From 70e573ebe1788d6ac4c243d9ce15e9f5b97b0cdb Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Sun, 28 Jun 2026 11:39:57 +0200
Subject: [PATCH] bumped deps + fixed deprecations + session for live tests

---
 .gitignore                                    |   3 +
 Cargo.lock                                    | 831 ++++++++++++------
 Cargo.toml                                    |  17 +-
 .../proton-drive-sdk/examples/live_login.rs   |   2 +-
 crates/proton-drive-sdk/src/client.rs         |   2 +-
 crates/proton-drive-sdk/tests/common/mod.rs   | 109 ++-
 crates/proton-sdk/src/crypto/content.rs       |  52 +-
 crates/proton-sdk/src/crypto/encrypt.rs       |  39 +-
 crates/proton-sdk/src/crypto/keys.rs          |   8 +-
 crates/proton-sdk/src/crypto/verify.rs        |  10 +-
 10 files changed, 761 insertions(+), 312 deletions(-)

diff --git a/.gitignore b/.gitignore
index 592d40a..4a27f54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,6 @@ todo.md
 sdk/
 
 .env
+
+# Cached live-test session (resume instead of re-running SRP+2FA)
+.proton_session.json
diff --git a/Cargo.lock b/Cargo.lock
index 624e0c1..3b24053 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "adler2"
@@ -15,7 +15,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
  "bytes",
- "crypto-common",
+ "crypto-common 0.1.7",
  "generic-array",
 ]
 
@@ -26,8 +26,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
- "cipher",
- "cpufeatures",
+ "cipher 0.4.4",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -38,7 +38,7 @@ checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
 dependencies = [
  "aead",
  "aes",
- "cipher",
+ "cipher 0.4.4",
  "ctr",
  "ghash",
  "subtle",
@@ -53,15 +53,6 @@ dependencies = [
  "aes",
 ]
 
-[[package]]
-name = "aho-corasick"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -79,7 +70,7 @@ checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
  "base64ct",
  "blake2",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "password-hash",
  "zeroize",
 ]
@@ -107,6 +98,28 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
 [[package]]
 name = "base16ct"
 version = "0.2.0"
@@ -127,36 +140,36 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bcrypt"
-version = "0.17.1"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abaf6da45c74385272ddf00e1ac074c7d8a6c1a1dda376902bd6a427522a8b2c"
+checksum = "7f3c067aa24dd4ed5c79cf222a38f260c8f23d3b82a062fba3f28c6fe563b753"
 dependencies = [
  "base64",
- "blowfish",
- "getrandom 0.3.4",
+ "blowfish 0.10.0",
+ "getrandom 0.4.3",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "bitfields"
-version = "0.12.4"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d84268bbf9b487d31fe4b849edbefcd3911422d7a07de855a2da1f70ab3d1c"
+checksum = "ef6e59298da389bc0649c7463856b34c6e17fe542f88939426ede4436c6b1195"
 dependencies = [
  "bitfields-impl",
 ]
 
 [[package]]
 name = "bitfields-impl"
-version = "0.9.4"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07c93edde7bb4416c35c85048e34f78999dcb47d199bde3b1d79286156f3e2fb"
+checksum = "f2c044f98f86f15414668d6c8187c7e4fadab1ad2b31680f648703e0fe07c555"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
- "thiserror",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -183,7 +196,7 @@ version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -195,6 +208,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "block-padding"
 version = "0.3.3"
@@ -211,7 +233,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
 dependencies = [
  "byteorder",
- "cipher",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62ce3946557b35e71d1bbe07ec385073ce9eda05043f95de134eb578fcf1a298"
+dependencies = [
+ "byteorder",
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -243,24 +275,13 @@ checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 
 [[package]]
 name = "bzip2"
-version = "0.5.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47"
+checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c"
 dependencies = [
- "bzip2-sys",
  "libbz2-rs-sys",
 ]
 
-[[package]]
-name = "bzip2-sys"
-version = "0.1.13+1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
-dependencies = [
- "cc",
- "pkg-config",
-]
-
 [[package]]
 name = "camellia"
 version = "0.1.0"
@@ -268,7 +289,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3264e2574e9ef2b53ce6f536dea83a69ac0bc600b762d1523ff83fe07230ce30"
 dependencies = [
  "byteorder",
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -277,7 +298,7 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b07d673db1ccf000e90f54b819db9e75a8348d6eb056e9b8ab53231b7a9911"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -287,16 +308,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
 dependencies = [
  "find-msvc-tools",
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
 [[package]]
 name = "cfb-mode"
 version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "738b8d467867f80a71351933f70461f5b56f24d5c93e0cf216e59229c968d330"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -330,8 +359,18 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common",
- "inout",
+ "crypto-common 0.1.7",
+ "inout 0.1.4",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
 ]
 
 [[package]]
@@ -340,9 +379,34 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8543454e3c3f5126effff9cd44d562af4e31fb8ce1cc0d3dcd8f084515dbc1aa"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
  "dbl",
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
 ]
 
 [[package]]
@@ -351,6 +415,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -360,6 +430,16 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -375,6 +455,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc24"
 version = "0.1.6"
@@ -404,13 +493,31 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ctr"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
 ]
 
