deps: bump orion from 0.17.15 to 0.18.0

[dependabot]

Bumps orion from 0.17.15 to 0.18.0.

Release notes

Sourced from orion's releases.

0.18.0

Changelog:

See CHANGELOG.md.

0.18.0-rc.1

Changelog:

See CHANGELOG.md.

Changelog

Sourced from orion's changelog.

0.18.0

Date: August 30, 2026.

Note: This release contains many breaking changes and updates to almost every part of the crate. Feel free to open an issue if something seems off.

A doc/MIGRATION guide has been written to give a better overview than this exhaustive list.

Changelog:

• [Breaking change] Rust Edition moved from 2021 to 2024.
• [Breaking change] auth::SecretKey has been changed to reference directly the hazardous type instead: crate::hazardous::mac::blake2b::SecretKey.
• [Breaking change] T::generate() -> Self -> T::generate() -> Result<T, UnknownCryptoError> where this was not already the case. All T::generate() calls are now fallible and return UnknownCryptoError so all OS-related errors can be handled.
• [Breaking change] T::from_slice() is no longer provided. Instead, all types provide: TryFrom<&[u8]>, TryFrom<&Vec<u8>> and TryFrom<&[u8; N]> + From<[N]> where applicable.
• [Breaking change] T::unprotected_as_bytes() -> T::unprotected_as_ref().
• [Breaking change] High-level types used in non-hazardous API no longer implement Default with a panicking CSPRNG call. Instead generate() -> Result<Self, UnknownCryptoError> is provided exclusively.
• [Breaking change] High-level types used in non-hazardous API no longer implement T::generate(length: usize). They simply generate with bytelength 32.
• [Breaking change] HPKE implementation has been redesigned for modularity and easier maintainability.
• [Breaking change] HKDF functions have been moved to specific struct (for example ::hkdf::sha256 is now ::hkdf::Hkdf<SHA256>).
• [Breaking change] ML-KEM and X-Wing API have undergone large re-design:
  • [Breaking change] mlkem*:MlKem* struct no longer exists, and all functionality has been moved to the respective KeyPair, EncapsulationKey and DecapsulationKey types.
  • [Breaking change] ML-KEM DecapsulationKeys no longer perform key-caching. This has been moved to KeyPair. KeyPair therefor offers important performance benefits when decapsulating with the same secret more than once.
  • [Breaking change] Constants previously associated with the zero-sized structs are now in mlkem*:: modules.
  • [Breaking change] ML-KEM DecapuslationKeys can now return the raw, encoded bytes.
  • [Breaking change] X-Wing now has separate type for explicit randomness Eseed used during encapsulation operations.
• [Breaking change] orion::kdf::Password and orion::pwhash::Password no longer has generate() since it is meant to represent a user-supplied password (one of the many drawbacks of the older macro-based approach).
• [Breaking change] Types that previously implemented Copy do not anymore. Copy in all cases requires copying a lot of bytes and could hide a performance penalty, so now only Clone is available for Public<T>.
• [Breaking change] orion::hazardous::ecc::x25519::PublicKey no longer stores the u-coordinate in masked form, but original byte slice. The PartialEq still respects (applies masking) the u-coordinate condition. Masking is applied before Montgomery ladder.
• [Breaking change] orion::hazardous::ecc::x25519::SecretKey no longer stores the clamped scalar, but the original byte slice. This changes the inherited PartialEq, which now operates on the original bytes, not the clamped. Clamping is applied before Montgomery ladder.
• [Breaking change] orion::hazardous::ecc::x25519::SharedSecret now respects (applies masking) the u-coordinate condition for PartialEq.
• [Breaking change] orion::hazardous::kem::xwing::EncapsulationKey now fails on TryFrom<&[u8]> if the ML-KEM-768 public-part does not pass the FIPS-203 keys checks.
• [Breaking change] orion::hazardous::kem::x25519_hkdf_sha256 uses as separate PrivateKey type to ensure RFC9180 SerializePrivateKey() and DeserializePrivateKey() clamping requirements are uphled.
• [Breaking change] orion::hazardous::kem::x25519_hkdf_sha256 DhKem has been renamed to KeyPair to match the same API the remaining KEM interfaces have.
  • This was previously a part of orion::hazardous::ecc::x25519::SecretKey but has been moved to HPKE, since it is a HPKE-specific requirement.
• [Breaking change] orion::hazardous::stream:
  • [Breaking change]: Remove chacha20::encrypt(), chacha20::decrypt(), xchacha20::encrypt() and xchacha20::decrypt().
  • Add structs ChaCha20 and XChaCha20 that can be used for encryption/decryption and with a more stream-oriented API (including seeking ahead).
• [Breaking change] orion::hazardous::aead:
  • [Breaking change]: Remove chacha20poly1305::seal(), chacha20poly1305::open(), xchacha20poly1305::seal() xchacha20poly1305::open().
  • Add structs ChaCha20Poly1305 and XChaCha20Poly1305 that offer equivalent open() and seal() functions from versions prior to 0.18.0.
  • Add support for seal_inplace() and open_inplace() for ChaCha20Poly1305 and XChaCha20Poly1305. These overwrite data directly instead of copying and allow handling the authentication tag separately.
• [Breaking change] orion::hazardous::kdf::argon2:
  • Functions moved to Argon2<Variant, Threading> struct.
  • Added Argon2::derive_key_encoded() and Argon2::verify_encoded() that work on P-H-C strings.
  • Hazardous now contains safe_api feature-gated PasswordHash.
  • Add CostParams struct being passes to functions.
• [Breaking change] orion::pwhash now uses Argon2id:
  • See doc/MIGRATION on how to migrate existing 0.17 orion::pwhash::PasswordHashes.
  • PasswordHash::unprotected_as_encoded() -> PasswordHash::unprotected_as_str().
  • PasswordHash is nonw a wrapper around the PHC-encoded string only:

... (truncated)

Commits

• a65653b Update CHANGELOG
• 728d74c 0.18.0: Prepare release (#668)
• 0694af9 ci: bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.8 (#667)
• 4a5cc86 ci: bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#661)
• 61155c5 test_framework: Ensure AAD is actually mutated to avoid flaky tests
• f976758 signer/hpke: Basic rountrip tests in high-level
• 3008b61 mldsa: Remove unused ring arithmetic operations
• 93c58bc mldsa: Missing tests
• 2d28a02 argon2/scrypt: Add missing cost_params() test
• d647085 Update CHANGELOG
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/vitest

The overall line coverage in commit e8188c3 in the dependabot/cargo/ori... branch remains at 66%, unchanged from commit 77fdb39 in the main branch.