Thanks @ioquatix.

What do you think about version bumping for this? It's not a major version bump, since no interfaces changed. But the dependencies did change slightly, so probably a minor version bump?

I think it's fine. No one should be depending on the checksum implementation. I'd even just do a patch release.

No one should be depending on the checksum implementation.

I agree they shouldn't. But if you told me that Truffle- or J- or MRI Ruby version X has a problem where the SHA256 interface is broken in some way (perhaps because of libssl?) I'd believe you in an instant. I've started leaning towards minor version bumps for dependency changes for this reason.

But here's an even better reason: this release actually adds a feature: FIPS compatibility.