 [[package]]
@@ -420,9 +527,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
- "digest",
+ "digest 0.10.7",
  "fiat-crypto",
  "rustc_version",
  "subtle",
@@ -507,7 +614,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -572,7 +679,7 @@ version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ffdd80ce8ce993de27e9f063a444a4d53ce8e8db4c1f00cc03af5ad5a9867a1e"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -581,12 +688,24 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
@@ -604,16 +723,22 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48bc224a9084ad760195584ce5abb3c2c34a225fa312a128ad245a6b412b7689"
 dependencies = [
- "digest",
+ "digest 0.10.7",
  "num-bigint-dig",
  "num-traits",
  "pkcs8",
  "rfc6979",
- "sha2",
+ "sha2 0.10.9",
  "signature",
  "zeroize",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "eax"
 version = "0.5.0"
@@ -621,7 +746,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9954fabd903b82b9d7a68f65f97dc96dd9ad368e40ccc907a7c19d53e6bfac28"
 dependencies = [
  "aead",
- "cipher",
+ "cipher 0.4.4",
  "cmac",
  "ctr",
  "subtle",
@@ -634,7 +759,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
  "der",
- "digest",
+ "digest 0.10.7",
  "elliptic-curve",
  "rfc6979",
  "signature",
@@ -661,7 +786,7 @@ dependencies = [
  "ed25519",
  "rand_core 0.6.4",
  "serde",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -675,11 +800,11 @@ dependencies = [
  "base16ct",
  "base64ct",
  "crypto-bigint",
- "digest",
+ "digest 0.10.7",
  "ff",
  "generic-array",
  "group",
- "hkdf",
+ "hkdf 0.12.4",
  "pem-rfc7468",
  "pkcs8",
  "rand_core 0.6.4",
@@ -691,12 +816,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -745,6 +864,12 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -872,11 +997,22 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
  "wasip2",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
 [[package]]
 name = "ghash"
 version = "0.5.1"
@@ -898,12 +1034,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -922,7 +1052,16 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
+]
+
+[[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac 0.13.0",
 ]
 
 [[package]]
@@ -931,7 +1070,16 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -973,6 +1121,15 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "1.10.1"
@@ -1006,7 +1163,6 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots",
 ]
 
 [[package]]
@@ -1144,7 +1300,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "075557004419d7f2031b8bb7f44bb43e55a83ca7b63076a8fb8fe75753836477"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -1174,16 +1330,6 @@ dependencies = [
  "icu_properties",
 ]
 
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown",
-]
-
 [[package]]
 name = "inout"
 version = "0.1.4"
@@ -1193,6 +1339,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.0"
@@ -1205,6 +1360,60 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys 0.3.1",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.102"
@@ -1226,7 +1435,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "once_cell",
- "sha2",
+ "sha2 0.10.9",
  "signature",
 ]
 
@@ -1236,7 +1445,7 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -1250,9 +1459,9 @@ dependencies = [
 
 [[package]]
 name = "libbz2-rs-sys"
-version = "0.1.3"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0864a00c8d019e36216b69c2c4ce50b83b7bd966add3cf5ba554ec44f8bebcf5"
+checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
 
 [[package]]
 name = "libc"
@@ -1291,7 +1500,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
  "cfg-if",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1316,12 +1525,6 @@ dependencies = [
  "unicase",
 ]
 
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -1345,12 +1548,11 @@ dependencies = [
 
 [[package]]
 name = "nom"
-version = "7.1.3"
+version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
 dependencies = [
  "memchr",
- "minimal-lexical",
 ]
 
 [[package]]
@@ -1426,7 +1628,6 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
- "proc-macro-crate",
  "proc-macro2",
  "quote",
  "syn",
@@ -1439,7 +1640,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c196e0276c471c843dd5777e7543a36a298a4be942a2a688d8111cd43390dedb"
 dependencies = [
  "aead",
- "cipher",
+ "cipher 0.4.4",
  "ctr",
  "subtle",
 ]
@@ -1456,6 +1657,12 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -1465,7 +1672,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1477,7 +1684,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1491,7 +1698,7 @@ dependencies = [
  "elliptic-curve",
  "primeorder",
  "rand_core 0.6.4",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1522,9 +1729,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pgp"
-version = "0.16.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f91d320242d9b686612b15526fe38711afdf856e112eaa4775ce25b0d9b12b11"
+checksum = "1cfa4743b28656065ff4c0ba09e46b357a65e8c00fc2341e89084b82f87cbdf1"
 dependencies = [
  "aead",
  "aes",
@@ -1534,7 +1741,7 @@ dependencies = [
  "base64",
  "bitfields",
  "block-padding",
- "blowfish",
+ "blowfish 0.9.1",
  "buffer-redux",
  "byteorder",
  "bytes",
@@ -1542,16 +1749,15 @@ dependencies = [
  "camellia",
  "cast5",
  "cfb-mode",
- "chrono",
- "cipher",
- "const-oid",
+ "cipher 0.4.4",
+ "const-oid 0.9.6",
  "crc24",
  "curve25519-dalek",
  "cx448",
  "derive_builder",
  "derive_more",
  "des",
- "digest",
+ "digest 0.10.7",
  "dsa",
  "eax",
  "ecdsa",
@@ -1560,11 +1766,12 @@ dependencies = [
  "flate2",
  "generic-array",
  "hex",
- "hkdf",
+ "hkdf 0.12.4",
  "idea",
  "k256",
  "log",
  "md-5",
+ "memchr",
  "nom",
  "num-bigint-dig",
  "num-traits",
@@ -1574,16 +1781,17 @@ dependencies = [
  "p384",
  "p521",
  "rand 0.8.6",
- "regex",
+ "replace_with",
  "ripemd",
  "rsa",
- "sha1",
+ "sha1 0.10.6",
  "sha1-checked",
- "sha2",
+ "sha2 0.10.9",
  "sha3",
  "signature",
  "smallvec",
  "snafu",
+ "subtle",
  "twofish",
  "x25519-dalek",
  "zeroize",
@@ -1616,12 +1824,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1629,7 +1831,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -1661,15 +1863,6 @@ dependencies = [
  "elliptic-curve",
 ]
 
