Skip to content

chore(deps): update chacha20 to 0.10.2 and drop the yank exception - #165

Merged
henry40408 merged 1 commit into
mainfrom
chore/162-drop-chacha20-yank-exception
Sep 3, 2026
Merged

henry40408 merged 1 commit into
mainfrom
chore/162-drop-chacha20-yank-exception

Conversation

@henry40408

Copy link
Copy Markdown
Owner

chacha20 0.10.0 and 0.10.1 are both yanked upstream — a yank, not a security
advisory (the only RUSTSEC entry for the crate, RUSTSEC-2019-0029, is against
0.1.x). 0.10.2 was published 2026-08-27 and has now cleared the 7-day hold on
fresh releases, so this takes it and removes the stop-gap advisories.ignore
entry that #161 added to deny.toml.

The crate is transitive only, via rand 0.10.2 under sqlx-postgres and
axum-test:

chacha20 v0.10.2
├── rand v0.10.2
│   ├── rust-multipart-rfc7578_2 v0.9.0 → axum-test v21.1.0 [dev-dependencies]
│   └── sqlx-postgres v0.9.0 → sqlx v0.9.0
└── rand v0.10.2 → sqlx-postgres v0.9.0 → sqlx-macros-core → sqlx-macros

The e2e/ workspace keeps its own lockfile and pinned the same yanked version,
so it is bumped too. CI only runs cargo deny check at the repository root, so
that lock was not failing anything — there is just no reason to leave a second
lockfile on a yanked release.

Lockfiles and config only; no source change, hence no test — nothing about the
program's behaviour changes. README screenshots are unaffected (no template,
CSS or rendered copy in the diff).

Verification

cargo deny check (exit 0):

advisories ok, bans ok, licenses ok, sources ok

cargo nextest run (exit 0):

     Summary [  62.914s] 672 tests run: 672 passed, 0 skipped

cd e2e && cargo check --all-targets (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 29.96s

Closes #162

🤖 Generated with Claude Code

chacha20 0.10.0 and 0.10.1 are both yanked upstream (a yank, not an
advisory). 0.10.2 was published 2026-08-27 and has now cleared the 7-day
hold on fresh releases, so take it and remove the stop-gap ignore that
#161 added to deny.toml.

The crate is transitive only, via rand 0.10.2 under sqlx-postgres and
axum-test. The e2e workspace keeps its own lockfile and pinned the same
yanked version, so bump it too — cargo-deny only scans the root, but
there is no reason to leave the second lock on a yanked release.

Closes #162

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@codecov

codecov Bot commented Sep 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.31%. Comparing base (6fb2ad7) to head (a2d549c).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #165   +/-   ##
=======================================
  Coverage   96.31%   96.31%           
=======================================
  Files          28       28           
  Lines       13132    13132           
=======================================
  Hits        12648    12648           
  Misses        484      484           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@henry40408
henry40408 merged commit e0932e9 into main Sep 3, 2026
6 checks passed
@henry40408
henry40408 deleted the chore/162-drop-chacha20-yank-exception branch September 3, 2026 16:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Drop the chacha20@0.10.1 yank exception once 0.10.2 clears the 7-day hold

1 participant