chore(deps): apply available major bumps (sha2 0.11, rand 0.10) and tighten maintenance spec (#106)

- Bump sha2 0.10 -> 0.11 (drop-in for our Digest + Sha256 usage)
- Bump rand 0.8 -> 0.10; switch generate_nonce to rand::random() since rand::thread_rng() and crate-root RngCore were removed
- Tighten specs/maintenance.md §1 to require evaluating/applying major bumps via cargo upgrade --incompatible, not just cargo update

Both bumps cover only the optional bot-auth feature. Verified clippy + tests + doctests + docs + release build with and without bot-auth.

Author: chaliy

CHANGELOG.md

@@ -10,7 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - chore(deps): refresh `Cargo.lock` to latest compatible versions (tokio 1.52, reqwest 0.13.3, rustls 0.23.40, tower-http 0.6.10, rustls-platform-verifier 0.7, pyo3 0.28.3, and others)
+- chore(deps): bump `sha2` 0.10 → 0.11 and `rand` 0.8 → 0.10 for the optional `bot-auth` feature; switched the nonce generator to `rand::random()` since `rand::thread_rng()` was removed in rand 0.10
 - docs: document conditional-request, content-focus, ETag, metadata, word count, redirect chain, and paywall fields in spec and README
+- docs(specs): require deep maintenance to apply available major (SemVer-incompatible) dep bumps, not just `cargo update`
 
 ### Maintenance
 

Cargo.lock

@@ -55,5 +55,5 @@ tower = { version = "0.5", features = ["util"] }
 # Crypto (bot-auth feature)
 ed25519-dalek = { version = "2", features = ["rand_core"] }
 base64 = "0.22"
-sha2 = "0.10"
-rand = "0.8"
+sha2 = "0.11"
+rand = "0.10"

Cargo.toml

@@ -22,7 +22,6 @@
 
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use ed25519_dalek::{Signer, SigningKey, VerifyingKey};
-use rand::RngCore;
 use sha2::{Digest, Sha256};
 use std::time::{SystemTime, UNIX_EPOCH};
 
@@ -161,8 +160,7 @@ fn jwk_thumbprint_ed25519(key: &VerifyingKey) -> String {
 
 /// Generate a cryptographically random nonce (32 bytes, base64url-encoded).
 fn generate_nonce() -> String {
-    let mut bytes = [0u8; 32];
-    rand::thread_rng().fill_bytes(&mut bytes);
+    let bytes: [u8; 32] = rand::random();
     URL_SAFE_NO_PAD.encode(bytes)
 }
 

crates/fetchkit/src/bot_auth.rs

@@ -8,13 +8,23 @@ Define recurring maintenance tasks to keep the fetchkit repository healthy, up-t
 
 ### 1. Dependency Updates
 
-Update all workspace and crate-level dependencies to their latest compatible versions.
+Update all workspace and crate-level dependencies to their latest versions, including major
+(SemVer-incompatible) bumps. Maintenance must not stop at `cargo update`; it must also
+bump the manifest constraints in `Cargo.toml` for available major versions and adapt the
+code where the API has changed.
 
 1. **Check outdated deps** - Run `cargo outdated -R` (or equivalent) to list stale dependencies
 2. **Update minor/patch** - Apply non-breaking updates via `cargo update`
-3. **Evaluate major bumps** - Major version upgrades are allowed; review changelogs for breaking changes and adapt code accordingly
+3. **Evaluate and apply major bumps** - Run `cargo upgrade --incompatible --dry-run`
+   (from `cargo-edit`) to enumerate available major upgrades. Bump the manifest
+   constraints in `Cargo.toml` for each one, read the upstream changelog/migration
+   notes, and adapt the code (imports, renamed functions, removed APIs). A
+   maintenance pass that ships only `cargo update` is incomplete — call out any
+   major bump that is intentionally deferred, with the reason, in the PR body and
+   `CHANGELOG.md`.
 4. **Verify lockfile** - Ensure `Cargo.lock` reflects the updated versions
-5. **Build & test** - `cargo build --workspace && cargo test --workspace` must pass after updates
+5. **Build & test** - `cargo build --workspace && cargo test --workspace` must pass
+   after updates, with and without optional features (e.g. `--features bot-auth`)
 6. **Audit advisories** - Run `cargo audit` (if available) to check for known vulnerabilities
 
 ### 2. Documentation Quality (docs.rs / rustdoc)