Skip to content

fix(deps): take chacha20 0.10.2, since 0.10.0 and 0.10.1 were yanked - #1248

Merged
coderdan merged 1 commit into
nextfrom
fix/chacha20-0.10.2
Oct 18, 2026
Merged

fix(deps): take chacha20 0.10.2, since 0.10.0 and 0.10.1 were yanked#1248
coderdan merged 1 commit into
nextfrom
fix/chacha20-0.10.2

Conversation

@coderdan

@coderdan coderdan commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

Summary

Moves every lockfile in this repository from chacha20 0.10.0 to 0.10.2. chacha20 is the stream cipher behind rand's default random number generator and behind vitaminc-random.

The RustCrypto maintainers yanked 0.10.0 and 0.10.1 (marked them so new builds no longer select them) because of undefined behaviour. On an x86 CPU without AVX2, the random number generator falls back to code that uses an SSE4.1 instruction without first checking the CPU supports it. The effect depends on the CPU:

  • No SSE4.1 (hardware from before 2008, or a virtual machine on QEMU's default qemu64 CPU model): the process crashes with an illegal-instruction error.
  • Every other CPU: the code runs and gives the right answer. The random numbers were never wrong, so no key or nonce was weakened.

The native modules we ship to npm (@cipherstash/protect-ffi and @cipherstash/auth) are built from these lockfiles, so this PR adds a patch changeset for both.

Changes

  • Lockfiles: the root, packages/eql, languages/typescript/packages/protect-ffi, and the three fuzz workspaces (stack-auth, stack-encrypt, stack-kms). Only chacha20's version and checksum change in each.
  • Changeset: a patch for @cipherstash/protect-ffi and @cipherstash/auth.
  • Not changed: the two Go guest lockfiles were already on 0.10.2.

Verification

  • cargo tree --locked resolves in all six workspaces.
  • cargo check --locked --workspace --all-features (root): builds.
  • cargo nextest run --locked -p stack-encrypt -p stack-kms --all-features: 670 passed.
  • cargo tree -i chacha20 confirms stack-auth-node, stack-auth-wasm and protect-ffi all depend on it.

Related

https://claude.ai/code/session_01BZhkvKLpNtKuzj3HCfMXoL

@coderdan
fix(deps): take chacha20 0.10.2, since 0.10.0 and 0.10.1 were yanked
2c53bea 
chacha20 0.10.0 and 0.10.1 were yanked upstream for undefined behaviour
(RustCrypto/stream-ciphers#579, fixed in RustCrypto/stream-ciphers#580). On an x86 CPU without
AVX2 the crate falls back to its SSE2 backend, and that backend's RNG
path calls `_mm_extract_epi32`, an SSE4.1 intrinsic, without checking
for SSE4.1. A CPU with SSE4.1 runs it and gets the right answer; one
without it (pre-2008 hardware, QEMU's default qemu64 model) dies with
SIGILL. The keystream and the random numbers were never wrong.

We reach it through `rand` 0.10, whose ThreadRng is ChaCha12, and
through vitaminc-random. Both are in the native binaries
@cipherstash/protect-ffi and @cipherstash/auth ship, hence the patch
changeset. The fuzz workspaces move too, so no lockfile here still
holds a yanked chacha20. The Go guests were already on 0.10.2.

Only chacha20's version and checksum change in each lockfile.

Claude-Session: https://claude.ai/code/session_01BZhkvKLpNtKuzj3HCfMXoL
@changeset-bot

changeset-bot Bot commented Oct 18, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2c53bea

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 26 packages
Name Type
@cipherstash/protect-ffi Patch
@cipherstash/auth Patch
stash Patch
@cipherstash/stack-drizzle Patch
@cipherstash/stack-supabase Patch
@cipherstash/stack Patch
@cipherstash/ffi-integration-tests Patch
@cipherstash/wizard Patch
@cipherstash/bench Patch
@cipherstash/stack-prisma Patch
@cipherstash/test-kit Patch
@cipherstash/basic-example Patch
@cipherstash/prisma-example Patch
@cipherstash/e2e Patch
@cipherstash/protect-ffi-darwin-arm64 Patch
@cipherstash/protect-ffi-darwin-x64 Patch
@cipherstash/protect-ffi-linux-arm64-gnu Patch
@cipherstash/protect-ffi-linux-x64-gnu Patch
@cipherstash/protect-ffi-linux-x64-musl Patch
@cipherstash/protect-ffi-win32-x64-msvc Patch
@cipherstash/auth-darwin-arm64 Patch
@cipherstash/auth-darwin-x64 Patch
@cipherstash/auth-linux-arm64-gnu Patch
@cipherstash/auth-linux-x64-gnu Patch
@cipherstash/auth-linux-x64-musl Patch
@cipherstash/auth-win32-x64-msvc Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c31c0b46-b99d-46bd-bbf9-7f527f04f95c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

@coderdan
coderdan changed the base branch from main to next October 18, 2026 06:17
@coderdan
coderdan marked this pull request as ready for review October 18, 2026 06:19
@coderdan
coderdan requested a review from a team as a code owner October 18, 2026 06:19
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-18T06:21:44.971384Z 2c53bea Draft marked ready
🔒 Security Review ✅ Completed 2026-10-18T06:23:08.261293Z 2c53bea Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cipherstash-agent
cipherstash-agent reviewed Oct 18, 2026
View reviewed changes

@cipherstash-agent cipherstash-agent left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review attestation: automated review (/code-review medium + /cross-check-review-findings) of head 2c53bea.

Findings: none. No critical or blocking issues.

Checked:

  • All 7 lockfile diffs (root, packages/eql, protect-ffi, 3 fuzz workspaces) change only chacha20 0.10.0 → 0.10.2 and its checksum. Dependency lists are untouched.
  • The checksum 65c35e4b…1b06 matches the SHA-256 of chacha20-0.10.2.crate downloaded from static.crates.io. crates.io reports 0.10.2 as not yanked.
  • The changeset covers @cipherstash/protect-ffi and @cipherstash/auth, the packages whose native binaries are built from these lockfiles. Patch bump is appropriate; there is no API change.
  • No skills or meta-file updates are needed.

Not run: builds or tests (the PR description reports cargo tree --locked and nextest results).

Generated by Claude Code

@coderdan
coderdan merged commit 3cba0f6 into next Oct 18, 2026
61 checks passed
@coderdan
coderdan deleted the fix/chacha20-0.10.2 branch October 18, 2026 06:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cipherstash-agent cipherstash-agent cipherstash-agent left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@coderdan @cipherstash-agent