From e2b01a3b36f30ba727b60b27d6b0d54a6fd667f6 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Mon, 9 Mar 2026 10:11:18 +0100
Subject: [PATCH 1/2] Only activiate heapless-bytes/heapless-0.9 in trussed

---
 Cargo.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 750df986900..8ff95266e74 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ license = "Apache-2.0 OR MIT"
 repository = "https://github.com/trussed-dev/trussed"
 
 [workspace.dependencies]
-heapless-bytes = { version = "0.5", features = ["heapless-0.9"]}
+heapless-bytes = "0.5"
 littlefs2-core = { version = "0.1", features = ["serde"] }
 postcard = "0.7.0"
 rand_core = "0.6"
@@ -60,7 +60,7 @@ sha2 = { version = "0.10", default-features = false }
 cosey = "0.4"
 delog = "0.1.0"
 cbor-smol = { version = "0.5", features = ["heapless-bytes-v0-5"] }
-heapless-bytes.workspace = true
+heapless-bytes = { workspace = true, features = ["heapless-0.9"] }
 interchange = "0.3.0"
 littlefs2 = "0.7.0"
 littlefs2-core = { workspace = true, features = ["heapless-bytes05"] }

From 81de091a78844c70ad459f2066f2852dc05821f0 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Mon, 9 Mar 2026 10:15:34 +0100
Subject: [PATCH 2/2] Update changelogs

---
 CHANGELOG.md      | 9 +++++++--
 core/CHANGELOG.md | 1 +
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e9f1cf30f5..989987a4b20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,7 +30,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `PollClient::syscall`.
 - Upgrade the `interchange` dependency to version 0.3.0 ([#99][])
   - As a consequence the type `pipe::TrussedInterchange` becomes a const`pipe::TRUSSED_INTERCHANGE`
-- Updated `littlefs2` to 0.6.0.
 - Made `Request`, `Reply`, `Error`, `Context`, `CoreContext`, `Mechanism`,
   `KeySerialization`, `SignatureSerialization`, `consent::Error`, `ui::Status` non-exhaustive.
 - Made `postcard_deserialize`, `postcard_serialize` and
@@ -40,7 +39,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   of being generic over the storage implementation.
 - Add `nonce` argument to `wrap_key` and `unwrap_key` syscalls.
 - Use nonce as IV for Aes256Cbc mechanism.
-- Updated `cbor-smol` to 0.5.0.
 - Removed `serde::{Deserialize, Serialize}` implementations for the API request
   and reply structs, `types::{consent::{Error, Level}, reboot::To, StorageAttributes,
   KeySerialization, SignatureSerialization}`.
@@ -67,6 +65,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Replaced the mechanism RPC traits in `service` with a single `MechanismImpl` trait.
 - Made the `mechanisms` module private.  Mechanism implementation can still be accessed via the `Mechanism` enum.
 - Changed the `Aes256Cbc` mechanism to use no padding instead of zero padding.
+- Updated dependencies to:
+  - `cbor-smol` 0.5
+  - `cosey` 0.4
+  - `flexiber` 0.2
+  - `heapless` 0.9
+  - `heapless-bytes` 0.5
+  - `littlefs2` 0.7
 
 ### Fixed
 
diff --git a/core/CHANGELOG.md b/core/CHANGELOG.md
index ba876e369e2..e46cb3d7e6f 100644
--- a/core/CHANGELOG.md
+++ b/core/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Changed
 
 - Deprecate `FilesystemClient::debug_dump_store`.  Instead, a debugger should be used to extract the filesystem from a development device.
+- Update to `heapless-bytes` v0.5.
 
 ## [v0.1.0](https://github.com/trussed-dev/trussed/releases/tag/core-v0.1.0) (2025-01-08)