chore(deps): pull in chacha20 0.10.2 and unbreak the deny job - #103
Merged
Merged
Conversation
chacha20 0.10.0 and 0.10.1 were yanked upstream; #100 parked a temporary `[advisories] ignore` entry because the unyanked 0.10.2 (published 2026-08-27) was still inside the 7-day publish cooldown. That cooldown has cleared, so take the real fix and remove the exception. - `cargo update -p chacha20` (0.10.0 -> 0.10.2) - Drop the `chacha20@0.10.0` ignore entry and revert the `ignore` doc comment now that the list is empty again Closes #101 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
RUSTSEC-2026-0221 landed after #101 was filed and turns the deny job red independently of the chacha20 yank: event-listener <=5.4.1 unconditionally implements `Send`/`Sync` for `StackSlot<'_, T>`, letting a `!Send` tag set via `Event::with_tag` cross a thread boundary. We reach it only transitively through sqlx-core and never call `Event::with_tag`, but the advisory is a hard `cargo deny` failure either way. 5.4.2 was published 2026-07-27, well clear of the 7-day cooldown. It also drops the concurrent-queue dependency. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #103 +/- ##
=======================================
Coverage 91.20% 91.20%
=======================================
Files 31 31
Lines 4468 4468
=======================================
Hits 4075 4075
Misses 393 393 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #101.
The 7-day publish cooldown on
chacha200.10.2 (published 2026-08-27) has cleared, so the temporary[advisories] ignoreexception parked by #100 can go.cargo update -p chacha20(0.10.0 -> 0.10.2)chacha20@0.10.0ignore entry fromdeny.tomland revert theignoredoc comment now that the list is empty againAlso in here: event-listener 5.4.2
RUSTSEC-2026-0221 landed after #101 was filed and fails
cargo denyon its own, so the deny job would have stayed red without it.event-listener<=5.4.1 unconditionally implementsSend/SyncforStackSlot<'_, T>, letting a!Sendtag set viaEvent::with_tagcross a thread boundary. We reach the crate only transitively viasqlx-coreand never callEvent::with_tag, but the advisory is a hard failure regardless. 5.4.2 was published 2026-07-27, well clear of the cooldown, and drops theconcurrent-queuedependency.Verification
No test accompanies this change: it is a lockfile and cargo-deny config change with no behaviour change in
luritself, and the existing suite pluscargo deny checkcover it.🤖 Generated with Claude Code