jlxq0/carddav-mcp
1
0
Fork 0
Code Issues 6 Pull requests 1 Projects Releases 4 Packages 1 Wiki Activity Actions

chacha20 0.10.1 is yanked, reached via rand 0.10.2 #23

New issue
Open
opened 2026-08-28 01:57:12 +00:00 by jlxq0 · 0 comments
jlxq0 commented 2026-08-28 01:57:12 +00:00
Owner
Copy link

cargo audit reports one allowed warning as of 2026-08-28:

Crate:    chacha20
Version:  0.10.1
Warning:  yanked
chacha20 0.10.1
└── rand 0.10.2
    ├── rmcp 1.8.0
    └── quinn-proto 0.11.16 -> quinn 0.11.11 -> reqwest 0.12.28

No RustSec advisory, so cargo audit exits 0 and CI passes. It appeared between
two audit runs a few hours apart on the same lockfile, which is the pitfall
AGENTS.md already records about rerunning against the finished lockfile.

Two dependency paths, rmcp and reqwest, so clearing it means both bring a
rand that no longer pulls a yanked chacha20. Deliberately not pulled onto
the v0.1.5 outage fix.

Not urgent: a yanked crate is a publishing-side signal, not a vulnerability, and
nothing here is known to be exploitable. Worth clearing on the next routine
dependency pass so a real advisory is not mistaken for this line.

`cargo audit` reports one **allowed** warning as of 2026-08-28: Crate: chacha20 Version: 0.10.1 Warning: yanked chacha20 0.10.1 └── rand 0.10.2 ├── rmcp 1.8.0 └── quinn-proto 0.11.16 -> quinn 0.11.11 -> reqwest 0.12.28 No RustSec advisory, so `cargo audit` exits 0 and CI passes. It appeared between two audit runs a few hours apart on the same lockfile, which is the pitfall `AGENTS.md` already records about rerunning against the finished lockfile. Two dependency paths, `rmcp` and `reqwest`, so clearing it means both bring a `rand` that no longer pulls a yanked `chacha20`. Deliberately not pulled onto the `v0.1.5` outage fix. Not urgent: a yanked crate is a publishing-side signal, not a vulnerability, and nothing here is known to be exploitable. Worth clearing on the next routine dependency pass so a real advisory is not mistaken for this line.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
docs/mergeable-is-async
v0.1.6
v0.1.5
v0.1.4
v0.1.3
v0.1.2
v0.1.1
v0.1.0
Labels
Clear labels   
waiting-on-julian
Blocked on Julian. The ask is in the issue.

No labels
waiting-on-julian
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jlxq0/carddav-mcp#23
No description provided.