RUSTSEC-2026-0238

In all published versions of `dcrypt-algorithms` before 2.0.0, the low-level `Gcm` builder required an operation nonce but derived `J0` from the nonce captured by the original `Gcm` constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values, compromising confidentiality and authenticity under an affected key.

Version 2.0.0 makes `Gcm` key-only and passes the operation nonce through IV derivation, encryption, and decryption. It also corrects non-96-bit IV processing, rejects tags shorter than 96 bits, and enforces counter limits. Applications must upgrade, identify affected keys, rotate them, and re-encrypt affected data; updating the implementation cannot restore security after nonce reuse.