[e54-bot]

Supersedes #44 (Dependabot). I did not close #44.

The #44 Rust (1.85.0) / Quality check failed with E0277: sha2 0.11 digests are hybrid_array::Array values and no longer implement LowerHex, so format!("{:x}", hasher.finalize()) in the mock provider does not compile. sha256_hex now formats the digest byte by byte. Output is unchanged (lower-case hex).

MSRV stays 1.85.0. sha2 0.11.0 builds on it; 0.11.1 requires Rust 1.88, so the lock file pins 0.11.0.

Validation on 1.85.0 at the head commit: cargo fmt --all --check, cargo clippy --locked --workspace --all-targets -- -D warnings, cargo test --workspace --locked, cargo build --locked, fixture validation, and 67/67 conformance against the mock all pass. The first head (0385326) failed clippy::format_collect; the second commit fixes it with a fold and write!.

[Teakowa]

Verdict: changes requested (round 1). The migration is correct, but Rust (1.85.0) / Quality fails on this head (0385326).

Blocking: conformance/mock-provider/src/methods.rs:439-443.
The new sha256_hex fails cargo clippy --locked ... -- -D warnings with clippy::format_collect ("use of format! to build up a string from an iterator"). CI job 118753954028 fails, and I reproduced it locally on the pinned 1.85.0 toolchain with cargo clippy --locked --workspace --all-targets -- -D warnings. The PR body says clippy passed. It does not on this head.

• Fix: avoid an allocation per byte, for example use std::fmt::Write; then .fold(String::new(), |mut hex, byte| { write!(hex, "{byte:02x}").expect("writing to a String cannot fail"); hex }). A #[allow] with a reason also works, but the fold is simpler.
• Because Quality fails, the conformance job was skipped on CI. Please confirm that it passes after the fix.

Checked and fine

1. Minimum migration: one dependency line (sha2 = "0.11") and one function. No other source change.
2. MSRV: no rust-version field and no toolchain change. The lock pins sha2 0.11.0, so the claim that 0.11.1 needs Rust 1.88 and that 1.85 stays valid is consistent with the build.
3. Digest output: sha256_hex still produces lowercase two-digit hex. Locally, the mock builds and conformance passes 67/67. The fixtures that assert sourceIdentity compare against fixed digest values, so a changed encoding would fail them.
4. Lock drift: only the RustCrypto stack moved. These are the sha2 0.10.9 to 0.11.0 bump, digest, block-buffer, crypto-common, cpufeatures, plus the new const-oid and hybrid-array (replacing generic-array and version_check). No unrelated crate changed.

Not found: .github/docs/pr-review.md does not exist in this repo, so I reviewed against the task instructions.

[Teakowa]

Approve (round 2). The round-1 blocker is fixed at 21bce18.

• sha256_hex now uses fold with write!. On the pinned 1.85.0 toolchain, cargo clippy --locked --workspace --all-targets -- -D warnings is clean and cargo fmt --all --check passes.
• CI on GitHub is green: Rust (1.85.0) / Quality passes and conformance now runs and passes. Locally, conformance passes 67/67.
• Digest output is unchanged. The format is still lowercase two-digit hex. Fixture 43 (project-loading-source-identity) asserts a fixed SHA-256 in sourceIdentity, the fixture is untouched by this PR, and it still passes. I did not run a separate known-vector test, for example abc giving ba7816bf….
• The earlier checks still hold: minimum migration, no MSRV change, and Cargo.lock drift limited to the RustCrypto stack.