From 47da12469520f4d0329413b66c044c54e9c60943 Mon Sep 17 00:00:00 2001
From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com>
Date: Sat, 29 Aug 2026 00:00:45 +0800
Subject: [PATCH 1/2] fix(docker): bump cargo-zigbuild to 0.23.0 for the rustc
 1.98 linker arg

rustc 1.98 emits -Wl,--fix-cortex-a53-843419 for aarch64 targets
(rust-lang/rust#155453). zig's linker rejects the flag, so every arm64
image build has failed since the toolchain bump in #95. cargo-zigbuild
0.23.0 filters the argument out before invoking zig.

0.23.0 keeps the version-branching support for zig 0.14, so ZIG_VERSION
stays pinned where it is.
---
 Dockerfile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index c480a17..39e0237 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,10 @@ RUN apt-get update \
 
 # Zig 0.14.1 avoids the libc++-19 bindgen requirement that 0.15+ introduces.
 ARG ZIG_VERSION=0.14.1
-ARG ZIGBUILD_VERSION=0.22.3
+# 0.23.0 is the first release that drops `-Wl,--fix-cortex-a53-843419`, which
+# rustc emits for aarch64 since 1.98 (rust-lang/rust#155453) and zig's linker
+# rejects. Anything older fails the arm64 leg outright.
+ARG ZIGBUILD_VERSION=0.23.0
 RUN cargo install cargo-zigbuild --version "${ZIGBUILD_VERSION}" --locked
 RUN set -eux; \
     case "$(uname -m)" in \

From 396b38863def4c1a00867fcc0518650e1909b57d Mon Sep 17 00:00:00 2001
From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com>
Date: Sat, 29 Aug 2026 00:00:45 +0800
Subject: [PATCH 2/2] chore(deny): temporarily accept yanked chacha20 0.10.0

chacha20 0.10.0 and 0.10.1 were yanked upstream after #95 was checked,
turning the deny job red on main. The unyanked 0.10.2 was published
2026-08-27 and is still inside the 7-day publish cooldown, so pull it in
from 2026-09-03 and drop this exception then.
---
 deny.toml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/deny.toml b/deny.toml
index 0427393..cd816e7 100644
--- a/deny.toml
+++ b/deny.toml
@@ -9,9 +9,15 @@ all-features = true
 [advisories]
 version = 2
 # Deny crates with a known security advisory (RUSTSEC) or that have been yanked.
-# `ignore` holds advisory IDs we've reviewed and consciously accept.
+# `ignore` holds advisory IDs, and yanked-crate specs, we've reviewed and
+# consciously accept.
 yanked = "deny"
 ignore = [
+    # chacha20 0.10.0 was yanked upstream; the unyanked 0.10.2 landed
+    # 2026-08-27 and is still inside the 7-day publish cooldown. Reached only
+    # transitively via rand -> sqlx-postgres, and the yank is not a security
+    # advisory. Drop this entry and `cargo update -p chacha20` from 2026-09-03.
+    { crate = "chacha20@0.10.0", reason = "yanked upstream; 0.10.2 still in publish cooldown" },
 ]
 
 [licenses]