From d053a7990c89af23c553ba8436251a93d7d3f885 Mon Sep 17 00:00:00 2001
From: Cody Kickertz <cody.kickertz@pm.me>
Date: Thu, 3 Sep 2026 09:11:29 -0500
Subject: [PATCH] chore(deps): bump chacha20 from 0.10.1 to 0.10.2 (0.10.x
 yanked upstream)

RustCrypto yanked chacha20 0.10.0 and 0.10.1 after a soundness report
in the SSE2 backend (RustCrypto/stream-ciphers#579: an SSE4.1
intrinsic gated only on SSE2 is UB under Miri); 0.10.2 carries the
fix. The Security workflow's `cargo audit --deny yanked` leg has
failed every scheduled main run since the yank.

Lockfile-only `cargo update -p chacha20` in the root and fuzz
workspaces; chacha20poly1305 and all other pins unchanged. Verified
locally: `cargo audit --deny unmaintained --deny unsound --deny
yanked` passes on both lockfiles; `cargo check --workspace --locked`
clean.

Co-authored-by: forkwright <cody@forkwright.com>
---
 Cargo.lock      | 6 +++---
 fuzz/Cargo.lock | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 29da444..916c448 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -383,9 +383,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -1956,7 +1956,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index 9a835ad..1229da3 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -102,9 +102,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",