From 6e36c537eaf2fc0bb1a8184ac638d344a04e0943 Mon Sep 17 00:00:00 2001 From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com> Date: Sat, 29 Aug 2026 00:04:37 +0800 Subject: [PATCH 1/2] fix(docker): bump cargo-zigbuild to 0.23.0 for the Cortex-A53 linker arg Rust 1.98 makes rustc pass `-Wl,--fix-cortex-a53-843419` on aarch64-unknown-linux-musl (rust-lang/rust#155453). zig's linker rejects it, so every arm64 image build since #156 fails with `unsupported linker arg: --fix-cortex-a53-843419`. cargo-zigbuild filters that arg from 0.23.0 onward (rust-cross/cargo-zigbuild#452); the pinned 0.22.3 predates the fix. ci.yml never cross-compiles, so nothing outside docker.yml sees this. Co-Authored-By: Claude Opus 5 (1M context) --- Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 829dfde..c9b0633 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,10 @@ RUN apt-get update \ # Zig 0.14.1 avoids the libc++-19 bindgen requirement that 0.15+ introduces. ARG ZIG_VERSION=0.14.1 -ARG ZIGBUILD_VERSION=0.22.3 +# 0.23.0 is the first release whose zigcc wrapper filters +# `-Wl,--fix-cortex-a53-843419`, which rustc started passing for +# aarch64-unknown-linux-musl in 1.98 and zig's linker rejects. +ARG ZIGBUILD_VERSION=0.23.0 RUN cargo install cargo-zigbuild --version "${ZIGBUILD_VERSION}" --locked RUN set -eux; \ case "$(uname -m)" in \ From c301296ecf693fa60c677c917abe755b7a310d76 Mon Sep 17 00:00:00 2001 From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com> Date: Sat, 29 Aug 2026 00:15:48 +0800 Subject: [PATCH 2/2] chore(deny): ignore the yanked chacha20 0.10.1 until 0.10.2 clears the hold MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit chacha20 0.10.1 was yanked upstream, so `cargo deny check` fails on every branch. It is not a security advisory — the crate's only RUSTSEC entry is RUSTSEC-2019-0029 against 0.1.x — and it reaches us transitively via rand. 0.10.0 is yanked too, leaving 0.10.2 (published 2026-08-27) as the only non-yanked stable release, which is inside the 7-day hold on fresh releases. Ignore the yank until 2026-09-03; #162 tracks removing it. Co-Authored-By: Claude Opus 5 (1M context) --- deny.toml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deny.toml b/deny.toml index 4433874..d4e4804 100644 --- a/deny.toml +++ b/deny.toml @@ -15,6 +15,12 @@ ignore = [ # spin 0.9.8 is yanked but pulled in transitively via flume -> sqlx-sqlite; # we don't control the version and there is no non-yanked 0.9.x to move to. "spin@0.9.8", + # chacha20 0.10.1 was yanked upstream (not an advisory); it is pulled in + # transitively via rand. 0.10.0 is yanked too, so the only non-yanked + # stable release is 0.10.2, published 2026-08-27 — too new to adopt under + # the 7-day hold on fresh releases, which clears on 2026-09-03. Remove + # this then; see #162. + "chacha20@0.10.1", ] [licenses]