
             (plaintext == message.as_bytes()).then_some(index)
         }) {
             if now.saturating_sub(self.entries[index].last_visible) < ERROR_DEDUP_WINDOW {
@@ -168,7 +166,7 @@ impl ErrorDeduplicator {
         let nonce = [self.nonce_prefix.as_slice(), counter.as_slice()].concat();
         let ciphertext = self
             .cipher
-            .encrypt(Nonce::from_slice(&nonce), message.as_bytes())
+            .encrypt(&Nonce::try_from(nonce.as_slice()).expect("12-byte nonce"), message.as_bytes())
             .expect("AES-GCM encryption");
         let mut fingerprint = nonce;
         fingerprint.extend(ciphertext);
diff --git a/crates/huginn/presentation/tests/event.rs b/crates/huginn/presentation/tests/event.rs
index 5d237fb1..0add3ab7 100644
--- a/crates/huginn/presentation/tests/event.rs
+++ b/crates/huginn/presentation/tests/event.rs
@@ -1,5 +1,5 @@
 #[cfg(feature = "test-driver")]
-use aes_gcm::aead::rand_core::{OsRng, RngCore};
+use rand::RngExt;
 #[cfg(feature = "test-driver")]
 use huginn_presentation::event::test_support;
 use huginn_presentation::event::*;
@@ -199,9 +199,9 @@ fn dedup_instances_keep_independent_caches() {
 fn dedup_decryption_requires_the_matching_key_even_with_the_same_nonce() {
     let clock = Arc::new(FakeClock::at(0));
     let mut first_key = [0u8; 32];
-    OsRng.fill_bytes(&mut first_key);
+    first_key = rand::rng().random();
     let mut second_key = [0u8; 32];
-    OsRng.fill_bytes(&mut second_key);
+    second_key = rand::rng().random();
     if second_key == first_key {
         second_key[0] ^= 1;
     }
diff --git a/crates/huginn/runtime/Cargo.toml b/crates/huginn/runtime/Cargo.toml
index 1e09f105..aa0af109 100644
--- a/crates/huginn/runtime/Cargo.toml
+++ b/crates/huginn/runtime/Cargo.toml
@@ -44,7 +44,7 @@ process-wrap = { version = "10", features = ["tokio1", "process-group", "kill-on
 keyring = { version = "=3.6.3", default-features = false, features = ["apple-native"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-keyring = { version = "=3.6.3", default-features = false, features = ["sync-secret-service", "crypto-rust"] }
+keyring = { version = "=3.6.3", default-features = false, features = ["sync-secret-service", "crypto-rust", "vendored"] }
 
 [[test]]
 name = "tls_transport"
diff --git a/crates/infrastructure/encryption-inmemory/src/key_manager.rs b/crates/infrastructure/encryption-inmemory/src/key_manager.rs
index 9b18ca31..beb147f1 100644
--- a/crates/infrastructure/encryption-inmemory/src/key_manager.rs
+++ b/crates/infrastructure/encryption-inmemory/src/key_manager.rs
@@ -1,9 +1,10 @@
 use aes_gcm::{
-    aead::{Aead, AeadCore, KeyInit, OsRng},
+    aead::{Aead, KeyInit},
     Aes256Gcm, Nonce,
 };
-use argon2::{password_hash::SaltString, Argon2, PasswordHasher};
+use argon2::{password_hash::PasswordHasher, Argon2};
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use rand::RngExt;
 use rook_core::ports::{CredentialEncryptionError, KeyManager};
 
 use super::{EncryptionError, Result};
@@ -32,10 +33,8 @@ impl AesGcmKeyManager {
             argon2::Params::new(65_536, 3, 4, Some(32))
                 .map_err(|_| EncryptionError::KeyDerivation)?,
         );
-        let salt =
-            SaltString::encode_b64(&salt_bytes).map_err(|_| EncryptionError::KeyDerivation)?;
         let hash = argon2
-            .hash_password(passphrase.as_bytes(), &salt)
+            .hash_password_with_salt(passphrase.as_bytes(), &salt_bytes)
             .map_err(|_| EncryptionError::KeyDerivation)?;
         let hash_output = hash.hash.ok_or(EncryptionError::KeyDerivation)?;
 
