From 37e138cb421532f818517d8a15e0d345b59c8813 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 17:39:17 +0000 Subject: [PATCH] fix(deps): bump event-listener, chacha20 and spin in Cargo.lock cargo audit reports event-listener 5.4.1 as unsound (RUSTSEC-2026-0221, patched in 5.4.2) and chacha20 0.10.1 and spin 0.9.8 as yanked. Update the three to 5.4.2, 0.10.2 and 0.9.9 with cargo update -p; nothing else in the lockfile changes. cargo audit still reports RUSTSEC-2026-0459 (libsqlite3-sys 0.30.1). No released sqlx accepts the patched libsqlite3-sys 0.39 (0.8.6 needs ^0.30.1, 0.9.0 caps below 0.38), so that one needs an owner decision. cargo test --locked: all suites pass. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4 --- Cargo.lock | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f6b7e3b..2a95a13 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -581,9 +581,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -1309,11 +1309,10 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ] @@ -3881,9 +3880,9 @@ dependencies = [ [[package]] name = "spin" -version = "0.9.8" +version = "0.9.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" +checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e" dependencies = [ "lock_api", ]