From 4ffaeda5cf0da756ea05b6d13913ce3d775990d6 Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Sat, 7 Mar 2026 00:37:00 +0200
Subject: Declare hmac, sha2 and subtle at the workspace root

crates/server takes all three with workspace = true for the Stripe
webhook signature check, but the root manifest never defined them, so a
clean checkout did not resolve. They were already in the tree through
argon2; this only names them.
---
 Cargo.lock | 3 +++
 Cargo.toml | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 914002c..0cc0e5d 100755
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7578,11 +7578,14 @@ dependencies = [
  "dashmap",
  "dotenvy",
  "futures-util",
+ "hmac",
  "rand 0.8.8",
  "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "sqlx",
+ "subtle",
  "thiserror 1.0.69",
  "time",
  "tokio",
diff --git a/Cargo.toml b/Cargo.toml
index c5594dd..6a9ea46 100755
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -51,6 +51,11 @@ tower-http = { version = "0.5", features = ["cors", "trace", "set-header"] }
 # with them rsa, which carries RUSTSEC-2023-0071. Only Postgres is used.
 sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio-rustls", "postgres", "macros", "migrate", "time", "uuid"] }
 argon2 = "0.5"
+# Already in the tree through argon2; declared directly because the Stripe
+# webhook signature check needs them by name.
+hmac = "0.12"
+sha2 = "0.10"
+subtle = "2.6"
 # 0.12 moves to hyper 1.x, which brings h2 0.4 and rustls 0.23 with it.
 # 0.11 was the sole source of every remaining advisory in the server build:
 # h2 0.3, rustls-webpki 0.101, rustls-pemfile 1.0 and idna 0.3.
-- 
cgit v1.2.3