-[[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -1688,16 +1881,16 @@ dependencies = [
  "bytes",
  "futures",
  "hex",
- "hmac",
+ "hmac 0.13.0",
  "pgp",
  "proton-sdk",
  "reqwest",
  "serde",
  "serde_json",
  "serde_repr",
- "sha1",
- "sha2",
- "thiserror",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
 ]
@@ -1715,8 +1908,8 @@ dependencies = [
  "futures",
  "getrandom 0.2.17",
  "hex",
- "hkdf",
- "hmac",
+ "hkdf 0.13.0",
+ "hmac 0.13.0",
  "num-bigint",
  "num-traits",
  "pgp",
@@ -1725,8 +1918,8 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_repr",
- "sha2",
- "thiserror",
+ "sha2 0.11.0",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
 ]
@@ -1745,7 +1938,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "web-time",
@@ -1757,6 +1950,7 @@ version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
+ "aws-lc-rs",
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
@@ -1766,7 +1960,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror",
+ "thiserror 2.0.18",
  "tinyvec",
  "tracing",
  "web-time",
@@ -1801,6 +1995,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "radium"
 version = "0.7.0"
@@ -1867,39 +2067,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "regex"
-version = "1.12.4"
+name = "replace_with"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+checksum = "51743d3e274e2b18df81c4dc6caf8a5b8e15dbe799e0dca05c7617380094e884"
 
 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62"
 dependencies = [
  "base64",
  "bytes",
@@ -1919,9 +2096,9 @@ dependencies = [
  "quinn",
  "rustls",
  "rustls-pki-types",
+ "rustls-platform-verifier",
  "serde",
  "serde_json",
- "serde_urlencoded",
  "sync_wrapper",
  "tokio",
  "tokio-rustls",
@@ -1943,7 +2120,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
  "subtle",
 ]
 
@@ -1967,7 +2144,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1976,8 +2153,8 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
- "digest",
+ "const-oid 0.9.6",
+ "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
  "num-traits",
@@ -2011,14 +2188,26 @@ version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
+ "aws-lc-rs",
  "once_cell",
- "ring",
  "rustls-pki-types",
  "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.14.1"
@@ -2029,12 +2218,40 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
+ "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -2047,10 +2264,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
-name = "ryu"
-version = "1.0.23"
+name = "same-file"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
 
 [[package]]
 name = "sec1"
@@ -2067,6 +2296,29 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"
@@ -2127,18 +2379,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "serdect"
 version = "0.2.0"
@@ -2166,8 +2406,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -2176,8 +2427,8 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89f599ac0c323ebb1c6082821a54962b839832b03984598375bff3975b804423"
 dependencies = [
- "digest",
- "sha1",
+ "digest 0.10.7",
+ "sha1 0.10.6",
  "zeroize",
 ]
 
@@ -2188,8 +2439,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -2198,7 +2460,7 @@ version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
 dependencies = [
- "digest",
+ "digest 0.10.7",
  "keccak",
 ]
 
@@ -2214,7 +2476,7 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
- "digest",
+ "digest 0.10.7",
  "rand_core 0.6.4",
 ]
 
@@ -2238,18 +2500,18 @@ checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "snafu"
-version = "0.8.9"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
+checksum = "d1a012328be2e3f5d5f6f3218147ca02588cea4cb865e876849ab6debcf36522"
 dependencies = [
  "snafu-derive",
 ]
 
 [[package]]
 name = "snafu-derive"
-version = "0.8.9"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
+checksum = "5f103c50866b8743da9429b8a581d81a27c2d3a9c4ac7df8f8571c1dd7896eda"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -2338,13 +2600,33 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -2432,36 +2714,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.12+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
-dependencies = [
- "indexmap",
- "toml_datetime",
- "toml_parser",
- "winnow",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
-dependencies = [
- "winnow",
-]
-
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -2550,7 +2802,7 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a78e83a30223c757c3947cd144a31014ff04298d8719ae10d03c31c0448c8013"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -2589,7 +2841,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
@@ -2623,6 +2875,16 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -2735,6 +2997,15 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.8"
@@ -2744,6 +3015,15 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -2803,6 +3083,15 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -2830,6 +3119,21 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -2863,6 +3167,12 @@ dependencies = [
  "windows_x86_64_msvc 0.53.1",
 ]
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
@@ -2875,6 +3185,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
@@ -2887,6 +3203,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -2911,6 +3233,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
@@ -2923,6 +3251,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
@@ -2935,6 +3269,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
@@ -2947,6 +3287,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -2959,15 +3305,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
-[[package]]
-name = "winnow"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
diff --git a/Cargo.toml b/Cargo.toml
index 1a01690..33c2f61 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,7 @@ categories = ["api-bindings", "cryptography", "filesystem"]
 
