fix(deps): Adapt code to breaking dependency changes

Several of the Renovate-bumped dependencies have breaking API changes
that need code fixes, and two bumps are incompatible with the rest of
the dependency tree and need to be reverted.

sha2 0.11: Removed the "std" feature (no longer exists) and dropped
the std::io::Write impl on Sha256. Added a DigestWrite<D> wrapper in
composefs::util to bridge the gap for SplitStreamReader::cat() callers.

rand 0.10: sample_iter() and random_range() moved from Rng to RngExt.
Updated imports accordingly.

toml 1.0: from_str() now requires the "serde" feature; added it.

oci-spec 0.9: Reverted to 0.8 because containers-image-proxy 0.9.2
depends on oci-spec 0.8, creating incompatible types across the
dependency boundary.

fuser 0.17: Reverted to 0.15.1 because the Filesystem trait now
requires Send + Sync, which would need significant architectural
changes (Rc -> Arc, RefCell -> RwLock) in composefs-fuse.

Assisted-by: OpenCode (Claude Opus 4)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

crates/composefs-fuse/Cargo.toml

@@ -13,6 +13,6 @@ version.workspace = true
 [dependencies]
 anyhow = { version = "1.0.98", default-features = false }
 composefs = { workspace = true }
-fuser = { version = "0.17.0", default-features = false, features = ["abi-7-31"] }
+fuser = { version = "0.15.1", default-features = false, features = ["abi-7-31"] }
 log = { version = "0.4.8", default-features = false }
 rustix = { version = "1.0.0", default-features = false, features = ["fs", "mount"] }

crates/composefs-http/src/lib.rs

@@ -14,6 +14,7 @@ use std::{
 
 use anyhow::{bail, Result};
 use bytes::Bytes;
+use composefs::util::DigestWrite;
 use indicatif::{ProgressBar, ProgressStyle};
 use reqwest::{Client, Response, Url};
 use sha2::{Digest, Sha256};
@@ -199,7 +200,7 @@ impl<ObjectID: FsVerityHashValue> Downloader<ObjectID> {
         // TODO: This can definitely happen in parallel...
         for (id, expected_checksum) in splitstreams {
             let mut reader = self.open_splitstream(&id)?;
-            let mut context = Sha256::new();
+            let mut context = DigestWrite(Sha256::new());
             reader.cat(&self.repo, &mut context)?;
             let measured_checksum = format!("sha256:{}", hex::encode(context.finalize()));
 

crates/composefs-oci/Cargo.toml

@@ -19,7 +19,7 @@ composefs = { workspace = true }
 containers-image-proxy = { version = "0.9.2", default-features = false }
 hex = { version = "0.4.0", default-features = false }
 indicatif = { version = "0.18.0", default-features = false, features = ["tokio"] }
-oci-spec = { version = "0.9.0", default-features = false }
+oci-spec = { version = "0.8.0", default-features = false }
 rustix = { version = "1.0.0", features = ["fs"] }
 serde = { version = "1.0", default-features = false, features = ["derive"] }
 thiserror = { version = "2.0.0", default-features = false }

crates/composefs-oci/src/image.rs

@@ -11,6 +11,7 @@
 use std::{ffi::OsStr, os::unix::ffi::OsStrExt, rc::Rc};
 
 use anyhow::{ensure, Context, Result};
+use composefs::util::DigestWrite;
 use fn_error_context::context;
 use sha2::{Digest, Sha256};
 
@@ -117,7 +118,7 @@ pub fn create_filesystem<ObjectID: FsVerityHashValue>(
             // stream.
             let mut layer_stream =
                 repo.open_stream("", Some(layer_verity), Some(TAR_LAYER_CONTENT_TYPE))?;
-            let mut context = Sha256::new();
+            let mut context = DigestWrite(Sha256::new());
             layer_stream.cat(repo, &mut context)?;
             let content_hash = format!("sha256:{}", hex::encode(context.finalize()));
             ensure!(content_hash == *diff_id, "Layer has incorrect checksum");

crates/composefs-setup-root/Cargo.toml

@@ -25,7 +25,7 @@ env_logger = { version = "0.11.0", default-features = false }
 hex = { version = "0.4.3", default-features = false }
 rustix = { version = "1.0.0", default-features = false }
 serde = { version = "1.0.145", default-features = false, features = ["derive"] }
-toml = { version = "1.0.0", default-features = false, features = ["parse"] }
+toml = { version = "1.0.0", default-features = false, features = ["parse", "serde"] }
 
 [dev-dependencies]
 similar-asserts = "1.7.0"

crates/composefs/Cargo.toml

@@ -24,7 +24,7 @@ hex = { version = "0.4.0", default-features = false, features = ["std"] }
 log = { version = "0.4.8", default-features = false }
 once_cell = { version = "1.21.3", default-features = false, features = ["std"] }
 rustix = { version = "1.0.0", default-features = false, features = ["fs", "mount", "process", "std"] }
-sha2 = { version = "0.11.0", default-features = false, features = ["std"] }
+sha2 = { version = "0.11.0", default-features = false }
 thiserror = { version = "2.0.0", default-features = false }
 tokio = { version = "1.24.2", default-features = false, features = ["macros", "process", "io-util", "rt-multi-thread", "sync"] }
 tempfile = { version = "3.8.0", optional = true, default-features = false }

crates/composefs/src/fsverity/mod.rs

@@ -261,7 +261,7 @@ mod tests {
     use composefs_ioctls::test_utils_pub::CommandExt;
 
     use once_cell::sync::Lazy;
-    use rand::Rng;
+    use rand::RngExt;
     use rustix::{
         fd::OwnedFd,
         fs::{open, Mode, OFlags},

crates/composefs/src/util.rs

@@ -4,7 +4,8 @@
 //! I/O utilities for reading data streams, SHA256 digest parsing, and
 //! filesystem operations like atomic symlink replacement.
 
-use rand::{distr::Alphanumeric, Rng};
+use rand::{distr::Alphanumeric, RngExt};
+use sha2::Digest;
 use std::{
     io::{Error, ErrorKind, Read, Result},
     os::{
@@ -20,6 +21,32 @@ use rustix::{
 };
 use tokio::io::{AsyncRead, AsyncReadExt};
 
+/// Adapts a [`sha2::Digest`] hasher to implement [`std::io::Write`].
+///
+/// sha2 0.11 removed its `std::io::Write` impl. This wrapper bridges
+/// the gap so that digest hashers can still be used with APIs that
+/// accept `impl Write` (e.g. [`SplitStreamReader::cat`]).
+#[derive(Debug)]
+pub struct DigestWrite<D: Digest>(pub D);
+
+impl<D: Digest> std::io::Write for DigestWrite<D> {
+    fn write(&mut self, buf: &[u8]) -> Result<usize> {
+        self.0.update(buf);
+        Ok(buf.len())
+    }
+
+    fn flush(&mut self) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl<D: Digest> DigestWrite<D> {
+    /// Consumes the wrapper and returns the computed digest.
+    pub fn finalize(self) -> sha2::digest::Output<D> {
+        self.0.finalize()
+    }
+}
+
 /// Formats a string like "/proc/self/fd/3" for the given fd.  This can be used to work with kernel
 /// APIs that don't directly accept file descriptors.
 ///