From 46531bcddb4f9cea1c62a5c07309a931c2f82c67 Mon Sep 17 00:00:00 2001
From: Andrea Debernardi <andrea@debbaweb.it>
Date: Sun, 18 Oct 2026 17:04:10 +0200
Subject: [PATCH] fix(ci): update yanked chacha20 and let the audit job report
 checks

---
 .github/workflows/ci.yml | 4 ++++
 Cargo.lock               | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0d8ab3..04aa111 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -88,6 +88,10 @@ jobs:
   audit:
     name: Security audit
     runs-on: ubuntu-latest
+    # audit-check reports warnings (e.g. yanked crates) as a check run.
+    permissions:
+      contents: read
+      checks: write
     steps:
       - uses: actions/checkout@v7
       - uses: rustsec/audit-check@v2
diff --git a/Cargo.lock b/Cargo.lock
index c0730b7..a9748b7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -128,9 +128,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",