[27Bslash6]

Updates cachekit-rs 0.9 → 0.11.1 and cachekit-core 0.6 → 0.7, and removes the crate-scoped cbindgen (MPL-2.0) licence exception from deny.toml.

cachekit-core 0.7 builds cbindgen only under its ffi feature, which ck does not enable. cachekit-rs 0.11.1 is the first release on cachekit-core 0.7 (0.11.0 still requires ^0.6), so the requirement names 0.11.1: a looser 0.11 would let a resolver pick 0.11.0 and pull a second cachekit-core, and cbindgen with it.

Compatibility. ck uses EncryptionLayer and the file and cachekitio backends directly, not the high-level client. Between 0.9.0 and 0.11.1, EncryptionLayer's API and AAD are unchanged (doc comments only), and the file backend's entry format is unchanged (new protocol vectors, same writer). The 0.10 breaking changes (namespace-bound AAD, encrypt-everything) are in the high-level client, which ck does not use. Existing ck cache entries stay readable. cachekit-core 0.7's breaking change removes the metrics API, which ck does not use.

Checks run locally:

• cargo tree --locked -e build -i cbindgen: no match
• cargo deny check: advisories, bans, licences and sources ok
• cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked: all pass
• hit-path bench (--release --test bench -- --ignored): within budget
• cargo +1.85 check --locked --all-targets
• admin-API grep over source and release binary, crates.io-only check

Guards for the next bump:

• deny.toml bans a second cachekit-core version (deny-multiple-versions), so ck's key derivation (cachekit-core) and its EncryptionLayer (cachekit-rs) cannot come from different releases. Checked: with cachekit-core = "0.6" the bans check fails on the duplicate.
• Known-answer tests: keys::tests::value_key_known_answer pins the cache key for a fixed master key, and store::tests::an_older_entry_still_decrypts decrypts a ciphertext written by cachekit-rs 0.9.0 on cachekit-core 0.6.0. A derivation or format drift now fails a test, instead of turning every stored entry into a silent miss.

Docs: the SAAS_DEADLINE comment in src/store.rs quoted the 0.9 client's timeouts. It no longer quotes figures. No README or doc text names cbindgen or these dependency versions.

Closes LAB-7740

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 1 suggested fix.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:32

---

### [1/1] Cargo.toml:32
Issue identified during code review:
WHAT: cachekit-rs jumps from 0.9 to 0.11.1, skipping a minor series. In 0.x semver, each minor bump is breaking. WHY: Skipping versions of a crate with encryption and IO features raises supply-chain risk and needs audit evidence. HOW: Run cargo audit or an OSV query for cachekit-rs 0.11.1, review its changelog, put the results in the PR description, and commit the updated Cargo.lock.

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.