From 868a78144842954d4229d2db8022b67f73685241 Mon Sep 17 00:00:00 2001 From: Steve Brown Date: Sat, 26 Sep 2026 10:42:18 -0400 Subject: [PATCH] fix(deps): chacha20 0.10.1 (yanked) -> 0.10.2 (aegis-vw9iek) chacha20 0.10.1 is yanked on crates.io. Upstream 0.10.2 fixes use of an SSE4.1 intrinsic in the SSE2 backend of the RNG and legacy variants (RustCrypto stream-ciphers #580), which is a fault on CPUs without SSE4.1. bobbin pulls it only transitively, via rand 0.10.2 (lopdf/pdf-extract, twox-hash/lance/arrow). Cargo.lock only: chacha20's version and checksum; no other crate moves. The new checksum equals crates.io's. cargo check --locked --features knowledge passes and the yanked warning is gone. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UszAbpDcC8doX5bQ9K6WkB --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0a535d8c..a46140aa 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1089,9 +1089,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0",