From a2d549c4695ab8fabe497189ff8f78dea19270b8 Mon Sep 17 00:00:00 2001
From: Heng-Yi Wu <2316687+henry40408@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:30:15 +0800
Subject: [PATCH] chore(deps): update chacha20 to 0.10.2 and drop the yank
 exception
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

chacha20 0.10.0 and 0.10.1 are both yanked upstream (a yank, not an
advisory). 0.10.2 was published 2026-08-27 and has now cleared the 7-day
hold on fresh releases, so take it and remove the stop-gap ignore that
#161 added to deny.toml.

The crate is transitive only, via rand 0.10.2 under sqlx-postgres and
axum-test. The e2e workspace keeps its own lockfile and pinned the same
yanked version, so bump it too — cargo-deny only scans the root, but
there is no reason to leave the second lock on a yanked release.

Closes #162

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 Cargo.lock     | 4 ++--
 deny.toml      | 6 ------
 e2e/Cargo.lock | 4 ++--
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0f311cf..f09aed2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -381,9 +381,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
diff --git a/deny.toml b/deny.toml
index d4e4804..4433874 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,12 +15,6 @@ ignore = [
     # spin 0.9.8 is yanked but pulled in transitively via flume -> sqlx-sqlite;
     # we don't control the version and there is no non-yanked 0.9.x to move to.
     "spin@0.9.8",
-    # chacha20 0.10.1 was yanked upstream (not an advisory); it is pulled in
-    # transitively via rand. 0.10.0 is yanked too, so the only non-yanked
-    # stable release is 0.10.2, published 2026-08-27 — too new to adopt under
-    # the 7-day hold on fresh releases, which clears on 2026-09-03. Remove
-    # this then; see #162.
-    "chacha20@0.10.1",
 ]
 
 [licenses]
diff --git a/e2e/Cargo.lock b/e2e/Cargo.lock
index af32937..5bcbe1d 100644
--- a/e2e/Cargo.lock
+++ b/e2e/Cargo.lock
@@ -281,9 +281,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",