2 files changed, 8 insertions, 0 deletions
diff --git a/Cargo.lock b/Cargo.lock
index 914002c..0cc0e5d 100755
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7578,11 +7578,14 @@ dependencies = [
  "dashmap",
  "dotenvy",
  "futures-util",
+ "hmac",
  "rand 0.8.8",
  "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "sqlx",
+ "subtle",
  "thiserror 1.0.69",
  "time",
  "tokio",
diff --git a/Cargo.toml b/Cargo.toml
index c5594dd..6a9ea46 100755
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -51,6 +51,11 @@ tower-http = { version = "0.5", features = ["cors", "trace", "set-header"] }
 # with them rsa, which carries RUSTSEC-2023-0071. Only Postgres is used.
 sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio-rustls", "postgres", "macros", "migrate", "time", "uuid"] }
 argon2 = "0.5"
+# Already in the tree through argon2; declared directly because the Stripe
+# webhook signature check needs them by name.
+hmac = "0.12"
+sha2 = "0.10"
+subtle = "2.6"
 # 0.12 moves to hyper 1.x, which brings h2 0.4 and rustls 0.23 with it.
 # 0.11 was the sole source of every remaining advisory in the server build:
 # h2 0.3, rustls-webpki 0.101, rustls-pemfile 1.0 and idna 0.3.