Pin memchr in our release dependency list due to `core2` using it