@@ -53,7 +52,8 @@ impl AesGcmKeyManager {
 
         let cipher =
             Aes256Gcm::new_from_slice(&self.key).map_err(|_| EncryptionError::CipherError)?;
-        let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
+        let nonce_bytes: [u8; NONCE_BYTES] = rand::rng().random();
+        let nonce = Nonce::try_from(nonce_bytes.as_slice()).expect("12-byte nonce");
         let ciphertext = cipher
             .encrypt(&nonce, plaintext.as_bytes())
             .map_err(|_| EncryptionError::CipherError)?;
@@ -88,9 +88,9 @@ impl AesGcmKeyManager {
 
         let cipher =
             Aes256Gcm::new_from_slice(&self.key).map_err(|_| EncryptionError::CipherError)?;
-        let nonce = Nonce::from_slice(&nonce_bytes);
+        let nonce = Nonce::try_from(nonce_bytes.as_slice()).expect("12-byte nonce");
         let plaintext = cipher
-            .decrypt(nonce, ciphertext_with_tag.as_ref())
+            .decrypt(&nonce, ciphertext_with_tag.as_ref())
             .map_err(|_| EncryptionError::DecryptKey)?;
 
         String::from_utf8(plaintext).map_err(|_| EncryptionError::DecryptFormat)
diff --git a/crates/infrastructure/encryption-inmemory/src/password.rs b/crates/infrastructure/encryption-inmemory/src/password.rs
index f4888850..81ef8d28 100644
--- a/crates/infrastructure/encryption-inmemory/src/password.rs
+++ b/crates/infrastructure/encryption-inmemory/src/password.rs
@@ -1,9 +1,11 @@
 use argon2::{
-    password_hash::{rand_core::OsRng, PasswordHash, PasswordVerifier},
-    Argon2, PasswordHasher as _,
+    password_hash::phc::PasswordHash,
+    password_hash::{PasswordHasher, PasswordVerifier},
+    Argon2,
 };
+use rand::RngExt;
 use rook_core::model::PasswordHash as CorePasswordHash;
-use rook_core::ports::{PasswordHashError, PasswordHasher};
+use rook_core::ports::{PasswordHashError, PasswordHasher as CorePasswordHasher};
 
 /// Argon2id password hasher using the argon2 crate's password_hash API.
 ///
@@ -30,16 +32,16 @@ impl Default for Argon2idHasher {
     }
 }
 
-impl PasswordHasher for Argon2idHasher {
+impl CorePasswordHasher for Argon2idHasher {
     fn hash_password(&self, password: &str) -> Result<CorePasswordHash, PasswordHashError> {
         // Generate a random salt using OS RNG (16 bytes is the default)
-        let salt = argon2::password_hash::SaltString::generate(&mut OsRng);
+        let salt_bytes: [u8; 16] = rand::rng().random();
 
         // Hash the password with Argon2id using default (OWASP) params
         // Argon2::default() uses: m=65536 (64MB), t=3, p=1
         let hash = self
             .argon2
-            .hash_password(password.as_bytes(), &salt)
+            .hash_password_with_salt(password.as_bytes(), &salt_bytes)
             .map_err(|_| PasswordHashError::HashGeneration)?;
 
         Ok(CorePasswordHash::from(hash.to_string()))

From 972ac0ee490bf9fa1b2a3f07ba6207dcf412af50 Mon Sep 17 00:00:00 2001
From: Ryuk Null <286979232+ryuknull@users.noreply.github.com>
Date: Wed, 28 Oct 2026 00:20:29 +0100
Subject: [PATCH 3/3] style(huginn): fix event formatting

---
 crates/huginn/presentation/src/event.rs   | 5 ++++-
 crates/huginn/presentation/tests/event.rs | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/crates/huginn/presentation/src/event.rs b/crates/huginn/presentation/src/event.rs
index 905af564..34eb08b3 100644
--- a/crates/huginn/presentation/src/event.rs
+++ b/crates/huginn/presentation/src/event.rs
@@ -166,7 +166,10 @@ impl ErrorDeduplicator {
         let nonce = [self.nonce_prefix.as_slice(), counter.as_slice()].concat();
         let ciphertext = self
             .cipher
-            .encrypt(&Nonce::try_from(nonce.as_slice()).expect("12-byte nonce"), message.as_bytes())
+            .encrypt(
+                &Nonce::try_from(nonce.as_slice()).expect("12-byte nonce"),
+                message.as_bytes(),
+            )
             .expect("AES-GCM encryption");
         let mut fingerprint = nonce;
         fingerprint.extend(ciphertext);
diff --git a/crates/huginn/presentation/tests/event.rs b/crates/huginn/presentation/tests/event.rs
index 0add3ab7..563e7f65 100644
--- a/crates/huginn/presentation/tests/event.rs
+++ b/crates/huginn/presentation/tests/event.rs
@@ -1,8 +1,8 @@
 #[cfg(feature = "test-driver")]
-use rand::RngExt;
-#[cfg(feature = "test-driver")]
 use huginn_presentation::event::test_support;
 use huginn_presentation::event::*;
+#[cfg(feature = "test-driver")]
+use rand::RngExt;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::{sync::Arc, time::Duration};