From 28f6e51194c6515b2ae571ebb690b1f8b20a4d2f Mon Sep 17 00:00:00 2001
From: Yohei Kitamura <ykitamura@mdsol.com>
Date: Thu, 23 Jul 2026 08:43:29 +0900
Subject: [PATCH] Pin dependencies for rsa, sha2, and spki to maintain
 compatibility with stable versions

---
 .github/dependabot.yml | 5 +++++
 Cargo.toml             | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0a34507..c282f3b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,11 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+    # Keep these pinned until a stable rsa 0.10+ release is adopted.
+    ignore:
+      - dependency-name: "rsa"
+      - dependency-name: "sha2"
+      - dependency-name: "spki"
     groups:
       cargo:
         patterns:
diff --git a/Cargo.toml b/Cargo.toml
index 3e8d26f..237f653 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,8 +17,10 @@ thiserror = "2"
 base64 = "0.22"
 hex = "0.4"
 lazy-regex = "3"
+# Keep these crypto dependencies on stable, compatible versions.
+# rsa 0.9 uses digest 0.10; moving to sha2 0.11 requires rsa 0.10, which is still RC.
 rsa = "0.9.0"
-regex = { version = "1", default_features = false, features = ["std"] }
+regex = { version = "1", default-features = false, features = ["std"] }
 sha2 = { version = "0.10", features = ["oid"] }
 urlencoding = "2"
 spki = "0.7"