fix(deps): chacha20 0.10.2 — 0.10.1 was yanked - #27
Merged
Merged
Conversation
Lockfile-only: `cargo update -p chacha20`. No manifest change; the transitive range already admits 0.10.2.
piekstra-dev
approved these changes
Sep 15, 2026
piekstra-dev
left a comment
Collaborator
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: 15a2d38ac760
Profile: reviewer - Posting as: piekstra-dev
Summary
| Reviewer | Findings |
|---|---|
| rust:implementation-tests | 0 |
| security:code-auditor | 0 |
Reviewer Coverage
rust:implementation-tests— complete (broad); skipped: none; constraints: Cargo.lock is a generated dependency-version bump (chacha20 0.10.1 -> 0.10.2) with no source or test code changes, so this agent's checks (error handling, resource/lifetime handling, test coverage, etc.) do not apply.security:code-auditor— complete (broad); skipped: none; constraints: none
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 36s | ~$0.43 (est.) | claude-sonnet-5 | cr 0.10.289
| Field | Value |
|---|---|
| Model | claude-sonnet-5 |
| Reviewers | rust:implementation-tests, security:code-auditor |
| Engine | claude_cli · claude-sonnet-5 |
| Reviewed by | cr · piekstra-dev |
| Duration | 36s wall · 44s compute |
| Cost | ~$0.43 (est.) |
| Tokens | 22 in / 2.7k out |
Per-workstream usage
orchestrator-selection— claude-sonnet-5- In: 6
- Out: 892
- Cache read: 73.6k
- Cache create: 23.2k
- Cost: ~$0.12 (est.)
- Duration: 14s
rust:implementation-tests— claude-sonnet-5- In: 6
- Out: 771
- Cache read: 83.3k
- Cache create: 22.0k
- Cost: ~$0.12 (est.)
- Duration: 11s
security:code-auditor— claude-sonnet-5- In: 6
- Out: 647
- Cache read: 84.3k
- Cache create: 22.8k
- Cost: ~$0.12 (est.)
- Duration: 11s
orchestrator-rollup— claude-sonnet-5- In: 4
- Out: 360
- Cache read: 55.5k
- Cache create: 11.5k
- Cost: ~$0.07 (est.)
- Duration: 7s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lockfile-only bump:
cargo update -p chacha20moveschacha200.10.1 -> 0.10.2. No manifest change; the transitive range already admits 0.10.2.Why
chacha20 0.10.1was yanked on 2026-08-27. This repo'sdeny.tomlsetsyanked = "deny", so cargo-deny (theaudit / deny / secretsjob) fails on any PR until the lock moves. Same fix as the rest of the family sweep, applied pre-emptively here.Gate
Mirrored locally before merge: repo gate (
make verifyor the CI-equivalent) pluscargo deny check; CI must also be green.