From 195fe1e7008fb866098b83bdc22586e03596b21d Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Wed, 9 Sep 2026 22:44:32 +0000 Subject: [PATCH] build(deps): move chacha20 off the yanked 0.10.1 chacha20 0.10.1 is yanked on crates.io. It reaches this tree through rand, which is a direct dependency, so it sits on the built path rather than off to one side. The requirement in Cargo.toml already admitted 0.10.2, so this is a lockfile change and nothing else moved: the diff is the chacha20 package entry and rand's reference to it. This is not a security fix. cargo audit reports nothing against chacha20 at either version, and 0.10.1 was withdrawn by its maintainer rather than flagged by an advisory. What the move buys is that a fresh checkout resolves without reaching for a yanked version. Gated on the branch: fmt, build, clippy with -D warnings and the library tests all pass, 2314 tests and 0 failed, and the six repo guards exit 0. --- CHANGELOG.md | 11 +++++++++++ Cargo.lock | 6 +++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3b884b93..d074ff81 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,6 +30,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 interval instead. That retry interval gates only a peer whose last attempt failed, so it cannot clamp a `heartbeat_interval_secs` configured below it. +### Changed + +- The lockfile moves `chacha20` from 0.10.1 to 0.10.2, because 0.10.1 is yanked. + It arrives through `rand`, a direct dependency, + so it sits on the built path rather than off to one side. The requirement in + `Cargo.toml` already admitted 0.10.2, so this is a lockfile change and no code + changed with it. **This is not a security fix**: `cargo audit` reports nothing + against `chacha20` at either version, and 0.10.1 was withdrawn by its + maintainer rather than flagged by an advisory. What it buys is that a fresh + checkout can resolve the lockfile without reaching for a yanked version. + ## [0.5.1] - 2026-09-06 ### Fixed diff --git a/Cargo.lock b/Cargo.lock index b8d7ca4e..1f41a814 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -498,9 +498,9 @@ dependencies = [ [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -2614,7 +2614,7 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "chacha20 0.10.1", + "chacha20 0.10.2", "getrandom 0.4.3", "rand_core 0.10.1", ]