From 414f268a9fb9c15b5fc23634f1a40ed995e14fcc Mon Sep 17 00:00:00 2001 From: Cody Kickertz Date: Thu, 3 Sep 2026 09:11:32 -0500 Subject: [PATCH] chore(deps): bump chacha20 from 0.10.0 to 0.10.2 (0.10.x yanked upstream) RustCrypto yanked chacha20 0.10.0 and 0.10.1 after a soundness report in the SSE2 backend (RustCrypto/stream-ciphers#579: an SSE4.1 intrinsic gated only on SSE2 is UB under Miri); 0.10.2 carries the fix. The Security workflow's `cargo audit --deny yanked` leg has failed every scheduled main run since the yank. Lockfile-only `cargo update -p chacha20@0.10.0`; the 0.9.1 entry and all other pins unchanged. Verified locally: `cargo audit --deny unmaintained --deny unsound --deny yanked` passes; `cargo check --workspace --locked` clean. Co-authored-by: forkwright --- Cargo.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 94152be..f670def 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -259,9 +259,9 @@ dependencies = [ [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -1044,7 +1044,7 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "chacha20 0.10.0", + "chacha20 0.10.2", "getrandom 0.4.2", "rand_core 0.10.1", ]