chore(deps): bump chacha20poly1305 from 0.10.1 to 0.11.0 in /packages

[dependabot]

Bumps chacha20poly1305 from 0.10.1 to 0.11.0.

Commits

• e37a978 chacha20poly1305 v0.11.0 (#853)
• a10b56f aes-gcm v0.11.0 (#852)
• f042e9c aead-stream v0.6.0 (#851)
• b29735a Adopt Trusted Publishing (#854)
• a1fe43f xaes-256-gcm: enable and fix workspace level lints (#850)
• 8cf876f eax: remove toplevel lint attributes (#849)
• 4661ddf ocb3: enable and fix workspace-level lints (#848)
• c821431 eax: enable and fix workspace-level lints (#847)
• d3684bb deoxys: enable and fix workspace-level lints (#846)
• 5e016e2 chacha20poly1305: enable and fix workspace-level lints (#845)
• Additional commits viewable in compare view

[claude]

Dependabot review: chacha20poly1305 0.10.1 → 0.11.0

Change: direct production dependency bump in packages/Cargo.toml (packages/Cargo.lock updated accordingly). Dependabot labels it semver-minor, but this is a pre-1.0 crate (0.10.x → 0.11.x), which the Rust ecosystem treats as a breaking-change boundary, not a routine minor bump. The upstream commit list is mostly workspace-wide lint fixes and a "Trusted Publishing" CI change for the RustCrypto/AEADs repo, with no explicitly called-out API break, but I could not fetch the crate's CHANGELOG.md to confirm (no web access in this session) — worth a human eyeballing the diff before trusting that.

Where it's used: packages/editor-api/src/crypto.rs — this is the AEAD cipher sealing GitHub OAuth tokens stored in a browser cookie (TokenCipher, using ChaCha20Poly1305::{new_from_slice, encrypt, decrypt} plus OsRng/Nonce). This is exactly the kind of security-critical, auth-adjacent dependency called out for extra scrutiny regardless of bump size.

CI status: still in progress at review time (Test, Pre-commit, WASM Build, and several build jobs pending); Security Audit, Validate PR title, and Detect changes have passed so far.

Decision: flagging for human review, not auto-merging — because (a) it's a crypto/auth-critical dependency and (b) CI has not yet fully completed. If CI passes clean and a maintainer confirms no breaking change in the chacha20poly1305/aead traits used here (Aead::encrypt/decrypt, KeyInit::new_from_slice), this looks safe to merge as-is — the existing unit tests in crypto.rs (roundtrip, tamper detection, wrong-key rejection, nonce uniqueness) already exercise the exact surface this bump touches.