 [workspace.dependencies]
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "fs", "io-util", "time"] }
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream", "multipart"] }
+reqwest = { version = "0.13", default-features = false, features = ["json", "rustls", "webpki-roots", "stream", "multipart"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_repr = "0.1"
@@ -25,18 +25,19 @@ futures = "0.3"
 bytes = "1"
 base64 = "0.22"
 hex = "0.4"
-hmac = "0.12"
-sha1 = "0.10"
-sha2 = "0.10"
+hmac = "0.13"
+sha1 = "0.11"
+sha2 = "0.11"
 aes-gcm = "0.10"
-hkdf = "0.12"
-bcrypt = "0.17"
-pgp = "0.16"
+hkdf = "0.13"
+bcrypt = "0.19"
+pgp = "0.20"
 # Match the chrono line rPGP pulls in; used to stamp detached-signature subpackets.
 chrono = "0.4"
 tracing = "0.1"
 num-bigint = "0.4"
 num-traits = "0.2"
 getrandom = "0.2"
-# rPGP re-exports rand_core 0.6 traits; match its 0.8 line for keygen/encryption RNG.
+# rPGP (pgp 0.20) still depends on rand 0.8 and passes its CryptoRng/Rng traits
+# across its public API, so the RNG we hand to keygen/encryption must be rand 0.8.
 rand = "0.8"
diff --git a/crates/proton-drive-sdk/examples/live_login.rs b/crates/proton-drive-sdk/examples/live_login.rs
index 1bd51e2..6da2630 100644
--- a/crates/proton-drive-sdk/examples/live_login.rs
+++ b/crates/proton-drive-sdk/examples/live_login.rs
@@ -11,7 +11,7 @@
 
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use proton_drive_sdk::ProtonDriveClient;
 use proton_sdk::config::ProtonClientConfiguration;
 use proton_sdk::session::ProtonApiSession;
diff --git a/crates/proton-drive-sdk/src/client.rs b/crates/proton-drive-sdk/src/client.rs
index 06ca89f..23b6875 100644
--- a/crates/proton-drive-sdk/src/client.rs
+++ b/crates/proton-drive-sdk/src/client.rs
@@ -22,7 +22,7 @@ use proton_sdk::ids::{AddressId, DriveEventId, LinkId, NodeUid, ShareId, VolumeI
 use proton_sdk::session::ProtonApiSession;
 use proton_sdk::telemetry::{NoopTelemetry, Telemetry, TelemetryExt};
 
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use sha1::Sha1;
 
 use crate::cache::DriveEntityCache;
diff --git a/crates/proton-drive-sdk/tests/common/mod.rs b/crates/proton-drive-sdk/tests/common/mod.rs
index 19135d1..3ef05ee 100644
--- a/crates/proton-drive-sdk/tests/common/mod.rs
+++ b/crates/proton-drive-sdk/tests/common/mod.rs
@@ -13,10 +13,11 @@
 
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use proton_drive_sdk::ProtonDriveClient;
 use proton_sdk::config::ProtonClientConfiguration;
-use proton_sdk::session::ProtonApiSession;
+use proton_sdk::session::{PasswordMode, ProtonApiSession, ResumeParameters};
+use serde::{Deserialize, Serialize};
 use sha1::Sha1;
 
 // Must follow Proton's required shape (sdk/README.md "Operational requirements").
@@ -51,6 +52,12 @@ pub async fn live_client() -> Option<&'static LiveClient> {
 }
 
 /// Perform the one-time SRP + 2FA login and build the client.
+///
+/// To avoid burning a TOTP window (and tripping Proton anti-abuse) on every run,
+/// a successful login is persisted to a gitignored cache file. On the next run we
+/// [`ProtonApiSession::resume`] from that file instead of doing SRP+2FA again; the
+/// stored refresh token auto-refreshes via the http client's 401 path, so no TOTP
+/// is needed. A missing/dead cache falls back to a fresh login.
 async fn build_live_client() -> Option<LiveClient> {
     let (username, password) = match read_dotenv() {
         Ok(creds) => creds,
@@ -59,6 +66,33 @@ async fn build_live_client() -> Option<LiveClient> {
             return None;
         }
     };
+
+    let config = ProtonClientConfiguration::new(APP_VERSION).with_user_agent(USER_AGENT);
+
+    // Fast path: resume a cached session (no TOTP). Validate with one cheap
+    // authenticated call so a dead/revoked session falls through to a fresh login.
+    if let Some(stored) = load_cached_session() {
+        let session = ProtonApiSession::resume(config.clone(), stored.into_params())
+            .expect("resume cached session");
+        match session
+            .http()
+            .get::<serde_json::Value>("core/v4/users")
+            .await
+        {
+            Ok(_) => {
+                eprintln!("[auth] resumed cached session (no TOTP)");
+                // Refresh may have rotated the tokens; re-persist the current set.
+                save_session(&session).await;
+                let client = ProtonDriveClient::new(&session, password.into_bytes());
+                return Some(LiveClient {
+                    client,
+                    _session: session,
+                });
+            }
+            Err(e) => eprintln!("[auth] cached session invalid ({e}); logging in fresh"),
+        }
+    }
+
     let totp_secret = match read_totp_secret() {
         Some(s) => s,
         None => {
@@ -67,8 +101,6 @@ async fn build_live_client() -> Option<LiveClient> {
         }
     };
 
