Repository navigation
Update chacha20 to 0.10.2 - #5256
Merged
Merged
Conversation
chacha20 0.10.0 and 0.10.1 are yanked from crates.io, which fails the cargo-deny advisories check. 0.10.2 fixes an SSE4.1 intrinsic used in the SSE2 backend of the RNG and legacy 64-bit-counter variants, so on a CPU without SSE4.1 the affected backends could execute an instruction that is not available. Restate reaches chacha20 through rand, google-cloud-gax and google-cloud-auth. Server CPUs in practice have SSE4.1, so this is a correctness fix rather than an observed fault.
tillrohrmann
approved these changes
Aug 28, 2026
tillrohrmann
left a comment
tillrohrmann
left a comment
Contributor
There was a problem hiding this comment.
Good improvement @pcholakov. LGTM. +1 for merging.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both
chacha200.10.0 and 0.10.1 are yanked from crates.io. 0.10.2, released 2026-08-27, fixes an SSE4.1 intrinsic used in the SSE2 backend of the RNG and legacy 64-bit-counter variants (RustCrypto/stream-ciphers#580), where a CPU without SSE4.1 could be asked to execute an instruction it does not have.Restate reaches
chacha20transitively throughrand→google-cloud-gax→google-cloud-auth→restate-service-client. Server CPUs in practice have SSE4.1, so this is a correctness fix rather than a response to an observed fault.The change is two lines of
Cargo.lock.cargo deny --all-features checknow reportsadvisories ok, bans ok, licenses ok, sources ok, andcargo nextest run --all-featurespasses (1456 tests).Note that the
advisoriesjob iscontinue-on-errorindeps.yml, so this was never blocking a merge — it was making every dependency-touching PR report a red job.