chore(deps): bump chacha20 from 0.10.1 to 0.10.2 (0.10.x yanked upstream) - #492
Merged
Conversation
…eam) RustCrypto yanked chacha20 0.10.0 and 0.10.1 after a soundness report in the SSE2 backend (RustCrypto/stream-ciphers#579: an SSE4.1 intrinsic gated only on SSE2 is UB under Miri); 0.10.2 carries the fix. The Security workflow's `cargo audit --deny yanked` leg has failed every scheduled main run since the yank. Lockfile-only `cargo update -p chacha20` in the root and fuzz workspaces; chacha20poly1305 and all other pins unchanged. Verified locally: `cargo audit --deny unmaintained --deny unsound --deny yanked` passes on both lockfiles; `cargo check --workspace --locked` clean. Co-authored-by: forkwright <cody@forkwright.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chore(deps): bump chacha20 from 0.10.1 to 0.10.2 (0.10.x yanked upstream)
RustCrypto yanked chacha20 0.10.0 and 0.10.1 after a soundness report
in the SSE2 backend (RustCrypto/stream-ciphers#579: an SSE4.1
intrinsic gated only on SSE2 is UB under Miri); 0.10.2 carries the
fix. The Security workflow's
cargo audit --deny yankedleg hasfailed every scheduled main run since the yank.
Lockfile-only
cargo update -p chacha20in the root and fuzzworkspaces; chacha20poly1305 and all other pins unchanged. Verified
locally:
cargo audit --deny unmaintained --deny unsound --deny yankedpasses on both lockfiles;cargo check --workspace --lockedclean.
Co-authored-by: forkwright cody@forkwright.com