-    let config = ProtonClientConfiguration::new(APP_VERSION).with_user_agent(USER_AGENT);
-
     let mut session = ProtonApiSession::begin(config, &username, password.as_bytes())
         .await
         .expect("SRP login failed");
@@ -81,6 +113,7 @@ async fn build_live_client() -> Option<LiveClient> {
             .expect("2FA submission failed");
     }
 
+    save_session(&session).await;
     let client = ProtonDriveClient::new(&session, password.into_bytes());
     Some(LiveClient {
         client,
@@ -88,6 +121,74 @@ async fn build_live_client() -> Option<LiveClient> {
     })
 }
 
+/// Persisted session credentials. Mirrors [`ResumeParameters`], serialized to a
+/// gitignored cache file so reruns can skip SRP+2FA.
+#[derive(Serialize, Deserialize)]
+struct StoredSession {
+    session_id: String,
+    username: String,
+    user_id: String,
+    access_token: String,
+    refresh_token: String,
+    scopes: Vec<String>,
+    /// `1` = single, `2` = dual (matches Proton's wire value).
+    password_mode: u8,
+}
+
+impl StoredSession {
+    fn into_params(self) -> ResumeParameters {
+        ResumeParameters {
+            session_id: self.session_id.into(),
+            username: self.username,
+            user_id: self.user_id.into(),
+            access_token: self.access_token,
+            refresh_token: self.refresh_token,
+            scopes: self.scopes,
+            is_waiting_for_second_factor_code: false,
+            password_mode: match self.password_mode {
+                1 => PasswordMode::Single,
+                _ => PasswordMode::Dual,
+            },
+        }
+    }
+}
+
+/// Repo-root path of the gitignored session cache.
+fn session_cache_path() -> String {
+    concat!(env!("CARGO_MANIFEST_DIR"), "/../../.proton_session.json").to_owned()
+}
+
+/// Load the cached session, or `None` if absent/unparseable.
+fn load_cached_session() -> Option<StoredSession> {
+    let text = std::fs::read_to_string(session_cache_path()).ok()?;
+    serde_json::from_str(&text).ok()
+}
+
+/// Persist the session's current tokens to the cache file (best-effort).
+async fn save_session(session: &ProtonApiSession) {
+    let tokens = session.current_tokens().await;
+    let stored = StoredSession {
+        session_id: session.session_id().as_str().to_owned(),
+        username: session.username().to_owned(),
+        user_id: session.user_id().as_str().to_owned(),
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        scopes: session.scopes().to_vec(),
+        password_mode: match session.password_mode() {
+            PasswordMode::Single => 1,
+            PasswordMode::Dual => 2,
+        },
+    };
+    match serde_json::to_string_pretty(&stored) {
+        Ok(json) => {
+            if let Err(e) = std::fs::write(session_cache_path(), json) {
+                eprintln!("[auth] could not write session cache: {e}");
+            }
+        }
+        Err(e) => eprintln!("[auth] could not serialize session: {e}"),
+    }
+}
+
 /// Minimal `.env` reader: `key=value` lines, trims whitespace, ignores `#`.
 fn read_dotenv() -> Result<(String, String), Box<dyn std::error::Error>> {
     let path = concat!(env!("CARGO_MANIFEST_DIR"), "/../../.env");
diff --git a/crates/proton-sdk/src/crypto/content.rs b/crates/proton-sdk/src/crypto/content.rs
index e02a570..fe6efe4 100644
--- a/crates/proton-sdk/src/crypto/content.rs
+++ b/crates/proton-sdk/src/crypto/content.rs
@@ -9,7 +9,7 @@
 use std::io::Cursor;
 
 use pgp::armor::Dearmor;
-use pgp::composed::{MessageBuilder, PlainSessionKey};
+use pgp::composed::{MessageBuilder, PlainSessionKey, RawSessionKey};
 use pgp::crypto::aead::{AeadAlgorithm, ChunkSize};
 use pgp::crypto::hash::HashAlgorithm;
 use pgp::crypto::sym::SymmetricKeyAlgorithm;
@@ -17,7 +17,7 @@ use pgp::packet::{
     LiteralData, Packet, PacketParser, PacketTrait, PublicKeyEncryptedSessionKey,
     SymEncryptedProtectedData,
 };
-use pgp::types::{EskType, PkeskVersion, PublicKeyTrait};
+use pgp::types::{DecryptionKey, EncryptionKey, EskType, PkeskVersion, Seipdv1ReadMode};
 
