From 75ae01141e4750ee8534a6a8bef77494e6df085f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 09:36:53 +0000
Subject: [PATCH] chore(deps): Bump chacha20 from 0.9.1 to 0.10.1 in /native

Bumps [chacha20](https://github.com/RustCrypto/stream-ciphers) from 0.9.1 to 0.10.1.
- [Commits](https://github.com/RustCrypto/stream-ciphers/compare/chacha20-v0.9.1...chacha20-v0.10.1)

---
updated-dependencies:
- dependency-name: chacha20
  dependency-version: 0.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 native/Cargo.lock          | 29 +++++++++++++++++++++++++----
 native/ol_onion/Cargo.toml |  2 +-
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/native/Cargo.lock b/native/Cargo.lock
index bd1424b9..6f04dfb9 100644
--- a/native/Cargo.lock
+++ b/native/Cargo.lock
@@ -267,7 +267,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
@@ -278,6 +278,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
+ "cipher 0.5.2",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
@@ -290,7 +291,7 @@ checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
  "aead",
  "chacha20 0.9.1",
- "cipher",
+ "cipher 0.4.4",
  "poly1305",
  "zeroize",
 ]
@@ -329,10 +330,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout",
+ "inout 0.1.4",
  "zeroize",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
 [[package]]
 name = "clap"
 version = "4.6.4"
@@ -938,6 +950,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array 0.4.13",
+]
+
 [[package]]
 name = "is-terminal"
 version = "0.4.17"
@@ -1539,7 +1560,7 @@ version = "0.22.1"
 dependencies = [
  "aead",
  "blake3",
- "chacha20 0.9.1",
+ "chacha20 0.10.1",
  "chacha20poly1305",
  "criterion",
  "curve25519-dalek",
diff --git a/native/ol_onion/Cargo.toml b/native/ol_onion/Cargo.toml
index f2cc2d51..a3436a65 100644
--- a/native/ol_onion/Cargo.toml
+++ b/native/ol_onion/Cargo.toml
@@ -15,7 +15,7 @@ thiserror        = { workspace = true }
 blake3           = { workspace = true }
 x25519-dalek     = { version = "2.0", features = ["static_secrets"] }
 chacha20poly1305 = { workspace = true }
-chacha20         = "0.9"
+chacha20         = "0.10"
 # Sphinx point-blinding needs Edwards/Ristretto-form scalar mult.
 curve25519-dalek = { version = "4", default-features = false, features = ["alloc", "precomputed-tables", "zeroize"] }
 # T1.2 PQ-hybrid blinding: ML-KEM-768 mixed into the first hop's