From df108ef5fc0178b4143d43f4121eb1946ecebee3 Mon Sep 17 00:00:00 2001
From: Mark Janssen <20283+praseodym@users.noreply.github.com>
Date: Tue, 8 Sep 2026 09:15:33 +0200
Subject: [PATCH 1/2] Update to chacha20 0.10.2

---
 backend/Cargo.lock      | 4 ++--
 backend/fuzz/Cargo.lock | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 39d019b00c..50b68eac77 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -644,9 +644,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
diff --git a/backend/fuzz/Cargo.lock b/backend/fuzz/Cargo.lock
index 0798f89c19..5eab181404 100644
--- a/backend/fuzz/Cargo.lock
+++ b/backend/fuzz/Cargo.lock
@@ -334,9 +334,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",

From e4998ffd668ed8d99983ed6f7459ece77ae46297 Mon Sep 17 00:00:00 2001
From: Mark Janssen <20283+praseodym@users.noreply.github.com>
Date: Tue, 8 Sep 2026 09:16:08 +0200
Subject: [PATCH 2/2] Let cargo-deny also deny yanked dependencies

---
 backend/deny.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/deny.toml b/backend/deny.toml
index 849520f7fa..4d22f5930b 100644
--- a/backend/deny.toml
+++ b/backend/deny.toml
@@ -35,6 +35,7 @@ deny = [
 multiple-versions = "allow"
 
 [advisories]
+yanked = "deny"
 ignore = [
     { id = "RUSTSEC-2024-0320", reason = "yaml-rust is transitively used by Typst, see https://github.com/trishume/syntect/issues/537" },
     { id = "RUSTSEC-2024-0436", reason = "paste is transitively used by Typst (biblatex, https://github.com/typst/biblatex/issues/87) and by utoipa-axum; unmaintained but no vulnerability" },