 use super::encrypt::{recipient_encryption_key, RecipientOp};
 use super::errors::CryptoError;
@@ -49,7 +49,7 @@ impl ContentKey {
     pub fn generate() -> Self {
         let mut rng = rand::thread_rng();
         let sym_alg = SymmetricKeyAlgorithm::AES256;
-        let key = sym_alg.new_session_key(&mut rng).to_vec();
+        let key = sym_alg.new_session_key(&mut rng);
         ContentKey {
             session_key: PlainSessionKey::V3_4 { sym_alg, key },
         }
@@ -62,9 +62,7 @@ impl ContentKey {
     /// `PgpSessionKey.GenerateForAead()`.
     pub fn generate_aead() -> Self {
         let mut rng = rand::thread_rng();
-        let key = SymmetricKeyAlgorithm::AES256
-            .new_session_key(&mut rng)
-            .to_vec();
+        let key = SymmetricKeyAlgorithm::AES256.new_session_key(&mut rng);
         ContentKey {
             session_key: PlainSessionKey::V6 { key },
         }
@@ -191,8 +189,8 @@ impl ContentKey {
     /// official clients, which hardcode it for v6 session keys.
     fn session_parts(&self) -> Result<(SymmetricKeyAlgorithm, &[u8]), CryptoError> {
         match &self.session_key {
-            PlainSessionKey::V3_4 { sym_alg, key } => Ok((*sym_alg, key)),
-            PlainSessionKey::V6 { key } => Ok((SymmetricKeyAlgorithm::AES256, key)),
+            PlainSessionKey::V3_4 { sym_alg, key } => Ok((*sym_alg, key.as_ref())),
+            PlainSessionKey::V6 { key } => Ok((SymmetricKeyAlgorithm::AES256, key.as_ref())),
             _ => Err(CryptoError::Encrypt(
                 "content key is not a V3/V4 or V6 session key".into(),
             )),
@@ -284,7 +282,7 @@ impl ContentKey {
         };
 
         seipd
-            .decrypt(key, Some(sym_alg))
+            .decrypt(key, Some(sym_alg), Seipdv1ReadMode::default())
             .map_err(|e| CryptoError::Decrypt(format!("block: {e}")))
     }
 }
@@ -322,13 +320,16 @@ impl PrivateKey {
         let pw = self.password();
         let key = self.key();
 
+        // pgp 0.20: `DecryptionKey::decrypt` is implemented on the packet secret
+        // (sub)keys (`SecretKey` / `SecretSubkey`), not on `SignedSecretKey`, so
+        // reach through `primary_key` and each subkey's `.key`.
         let mut last_err: CryptoError;
-        match key.decrypt_session_key(&pw, values, esk_type) {
+        match key.primary_key.decrypt(&pw, values, esk_type) {
             Ok(Ok(session_key)) => return Ok(ContentKey { session_key }),
             Ok(Err(e)) | Err(e) => last_err = CryptoError::Decrypt(format!("content key: {e}")),
         }
         for subkey in &key.secret_subkeys {
-            match subkey.decrypt_session_key(&pw, values, esk_type) {
+            match subkey.key.decrypt(&pw, values, esk_type) {
                 Ok(Ok(session_key)) => return Ok(ContentKey { session_key }),
                 Ok(Err(e)) | Err(e) => {
                     last_err = CryptoError::Decrypt(format!("content key (subkey): {e}"))
@@ -428,9 +429,15 @@ struct ContentKeyPacketOp<'a> {
 impl RecipientOp for ContentKeyPacketOp<'_> {
     type Out = PublicKeyEncryptedSessionKey;
 
-    fn run(self, pubkey: &impl PublicKeyTrait) -> pgp::errors::Result<Self::Out> {
+    fn run(self, pubkey: &impl EncryptionKey) -> pgp::errors::Result<Self::Out> {
         let mut rng = rand::thread_rng();
-        PublicKeyEncryptedSessionKey::from_session_key_v3(&mut rng, self.key, self.sym_alg, pubkey)
+        let session_key = RawSessionKey::from(self.key);
+        PublicKeyEncryptedSessionKey::from_session_key_v3(
+            &mut rng,
+            &session_key,
+            self.sym_alg,
+            pubkey,
+        )
     }
 }
 
@@ -443,16 +450,19 @@ struct ContentKeyPacketV6Op<'a> {
 impl RecipientOp for ContentKeyPacketV6Op<'_> {
     type Out = PublicKeyEncryptedSessionKey;
 
-    fn run(self, pubkey: &impl PublicKeyTrait) -> pgp::errors::Result<Self::Out> {
+    fn run(self, pubkey: &impl EncryptionKey) -> pgp::errors::Result<Self::Out> {
         let mut rng = rand::thread_rng();
-        PublicKeyEncryptedSessionKey::from_session_key_v6(&mut rng, self.key, pubkey)
+        let session_key = RawSessionKey::from(self.key);
+        PublicKeyEncryptedSessionKey::from_session_key_v6(&mut rng, &session_key, pubkey)
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use pgp::composed::{KeyType, MessageBuilder, SecretKeyParamsBuilder, SignedSecretKey};
+    use pgp::composed::{
+        EncryptionCaps, KeyType, MessageBuilder, SecretKeyParamsBuilder, SignedSecretKey,
+    };
     use pgp::crypto::sym::SymmetricKeyAlgorithm;
 
     /// Generate a passphrase-locked RSA key able to both sign and encrypt — a
@@ -463,16 +473,12 @@ mod tests {
             .key_type(KeyType::Rsa(2048))
             .can_sign(true)
             .can_certify(true)
-            .can_encrypt(true)
+            .can_encrypt(EncryptionCaps::All)
             .primary_user_id("node <node@proton.test>".into())
             .passphrase(Some(passphrase.to_owned()))
             .build()
             .expect("key params");
-        params
-            .generate(&mut rng)
-            .expect("generate")
-            .sign(&mut rng, &passphrase.into())
-            .expect("sign")
+        params.generate(&mut rng).expect("generate")
     }
 
