Update dependency apple/swift-crypto to v5

[renovate]

This PR contains the following updates:

Package	Update	Change
apple/swift-crypto	major	from: "4.5.0" → from: "5.0.0"

---

Release Notes

apple/swift-crypto (apple/swift-crypto)

v5.0.0

Compare Source

Swift Crypto 5.0 Release Notes

Swift Crypto 5.0 aligns the cross-platform API surface with CryptoKit as shipped in Xcode 27 (CryptoKit-383.2.1), and takes the opportunity to streamline the package for both adopters and maintainers.

Most users will be able to depend on the 1.0.0, 2.0.0, 3.0.0, 4.0.0, or 5.0.0 series of releases.

To do so, please use the following dependency in your Package.swift:

.package(url: "https://github.com/apple/swift-crypto.git", "1.0.0" ..< "6.0.0"),

Requires Swift 6.2

The package now declares 6.2 as the minimum Swift version in its package manifest.

New span-based API

CryptoKit's new non-allocating, span-based entry points are now available cross-platform:

• SymmetricKey gains bytes: RawSpan, init(copying: RawSpan), init(copyingWithZeroing: inout MutableRawSpan), and init(size:initializingWith:) which initializes the key through an inout OutputRawSpan.
• HashFunction gains update(bytes: RawSpan) and hash(bytes: RawSpan), and Digest gains init?(copying: RawSpan).
• HMAC gains authenticationCode(for: RawSpan, using:).
• HKDF gains deriveKey(inputKeyMaterial:salt:info:output:) writing into an inout OutputRawSpan, along with span-based extract and expand. The existing DataProtocol overload now has a fast path for contiguous salt and info.
• AES.GCM and ChaChaPoly gain in-place seal(inPlace:using:nonce:authenticating:tag:) and open(inPlace:using:nonce:authenticating:tag:) over MutableRawSpan, and their Nonce types gain bytes: RawSpan and init(copying: RawSpan).

Single-use KEM keys

A new KEMOneTimePrivateKey protocol, refining ~Copyable and Sendable, provides a consuming func decapsulate(_:) so a decapsulation key cannot be reused. Conforming types are MLKEM768.OneTimePrivateKey, MLKEM1024.OneTimePrivateKey, and XWingMLKEM768X25519.OneTimePrivateKey.

Extensible enums

Historically Swift Crypto needed a new major version each time CryptoKit added a case to a non-frozen enum, because Swift Crypto is not built with library evolution. All public non-frozen enums are now marked @nonexhaustive (SE-0487), which should remove that reason for future major bumps. Adopters who do not switch over these enums should not need to widen their version constraints again.

Other changes

• Symbols that were previously marked @_spi(...) public have been made internal; they were never intended to be available.
• @available annotations have been removed from Crypto; they are unused in all supported compilation modes.
• Some internal reference types are now marked final
• Some unused code, e.g. ECDSASignature.derBytes, is removed.

Build and packaging

• The CCryptoBoringSSLShims target is removed, along with all bindMemory(to:) calls.
• The .gyb templates for nonces, digests, ECDH, ECDSA, MLDSA, and MLKEM are removed and the generated Swift is checked in. The BoringSSL backend templates for MLDSA and MLKEM remain.
• Conditional compilation is simplified to #if canImport(CryptoKit); branches that could never be taken are gone.
• Developing the BoringSSL backend on macOS is no longer supported. Use the Dev Container configuration now shipped in the repository, or build on the target platform.
• Warnings are silenced for vendored C sources: -Wshorten-64-to-32 for BoringSSL and macro-redefined for XKCP. CI builds with -warnings-as-errors.

Commits

The changes in this release were reviewed and merged to the 5.x branch during the beta period:

• 0a26a9e [5.x] Align with CryptoKit APIs from Xcode 27 beta 1 (#​442)
• 8ee9962 [5.x] Align with CryptoKit APIs from Xcode 27 beta 2 (#​444)
• ce8db47 [5.x] Align with CryptoKit APIs from Xcode 27 beta 4 (#​453)
• 15b0fb5 [5.x] Adopt CheckImplementationOnly and CI with -warnings-as-errors (#​454)
• b3746b1 [5.x] Remove bindMemory(to:) calls and the CCryptoBoringSSLShims target (#​455)
• 57782dc [5.x] Remove duplicate imports from gyb-generated MLDSA backend code (#​458)
• 2c45ca2 [5.x] Remove unused internal code path: ECDSASignature.derBytes (#​457)
• 33785f6 [5.x] Mark some class types as final (#​456)
• 2e074ef [5.x] Remove native SwiftPM build-system workaround in CI (#​461)
• 20f9049 [5.x] Align with CryptoKit from Xcode 27 beta 6 (#​462)

Full Changelog: apple/swift-crypto@4.5.2...5.0.0

v4.5.2

Compare Source

What's Changed

SemVer Patch

• Compute RSA key size from the modulus bit length by @​simonjbeaumont in #​466
• Enforce a 2048-bit minimum on RSA raw number initializers by @​simonjbeaumont in #​467

Other Changes

• Update contributing guidelines by @​simonjbeaumont in #​464
• Match the documented parameter names to the signatures by @​darkdi in #​463
• Reapply swift-format to fixup PR CI by @​simonjbeaumont in #​465

New Contributors

• @​darkdi made their first contribution in #​463

Full Changelog: apple/swift-crypto@4.5.1...4.5.2

v4.5.1

Compare Source

What's Changed

SemVer Patch

• Back AES-CBC with BoringSSL and constant-time PKCS#7 unpadding by @​simonjbeaumont in #​448
• Fix double-free when RSA key init from bytes fails by @​simonjbeaumont in 47d3869

Other Changes

• Update cross-platform dependencies in README by @​simonjbeaumont in #​446

Full Changelog: apple/swift-crypto@4.5.0...4.5.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.