chore(deps): add hex and sha2 to preloop-vm
Summary
Adds the two workspace dependencies the AgentENV read-only volume work needs to
crates/preloop-vm:
hex = { workspace = true }— lowercase hex for the tree and archive digests.sha2 = { workspace = true }— SHA-256 for the archive digest and the tree
fingerprint.
Both are already workspace dependencies (the orchestrator and the CLI use them),
and every crate is already covered by the vet store, so Cargo.lock records
exactly two dependency edges inside the existing preloop-vm entry:
"async-trait",
"base64 0.23.1",
+ "hex",
"parking_lot",
"preloop-gha-protocol",
"preloop-observability",
"serde",
"serde_json",
+ "sha2 0.10.9",
No new packages, no version changes, no source changes: this is a dedicated
dependency PR, so the supply-chain guard's "dedicated dependency manifest +
lockfile PR" shape applies (no label, no exception).
Verification
cargo vet --locked— Vetting Succeeded (17 fully audited, 2 partially
audited, 467 exempted).cargo update -p preloop-vm --offline— "Locking 0 packages"; the lockfile
diff is the two edges above and nothing else.
Consumer
The feature that uses these dependencies is #618 (feat(agentenv): deliver the runner bundle as a read-only volume), whose base is this branch until this PR
merges; it then retargets to main. Merge order: this PR first.
Summary by cubic
Adds hex and sha2 as workspace dependencies to preloop-vm so the AgentENV read-only volume work can hash the runner tree and format digests.
Both packages are already workspace dependencies used by the orchestrator and the CLI, and are already covered by the vet store. The lockfile change is exactly two new edges inside the existing preloop-vm entry — no new packages, no version changes, no source changes. This is a dedicated dependency-only PR for the supply-chain guard, so no label or exception is needed.
The feature that consumes these dependencies (feat(agentenv): deliver the runner bundle as a read-only volume) is based on this branch and will retarget to main once this merges. Merge this PR first.
Summary by CodeRabbit
- Release Notes
- This update does not change any features or behavior visible to end users. There are no new capabilities, fixes, or interface changes to highlight in this release.