Repository navigation
fix(deps): bump yanked chacha20 0.10.1 -> 0.10.2 - #140
Merged
Merged
Conversation
chacha20 0.10.1 is yanked on crates.io. Upstream 0.10.2 fixes use of an SSE4.1 intrinsic in the SSE2 backend of the RNG and legacy variants (RustCrypto stream-ciphers #580), which is a fault on CPUs without SSE4.1. bobbin pulls it only transitively, via rand 0.10.2 (lopdf/pdf-extract, twox-hash/lance/arrow). Cargo.lock only: chacha20's version and checksum; no other crate moves. The new checksum equals crates.io's. cargo check --locked --features knowledge passes and the yanked warning is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UszAbpDcC8doX5bQ9K6WkB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chacha20 0.10.1is yanked, and--lockedrelease builds (#139) were carrying it.Why it was yanked. Upstream 0.10.2 fixes the SSE2 backend of the RNG and legacy variants, which used an SSE4.1 intrinsic (RustCrypto/stream-ciphers#580). That is a fault on CPUs without SSE4.1.
Where it comes from. Transitive only, via
rand 0.10.2:lopdf→pdf-extracttwox-hash→ lance / arrowThe change
Cargo.lockonly: chacha20's version and checksum. No other crate moves.cargo check --locked --features knowledgepasses, and the yanked warning is gone.aegis-vw9iek.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UszAbpDcC8doX5bQ9K6WkB