build(deps): bump the zcash-sapling group in /crate with 2 updates

[dependabot]

Bumps the zcash-sapling group in /crate with 2 updates: sapling-crypto and zip32.

Updates sapling-crypto from 0.7.0 to 0.9.0

Changelog

Sourced from sapling-crypto's changelog.

[0.9.0] - 2026-09-30

Changed

• Migrated to incrementalmerkletree 0.9.
• The proptest dependency (used by the test-dependencies feature flag) now accepts any 1.x version.

[0.8.0] - 2026-09-29

Added

• zeroize feature flag (enabled by default), which enables the zeroize dependency (without its default features, so no_std is preserved), turns on jubjub/zeroize, redjubjub/zeroize and zip32/zeroize, and provides:
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for sapling_crypto::keys::SpendAuthorizingKey
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for sapling_crypto::keys::ExpandedSpendingKey
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for sapling_crypto::keys::ProofGenerationKey
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for sapling_crypto::zip32::ExtendedSpendingKey
  • impl zeroize::Zeroize for sapling_crypto::keys::OutgoingViewingKey
  • impl zeroize::Zeroize for sapling_crypto::zip32::DiversifierKey When enabled, the spending-key types are zeroized on drop, and the intermediate values produced while deriving them are zeroized after use.
• sapling_crypto::SaplingIvk::from_bytes
• sapling_crypto::ViewingKey::{from_parts, ak, nk}
• sapling_crypto::ProofGenerationKey::{from_parts, ak, nsk}
• sapling_crypto::keys::ExpandedSpendingKey::{from_parts, ask, nsk, ovk}
• sapling_crypto::keys::DecodingError::InvalidIvk
• sapling_crypto::zip32::ExtendedSpendingKey::expsk
• sapling_crypto::zip32::ExtendedFullViewingKey::fvk
• sapling_crypto::note_encryption::{NotePlaintextBytes, NoteCiphertextBytes, CompactNotePlaintextBytes, CompactNoteCiphertextBytes}

Changed

• MSRV is now 1.88
• Migrated to ff 0.14, group 0.14, rand/rand_core 0.10, bls12_381 0.9, jubjub 0.11, redjubjub 0.9, zcash_note_encryption 0.5, bellman 0.15, groth16 0.2, zip32 0.3.
• rand_core 0.10 merges RngCore into Rng, so every public API that was bounded by R: RngCore is now bounded by R: Rng.
• bellman's Groth16 implementation now lives in the standalone groth16 crate, which the circuit feature depends on alongside bellman. The SpendProver::Proof and OutputProver::Proof types of circuit::{SpendParameters, OutputParameters} are now groth16::Proof<Bls12> (previously bellman::groth16::Proof<Bls12>).
• The test-dependencies feature now enables rand/std_rng.
• impl Distribution<Node> for rand::distributions::Standard (under the test-dependencies feature) is now impl Distribution<Node> for rand::distr::StandardUniform.
• Migrated to the generalized zcash_note_encryption::Domain, which makes the note plaintext size variable. COMPACT_NOTE_SIZE, NOTE_PLAINTEXT_SIZE, and ENC_CIPHERTEXT_SIZE are no longer re-exported from zcash_note_encryption

... (truncated)

Commits

• adaeb7a Release sapling-crypto version 0.9.0
• e37b988 cargo vet: cover the zcash_note_encryption 0.5.1 and chacha20poly1305 0.11 up...
• 2ba74e0 Update the chacha20poly1305 dev-dependency to 0.11
• 02f5fc7 Update to zcash_note_encryption 0.5.1
• 0577e2c Relax the proptest requirement to any 1.x version
• b56600e Migrate to incrementalmerkletree 0.9
• bb2e3f9 Migrate to aes 0.9 and fpe 0.7
• cc46e36 Merge pull request #210 from zcash/release/0.8.0
• 76ac17a Release sapling-crypto version 0.8.0
• 38de29b CHANGELOG: fill gaps found by auditing the diff since 0.7.0
• Additional commits viewable in compare view

Updates zip32 from 0.2.1 to 0.3.0

Changelog

Sourced from zip32's changelog.

[0.3.0] - 2026-09-29

Added

• zeroize feature flag (enabled by default), which enables:
  • impl zeroize::Zeroize for zip32::ChainCode
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for zip32::hardened_only::HardenedOnlyKey
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for zip32::registered::SecretKey
  • impl zeroize::{Zeroize, ZeroizeOnDrop} for zip32::arbitrary::SecretKey When enabled, HardenedOnlyKey (and therefore both SecretKey types) are zeroized on drop, including every intermediate key produced while deriving a path, and the intermediate 64-byte PRF outputs used during derivation.
• impl Debug for zip32::registered::SecretKey and impl Debug for zip32::arbitrary::SecretKey (redacted).

Changed

• MSRV is now 1.85.0.
• impl Debug for zip32::hardened_only::HardenedOnlyKey no longer prints the secret key material; it now renders as HardenedOnlyKey { .. }.

Commits

• 83f2b27 v0.3.0
• 5818c78 Bump MSRV to 1.85
• 0399cd6 Merge pull request #30 from zcash/dependabot/github_actions/actions/checkout-6
• 389aa5c Merge pull request #34 from nullcopy/zeroize-secret-keys
• fa7bab0 Enable the zeroize feature by default
• 9bc1ef1 Zeroize hardened-only secret keys on drop behind a zeroize feature
• 28640fa Bump actions/checkout from 5 to 6
• f51f3d2 Merge pull request #29 from zcash/zip32-0.2.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions