[MarcusKainth]

What this changes, and why

chacha20 0.10.0 and 0.10.1 were yanked from crates.io, and 0.10.1 is what the lockfile pins. deny.toml sets yanked = "deny", so make deny fails on every branch until the lock moves. This bumps it to 0.10.2 and regenerates THIRD-PARTY.md, which carries the version.

The yank is worth stating plainly, because two consecutive releases of a cryptographic primitive being pulled reads worse than it is. The SSE2 backend of the RNG and the legacy 64-bit-counter variants used _mm_extract_epi32, an SSE4.1 intrinsic. A CPU with SSE2 and without SSE4.1 therefore met an illegal instruction rather than a working fallback. 0.10.2 replaces it with _mm_storeu_si128, which is SSE2 (RustCrypto/stream-ciphers#580).

Nothing about ciphertext, key handling or nonce handling changes, on any hardware that ran at all. The fault is portability, and the affected path needs x86_64 hardware predating SSE4.1 to reach. Our own exposure was nil in practice: the aarch64 targets take the NEON backend, and any x86_64 CPU new enough to select the AVX2 backend never entered the SSE2 path.

The crate reaches the shipped tree transitively, through apache-avro and async-nats, both by way of rand 0.10.2. No first-party code calls it.

Invariants

None.

Semver

• Additive — nothing existing changes

A lockfile bump within a patch release of a transitive dependency. No public API moves.

Checks

• make gates
• Conventional Commits, scoped to the crate touched, no AI attribution trailers
• A fragment under changelog.d/, if this reaches a crate somebody upgrading would care about

workspace is an exempt scope and the commit carries Changelog: none. Nothing a user calls behaves differently, so there is nothing for a fragment to say.

Anything else

make deny is the check that matters here, and it goes from failing on the yank to advisories ok, bans ok, licenses ok, sources ok. THIRD-PARTY.md is regenerated with make attribution rather than edited, so it stays a function of Cargo.lock.

#336 is blocked on this and should rebase once it lands.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!