     #[test]
@@ -576,7 +582,7 @@ mod tests {
             other => panic!("expected SEIPD, got {:?}", other.tag()),
         };
         let inner = seipd
-            .decrypt(key, Some(sym_alg))
+            .decrypt(key, Some(sym_alg), Seipdv1ReadMode::default())
             .expect("decrypt thumbnail");
 
         let mut inner_parser = PacketParser::new(Cursor::new(&inner));
diff --git a/crates/proton-sdk/src/crypto/encrypt.rs b/crates/proton-sdk/src/crypto/encrypt.rs
index 7773533..92a20c2 100644
--- a/crates/proton-sdk/src/crypto/encrypt.rs
+++ b/crates/proton-sdk/src/crypto/encrypt.rs
@@ -9,15 +9,14 @@
 use base64::engine::general_purpose::STANDARD as BASE64;
 use base64::Engine;
 use bytes::Bytes;
-use chrono::SubsecRound;
 use pgp::composed::{
-    ArmorOptions, KeyType, MessageBuilder, SecretKeyParamsBuilder, SignedSecretKey,
-    StandaloneSignature, SubkeyParamsBuilder,
+    ArmorOptions, DetachedSignature, EncryptionCaps, KeyType, MessageBuilder,
+    SecretKeyParamsBuilder, SignedSecretKey, SubkeyParamsBuilder,
 };
 use pgp::crypto::hash::HashAlgorithm;
 use pgp::crypto::sym::SymmetricKeyAlgorithm;
 use pgp::packet::{SignatureConfig, SignatureType, Subpacket, SubpacketData};
-use pgp::types::{CompressionAlgorithm, KeyDetails, KeyVersion, Password, PublicKeyTrait};
+use pgp::types::{CompressionAlgorithm, EncryptionKey, KeyDetails, KeyVersion};
 use rand::RngCore;
 
 use super::errors::CryptoError;
@@ -34,7 +33,7 @@ pub(crate) trait RecipientOp {
     /// The value produced by the operation.
     type Out;
     /// Run the operation against the selected public key.
-    fn run(self, pubkey: &impl PublicKeyTrait) -> pgp::errors::Result<Self::Out>;
+    fn run(self, pubkey: &impl EncryptionKey) -> pgp::errors::Result<Self::Out>;
 }
 
 /// Run `op` against the encryption-capable public key of `key`.
@@ -47,14 +46,14 @@ pub(crate) fn recipient_encryption_key<Op: RecipientOp>(
     op: Op,
 ) -> Result<Op::Out, CryptoError> {
     let primary = key.primary_key.public_key();
-    if primary.is_encryption_key() {
+    if primary.algorithm().can_encrypt() {
         return op
             .run(primary)
             .map_err(|e| CryptoError::Encrypt(format!("encrypt to primary key: {e}")));
     }
     for sub in &key.secret_subkeys {
         let pubsub = sub.public_key();
-        if pubsub.is_encryption_key() {
+        if pubsub.algorithm().can_encrypt() {
             return op
                 .run(&pubsub)
                 .map_err(|e| CryptoError::Encrypt(format!("encrypt to subkey: {e}")));
@@ -108,7 +107,7 @@ fn generate_node_key_versioned(version: KeyVersion) -> Result<GeneratedNodeKey,
     let subkey = SubkeyParamsBuilder::default()
         .version(version)
         .key_type(KeyType::X25519)
-        .can_encrypt(true)
+        .can_encrypt(EncryptionCaps::All)
         .passphrase(Some(pw_string.clone()))
         .build()
         .map_err(|e| CryptoError::Encrypt(format!("node subkey params: {e}")))?;
@@ -124,12 +123,11 @@ fn generate_node_key_versioned(version: KeyVersion) -> Result<GeneratedNodeKey,
         .build()
         .map_err(|e| CryptoError::Encrypt(format!("node key params: {e}")))?;
 
-    let secret = params
+    // In pgp 0.20 `generate` already returns a `SignedSecretKey`, locked with the
+    // passphrase set on the params (no separate sign/lock step as in 0.16).
+    let signed = params
         .generate(&mut rng)
         .map_err(|e| CryptoError::Encrypt(format!("generate node key: {e}")))?;
-    let signed = secret
-        .sign(&mut rng, &Password::from(passphrase.as_slice()))
-        .map_err(|e| CryptoError::Encrypt(format!("sign node key: {e}")))?;
     let locked_armored = signed
         .to_armored_string(None.into())
         .map_err(|e| CryptoError::Encrypt(format!("armor node key: {e}")))?;
@@ -275,20 +273,23 @@ pub(crate) fn sign_detached(signer: &PrivateKey, data: &[u8]) -> Result<String,
         Subpacket::regular(SubpacketData::IssuerFingerprint(key.fingerprint()))
             .map_err(|e| CryptoError::Encrypt(format!("issuer fingerprint subpacket: {e}")))?,
         Subpacket::regular(SubpacketData::SignatureCreationTime(
-            chrono::Utc::now().trunc_subsecs(0),
+            pgp::types::Timestamp::now(),
         ))
         .map_err(|e| CryptoError::Encrypt(format!("creation-time subpacket: {e}")))?,
     ];
     if key.version() <= KeyVersion::V4 {
-        config.unhashed_subpackets = vec![Subpacket::regular(SubpacketData::Issuer(key.key_id()))
-            .map_err(|e| CryptoError::Encrypt(format!("issuer subpacket: {e}")))?];
+        config.unhashed_subpackets =
+            vec![
+                Subpacket::regular(SubpacketData::IssuerKeyId(key.legacy_key_id()))
+                    .map_err(|e| CryptoError::Encrypt(format!("issuer subpacket: {e}")))?,
+            ];
     }
 
     let signature = config
         .sign(key, &pw, data)
         .map_err(|e| CryptoError::Encrypt(format!("detached sign: {e}")))?;
 
