hardening

.github/workflows/rust.yml

@@ -2,21 +2,62 @@ name: Rust
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust Toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Check Code Format
+        run: cargo fmt --all -- --check
 
+      - name: Code Lint
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Build
+        run: cargo build --verbose --all-features
+
+      - name: Run tests
+        run: cargo test --verbose --all-features
+
+  msrv:
+    name: Verify MSRV (1.85)
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
+      - uses: actions/checkout@v4
+
+      - name: Install Rust Toolchain (1.85)
+        uses: dtolnay/rust-toolchain@1.85.0
+
+      - name: Check
+        run: cargo check --all-features
+
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust Toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+
+      - name: Run cargo audit
+        run: cargo audit

CHANGELOG.md

@@ -5,11 +5,42 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.4] - 2026-07-15
+
+### Added
+
+- **`#![deny(unsafe_code)]`** at the crate root.
+- **`#[must_use]`** on `Builder::with_hash()` and `Builder::with_base_encoding()`
+  (methods returning `Self`).
+- **`#[must_use]`** on `Error::unsupported_hash()`,
+  `Error::invalid_digest_length()`, `Error::hash_compute_failed()`, and
+  `Error::kind()`.
+- **`# Errors`** doc sections on `Builder::new_from_bytes()`,
+  `Builder::try_build()`, and `Builder::try_build_encoded()`.
+- **MSRV declared**: `rust-version = "1.85"` in `Cargo.toml`. CI verifies the
+  MSRV with a dedicated job.
+- **`cargo audit`** job in CI.
+- **`cargo fmt --check`** and **`clippy -D warnings`** steps in CI.
+- **Clippy lint configuration**: `[lints.clippy]` with `pedantic`, `nursery`,
+  and `cargo` groups (all `warn`), plus `[lints.rust] unsafe_code = "deny"`.
+
+### Changed
+
+- **Edition 2024**: Updated from Rust 2021.
+- **`From<Multihash> for Vec<u8>`**: Pre-calculates total size and uses a single
+  `with_capacity` + `extend_from_slice` instead of two `append` calls that each
+  allocate intermediate `Vec<u8>` buffers.
+- **Clippy pedantic/nursery/cargo warnings** resolved across all source, tests,
+  and benchmarks.
+
 ## [1.0.0] - 2026-07-13
 
 ### Changed
 - Synced from bettersign workspace (bs-multihash 0.7.0)
 - Renamed crate from `bs-multihash` to `multi-hash`
 - Added `types.rs` module with type-safe wrappers
-- Added comprehensive test suite (edge cases, integration, proptest, security)
-- Initial published release on crates.io as `multi-hash`
+- Added test suite (edge cases, integration, proptest, security)
+- Initial published release on crates.io as `multi-hash`
+
+[1.0.4]: https://github.com/cryptidtech/multi-hash/compare/v1.0.0...v1.0.4
+[1.0.0]: https://github.com/cryptidtech/multi-hash/releases/tag/v1.0.0

Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "multi-hash"
-version = "1.0.3"
-edition = "2021"
+version = "1.0.4"
+edition = "2024"
+rust-version = "1.85"
 authors = ["Dave Grantham <dwg@linuxprogrammer.org>"]
 description = "Multihash self-describing cryptographic hash data"
 repository = "https://github.com/cryptidtech/multi-hash.git"
@@ -40,6 +41,17 @@ serde_cbor = "0.11"
 serde_json = "1.0"
 serde_test = "1.0"
 
+[lints.clippy]
+pedantic = { level = "warn", priority = -1 }
+nursery = { level = "warn", priority = -1 }
+cargo = { level = "warn", priority = -1 }
+# blake3 pulls in digest 0.11 while the other RustCrypto crates use 0.10.
+# This will resolve when the rest of the ecosystem upgrades.
+multiple_crate_versions = { level = "allow", priority = 1 }
+
+[lints.rust]
+unsafe_code = "deny"
+
 [[bench]]
 name = "multihash_bench"
 harness = false