fix(deps): complete sha2 0.11 upgrade

.github/workflows/lockfile-diagnostic.yml

@@ -0,0 +1,39 @@
+name: Lockfile diagnostic
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/lockfile-diagnostic.yml"
+      - "Cargo.lock"
+      - "crates/mlsirm-core/Cargo.toml"
+      - "crates/fast-mlsirm-py/Cargo.lock"
+      - "fuzz/Cargo.lock"
+
+permissions:
+  contents: read
+
+jobs:
+  lockfiles:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out exact PR head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: stable
+      - name: Resolve independent lockfiles
+        run: |
+          set -euo pipefail
+          cargo update --manifest-path crates/fast-mlsirm-py/Cargo.toml -p sha2 --precise 0.11.0
+          cargo generate-lockfile --manifest-path fuzz/Cargo.toml
+          cargo metadata --locked --format-version 1 --manifest-path crates/fast-mlsirm-py/Cargo.toml >/dev/null
+          cargo metadata --locked --format-version 1 --manifest-path fuzz/Cargo.toml >/dev/null
+          echo 'PY_LOCK_BASE64_BEGIN'
+          base64 -w0 crates/fast-mlsirm-py/Cargo.lock
+          echo
+          echo 'PY_LOCK_BASE64_END'
+          echo 'FUZZ_LOCK_BASE64_BEGIN'
+          base64 -w0 fuzz/Cargo.lock
+          echo
+          echo 'FUZZ_LOCK_BASE64_END'

crates/mlsirm-core/Cargo.toml

@@ -15,7 +15,7 @@ path = "src/entrypoint.rs"
 [dependencies]
 bytemuck = { version = "1.25.0", features = ["derive"], optional = true }
 pollster = { version = "1.0.1", optional = true }
-sha2 = "0.10.9"
+sha2 = "0.11.0"
 wgpu = { version = "30.0.0", optional = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

crates/mlsirm-core/src/sampling_design.rs

@@ -153,7 +153,14 @@ fn put_text(bytes: &mut Vec<u8>, value: &str) {
 }
 
 fn sha256_hex(bytes: &[u8]) -> String {
-    format!("{:x}", Sha256::digest(bytes))
+    const HEX: &[u8; 16] = b"0123456789abcdef";
+    let digest = Sha256::digest(bytes);
+    let mut encoded = String::with_capacity(digest.len() * 2);
+    for byte in digest {
+        encoded.push(HEX[(byte >> 4) as usize] as char);
+        encoded.push(HEX[(byte & 0x0f) as usize] as char);
+    }
+    encoded
 }
 
 fn input_identity(