-    StandaloneSignature::new(signature)
+    DetachedSignature::new(signature)
         .to_armored_string(ArmorOptions::default())
         .map_err(|e| CryptoError::Encrypt(format!("armor signature: {e}")))
 }
@@ -304,7 +305,7 @@ struct EncryptSignOp<'a> {
 impl RecipientOp for EncryptSignOp<'_> {
     type Out = String;
 
-    fn run(self, pubkey: &impl PublicKeyTrait) -> pgp::errors::Result<String> {
+    fn run(self, pubkey: &impl EncryptionKey) -> pgp::errors::Result<String> {
         let mut rng = rand::thread_rng();
         let mut builder = MessageBuilder::from_bytes(Bytes::new(), self.data)
             .seipd_v1(&mut rng, SymmetricKeyAlgorithm::AES256);
@@ -370,13 +371,13 @@ mod tests {
         // rejects with "Invalid manifest signature". rPGP self-verify above is not
         // enough to catch that — assert the subpackets explicitly.
         use pgp::composed::Deserializable as _;
-        let (parsed, _) = StandaloneSignature::from_string(&sig).expect("parse detached sig");
+        let (parsed, _) = DetachedSignature::from_string(&sig).expect("parse detached sig");
         assert!(
             parsed.signature.created().is_some(),
             "detached signature missing creation time"
         );
         assert!(
-            !parsed.signature.issuer().is_empty(),
+            !parsed.signature.issuer_key_id().is_empty(),
             "detached signature missing issuer key id"
         );
     }
diff --git a/crates/proton-sdk/src/crypto/keys.rs b/crates/proton-sdk/src/crypto/keys.rs
index da9f6d1..5c60f38 100644
--- a/crates/proton-sdk/src/crypto/keys.rs
+++ b/crates/proton-sdk/src/crypto/keys.rs
@@ -4,7 +4,7 @@
 //! distinct pre-unlock step, so a [`PrivateKey`] simply pairs a parsed
 //! [`SignedSecretKey`] with the passphrase that unlocks it.
 
-use pgp::composed::{Deserializable, SignedSecretKey, StandaloneSignature};
+use pgp::composed::{Deserializable, SignedSecretKey, DetachedSignature};
 use pgp::types::Password;
 
 use super::errors::CryptoError;
@@ -64,7 +64,7 @@ impl PrivateKey {
 
     /// The public half of this key, for use as an anonymous-fallback verifier.
     pub(crate) fn signed_public_key(&self) -> pgp::composed::SignedPublicKey {
-        self.key.signed_public_key()
+        self.key.to_public_key()
     }
 
     /// Verify an armored detached signature over `data` against this key's
@@ -74,9 +74,9 @@ impl PrivateKey {
         armored_sig: &str,
         data: &[u8],
     ) -> Result<(), CryptoError> {
-        let (sig, _headers) = StandaloneSignature::from_string(armored_sig)
+        let (sig, _headers) = DetachedSignature::from_string(armored_sig)
             .map_err(|e| CryptoError::Parse(format!("detached signature: {e}")))?;
-        sig.verify(&self.key.signed_public_key(), data)
+        sig.verify(&self.key.to_public_key(), data)
             .map_err(|e| CryptoError::Verification(e.to_string()))
     }
 
diff --git a/crates/proton-sdk/src/crypto/verify.rs b/crates/proton-sdk/src/crypto/verify.rs
index e49202f..0f7f712 100644
--- a/crates/proton-sdk/src/crypto/verify.rs
+++ b/crates/proton-sdk/src/crypto/verify.rs
@@ -9,10 +9,10 @@
 //! throwing.
 
 use pgp::composed::{
-    Deserializable, Message, SignedPublicKey, SignedSecretKey, StandaloneSignature,
+    Deserializable, Message, SignedPublicKey, SignedSecretKey, DetachedSignature,
     VerificationResult,
 };
-use pgp::types::{Password, PublicKeyTrait};
+use pgp::types::{Password, VerifyingKey};
 use serde::{Deserialize, Serialize};
 
 use super::errors::CryptoError;
@@ -111,8 +111,8 @@ impl VerificationKeyRing {
         self.keys.is_empty()
     }
 
-    fn dyn_refs(&self) -> Vec<&dyn PublicKeyTrait> {
-        self.keys.iter().map(|k| k as &dyn PublicKeyTrait).collect()
+    fn dyn_refs(&self) -> Vec<&dyn VerifyingKey> {
+        self.keys.iter().map(|k| k as &dyn VerifyingKey).collect()
     }
 }
 
@@ -122,7 +122,7 @@ pub fn verify_detached(
     data: &[u8],
     ring: &VerificationKeyRing,
 ) -> VerificationStatus {
-    let signature = match StandaloneSignature::from_string(armored_sig) {
+    let signature = match DetachedSignature::from_string(armored_sig) {
         Ok((sig, _headers)) => sig,
         Err(_) => return VerificationStatus::Failed,
     };