From d9472b9f72355024a6686a3195c566a4aef46ae1 Mon Sep 17 00:00:00 2001 From: Cody Kickertz Date: Thu, 3 Sep 2026 09:11:34 -0500 Subject: [PATCH] chore(deps): bump chacha20 from 0.10.1 to 0.10.2 (0.10.x yanked upstream) RustCrypto yanked chacha20 0.10.0 and 0.10.1 after a soundness report in the SSE2 backend (RustCrypto/stream-ciphers#579: an SSE4.1 intrinsic gated only on SSE2 is UB under Miri); 0.10.2 carries the fix. The Security workflow's `cargo audit --deny yanked` leg has failed every scheduled main run since the yank. Lockfile-only `cargo update -p chacha20`; chacha20poly1305 stays at the provenance-locked 0.11.0 and every other pin is unchanged, so crypto-provenance.toml needs no re-derivation. Verified locally: `cargo audit --deny unmaintained --deny unsound --deny yanked` passes; `cargo test --features preview-pq --locked` green, including the provenance lock and the RFC 8439 ChaCha20-Poly1305 KAT over the bumped backend. Co-authored-by: forkwright --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 30a79bc..9788a62 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -92,9 +92,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cipher",