From 2b6aba3b5f6380f585f28a5f167f386d5094bd03 Mon Sep 17 00:00:00 2001 From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:28:31 +0800 Subject: [PATCH 1/2] chore(deps): pull in chacha20 0.10.2 and drop the deny.toml exception chacha20 0.10.0 and 0.10.1 were yanked upstream; #100 parked a temporary `[advisories] ignore` entry because the unyanked 0.10.2 (published 2026-08-27) was still inside the 7-day publish cooldown. That cooldown has cleared, so take the real fix and remove the exception. - `cargo update -p chacha20` (0.10.0 -> 0.10.2) - Drop the `chacha20@0.10.0` ignore entry and revert the `ignore` doc comment now that the list is empty again Closes #101 Co-Authored-By: Claude Opus 5 (1M context) --- Cargo.lock | 4 ++-- deny.toml | 11 ++--------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 01946da..422999f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -246,9 +246,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", diff --git a/deny.toml b/deny.toml index cd816e7..c902104 100644 --- a/deny.toml +++ b/deny.toml @@ -9,16 +9,9 @@ all-features = true [advisories] version = 2 # Deny crates with a known security advisory (RUSTSEC) or that have been yanked. -# `ignore` holds advisory IDs, and yanked-crate specs, we've reviewed and -# consciously accept. +# `ignore` holds advisory IDs we've reviewed and consciously accept. yanked = "deny" -ignore = [ - # chacha20 0.10.0 was yanked upstream; the unyanked 0.10.2 landed - # 2026-08-27 and is still inside the 7-day publish cooldown. Reached only - # transitively via rand -> sqlx-postgres, and the yank is not a security - # advisory. Drop this entry and `cargo update -p chacha20` from 2026-09-03. - { crate = "chacha20@0.10.0", reason = "yanked upstream; 0.10.2 still in publish cooldown" }, -] +ignore = [] [licenses] version = 2 From be54f98a95e574741a012984641c77594c6e1cb4 Mon Sep 17 00:00:00 2001 From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:28:45 +0800 Subject: [PATCH 2/2] fix(deps): update event-listener to 5.4.2 for RUSTSEC-2026-0221 RUSTSEC-2026-0221 landed after #101 was filed and turns the deny job red independently of the chacha20 yank: event-listener <=5.4.1 unconditionally implements `Send`/`Sync` for `StackSlot<'_, T>`, letting a `!Send` tag set via `Event::with_tag` cross a thread boundary. We reach it only transitively through sqlx-core and never call `Event::with_tag`, but the advisory is a hard `cargo deny` failure either way. 5.4.2 was published 2026-07-27, well clear of the 7-day cooldown. It also drops the concurrent-queue dependency. Co-Authored-By: Claude Opus 5 (1M context) --- Cargo.lock | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 422999f..2c6e9eb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -364,15 +364,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "concurrent-queue" -version = "2.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" -dependencies = [ - "crossbeam-utils", -] - [[package]] name = "const-oid" version = "0.10.2" @@ -631,11 +622,10 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ]