From 97a62b37626b95e6f93f07dfbd8e32488aa4f8ae Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 02:26:33 +0000
Subject: [PATCH] Bump sha2 from 0.10.9 to 0.11.0

Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.9 to 0.11.0.
- [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.10.9...sha2-v0.11.0)

---
updated-dependencies:
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock               | 2 +-
 crates/engine/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f6b368b1..bd66df5e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1068,7 +1068,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml_ng",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "shaderc",
  "signalsmith-stretch",
  "skrifa 0.45.1",
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 9acee72d..04768e30 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -153,7 +153,7 @@ vello = { version = "0.11", default-features = false, features = ["wgpu"] }
 # docs/research/integrations.md §7.1.
 ureq = "2.12"
 # Model downloads are verified against a pinned SHA-256.
-sha2 = "0.10"
+sha2 = "0.11"
 # `secrets.toml` and `accounts.toml`.
 toml = "0.8"
 # ElevenLabs sends speech with timestamps as base64 inside JSON. Already in