Skip to content

chore(deps): pull in chacha20 0.10.2 and unbreak the deny job - #103

Merged
henry40408 merged 2 commits into
mainfrom
chore/101-chacha20-0-10-2
Sep 3, 2026
Merged

henry40408 merged 2 commits into
mainfrom
chore/101-chacha20-0-10-2

Conversation

@henry40408

Copy link
Copy Markdown
Owner

Closes #101.

The 7-day publish cooldown on chacha20 0.10.2 (published 2026-08-27) has cleared, so the temporary [advisories] ignore exception parked by #100 can go.

  • cargo update -p chacha20 (0.10.0 -> 0.10.2)
  • Drop the chacha20@0.10.0 ignore entry from deny.toml and revert the ignore doc comment now that the list is empty again

Also in here: event-listener 5.4.2

RUSTSEC-2026-0221 landed after #101 was filed and fails cargo deny on its own, so the deny job would have stayed red without it. event-listener <=5.4.1 unconditionally implements Send/Sync for StackSlot<'_, T>, letting a !Send tag set via Event::with_tag cross a thread boundary. We reach the crate only transitively via sqlx-core and never call Event::with_tag, but the advisory is a hard failure regardless. 5.4.2 was published 2026-07-27, well clear of the cooldown, and drops the concurrent-queue dependency.

Verification

$ cargo deny check
advisories ok, bans ok, licenses ok, sources ok

$ cargo clippy --all-targets -- -D warnings
Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 16s

$ cargo nextest run
Summary [8.747s] 241 tests run: 241 passed, 0 skipped

No test accompanies this change: it is a lockfile and cargo-deny config change with no behaviour change in lur itself, and the existing suite plus cargo deny check cover it.

🤖 Generated with Claude Code

henry40408 and others added 2 commits September 4, 2026 00:28
chacha20 0.10.0 and 0.10.1 were yanked upstream; #100 parked a temporary
`[advisories] ignore` entry because the unyanked 0.10.2 (published
2026-08-27) was still inside the 7-day publish cooldown. That cooldown has
cleared, so take the real fix and remove the exception.

- `cargo update -p chacha20` (0.10.0 -> 0.10.2)
- Drop the `chacha20@0.10.0` ignore entry and revert the `ignore` doc
  comment now that the list is empty again

Closes #101

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
RUSTSEC-2026-0221 landed after #101 was filed and turns the deny job red
independently of the chacha20 yank: event-listener <=5.4.1 unconditionally
implements `Send`/`Sync` for `StackSlot<'_, T>`, letting a `!Send` tag set
via `Event::with_tag` cross a thread boundary. We reach it only
transitively through sqlx-core and never call `Event::with_tag`, but the
advisory is a hard `cargo deny` failure either way.

5.4.2 was published 2026-07-27, well clear of the 7-day cooldown. It also
drops the concurrent-queue dependency.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@henry40408
henry40408 merged commit b6f4a1e into main Sep 3, 2026
6 checks passed
@codecov

codecov Bot commented Sep 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.20%. Comparing base (8859544) to head (be54f98).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #103   +/-   ##
=======================================
  Coverage   91.20%   91.20%           
=======================================
  Files          31       31           
  Lines        4468     4468           
=======================================
  Hits         4075     4075           
  Misses        393      393           
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@henry40408
henry40408 deleted the chore/101-chacha20-0-10-2 branch September 3, 2026 16:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pull in chacha20 0.10.2 and drop the temporary deny.toml exception

1 participant