fix(deps): update cargo minor/patch updates (#1595)

Bumps the Cargo minor/patch updates from #1593 and fixes the code break the version-only bump left behind:

| Package | Update |
|---|---|
| chrono | `0.4.44` → `0.4.45` (patch) |
| prost | `0.14.3` → `0.14.4` (patch) |
| sha2 | `0.10` → `0.11` (minor) |

## Why a new PR

#1593 (Renovate) bumped only the manifest/lockfile. `sha2` 0.11 pulls in `digest` 0.11, whose `finalize()` now returns a `hybrid_array::Array` that no longer implements `LowerHex` — so the `format!("{:x}", …)` digest formatting in `self_update` no longer compiles, and every CI job on #1593 fails.

This PR adds a small `hex_encode` helper over the digest bytes and uses it at all four call sites, so the bump actually builds and passes.

## Verification

- `cargo build -p mergify-cli` ✅
- `cargo test -p mergify-cli` (self_update tests) ✅
- `cargo clippy --all-targets --workspace -- -D warnings` ✅
- `cargo fmt --check` ✅

Closes #1593.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: jd

Cargo.lock

@@ -33,7 +33,7 @@ mergify-stack = { path = "../mergify-stack" }
 # can't-rename-over-a-running-exe dance cross-platform.
 reqwest = { version = "0.13", default-features = false, features = ["rustls", "json"] }
 self-replace = "1"
-sha2 = "0.10"
+sha2 = "0.11"
 tempfile = "3"
 # Backs the `_internal dump-cli-schema` generator (serializing the
 # clap command tree) and the Python-migration helpers (`_internal

crates/mergify-cli/Cargo.toml

@@ -203,6 +203,18 @@ async fn download_text(client: &reqwest::Client, url: &str) -> Result<String, Cl
         .map_err(|e| CliError::Generic(format!("non-UTF8 body from {url}: {e}")))
 }
 
+/// Render digest bytes as a lowercase hex string. `sha2` 0.11 returns
+/// a `hybrid_array::Array` from `finalize()` that no longer implements
+/// `LowerHex`, so we format the bytes ourselves.
+fn hex_encode(bytes: &[u8]) -> String {
+    use std::fmt::Write;
+    let mut s = String::with_capacity(bytes.len() * 2);
+    for b in bytes {
+        let _ = write!(s, "{b:02x}");
+    }
+    s
+}
+
 /// Verify the downloaded archive's SHA256 against the entry for
 /// `asset_name` in `SHA256SUMS`. Mirrors `install.sh` exactly: the
 /// line must split as `<hash> <name>` on whitespace where the
@@ -237,7 +249,7 @@ fn verify_checksum(archive: &[u8], asset_name: &str, sums: &str) -> Result<(), C
     }
     let mut hasher = Sha256::new();
     hasher.update(archive);
-    let actual = format!("{:x}", hasher.finalize());
+    let actual = hex_encode(&hasher.finalize());
     if actual.eq_ignore_ascii_case(expected) {
         Ok(())
     } else {
@@ -351,7 +363,7 @@ mod tests {
         let archive = fixture_archive();
         let mut h = Sha256::new();
         h.update(&archive);
-        let hash = format!("{:x}", h.finalize());
+        let hash = hex_encode(&h.finalize());
         let sums = format!("{hash}  mergify-x86_64-unknown-linux-gnu.tar.gz\n");
         verify_checksum(&archive, "mergify-x86_64-unknown-linux-gnu.tar.gz", &sums).unwrap();
     }
@@ -385,7 +397,7 @@ mod tests {
         let archive = fixture_archive();
         let mut h = Sha256::new();
         h.update(&archive);
-        let hash = format!("{:x}", h.finalize());
+        let hash = hex_encode(&h.finalize());
         let sums = format!("{hash}  mergify-x86_64-pc-windows-msvc.zip\n");
         let err = verify_checksum(&archive, "msvc.zip", &sums).unwrap_err();
         assert!(
@@ -404,7 +416,7 @@ mod tests {
         let archive = fixture_archive();
         let mut h = Sha256::new();
         h.update(&archive);
-        let hash = format!("{:x}", h.finalize());
+        let hash = hex_encode(&h.finalize());
         let sums = format!("{hash}  mergify-x86_64-unknown-linux-gnu.tar.gz extra\n");
         let err = verify_checksum(&archive, "mergify-x86_64-unknown-linux-gnu.tar.gz", &sums)
             .unwrap_err();