Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

joule-moq-room: its lockfile follows wai-quantum 0.6.14 (repository checks red on main since #427) #447

Merged
dcharlot merged 1 commit from sec/rust-advisories-2026-10 into main 2026-10-22 14:33:50 -04:00
Conversation 0 Commits 1 Files changed 1 +1 -1
dcharlot commented 2026-10-22 12:40:04 -04:00
Owner
Copy link

joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock still records wai-quantum 0.6.12. #427 moved wai-quantum to 0.6.14, and the room path-depends on it.

The lockfile step of repository checks has failed on main since that merge, on aa61ab3b and 41c5bafba. Because the step checks the whole tree, it fails on every open pull request too. That includes the security update in #444 (patched rustls, rustls-webpki, webpki roots and quinn-proto for the relay and the room).

This is the lockfile alone, regenerated with the command the check prints:

(cd joule-code/joule-code-rs/crates/joule-moq-room && cargo update --workspace)

One line changes, wai-quantum 0.6.12 -> 0.6.14. No registry crate moves.

Tested, on the build host

  • scripts/check-lockfiles.sh: 47 lockfiles, all current. On main it reports this one as STALE.
  • joule-moq-room: cargo check --locked --all-targets and cargo test --locked pass (11 + 4 tests).
  • Run locally, all pass: check-tests-in-ci, workflow concurrency, spec references, WAI section references, no-vanity-metrics, comparative prose and orphan sources.

Note on #444

#444 merges into current main without conflicts. With both merged, the relay's and the room's locks audit clean against the RustSec database as of 2026-10-22, except libcrux-kem 0.0.9 (RUSTSEC-2026-0330/0331). That one has no compatible fix yet: openmls_rust_crypto 0.6.0 pins hpke-rs 0.7. This PR does not overlap #444's changes.

🤖 Generated with Claude Code

`joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock` still records wai-quantum 0.6.12. #427 moved wai-quantum to 0.6.14, and the room path-depends on it. The **lockfile step of repository checks has failed on main** since that merge, on aa61ab3b and 41c5bafba. Because the step checks the whole tree, it fails on every open pull request too. That includes the security update in #444 (patched rustls, rustls-webpki, webpki roots and quinn-proto for the relay and the room). This is the lockfile alone, regenerated with the command the check prints: ``` (cd joule-code/joule-code-rs/crates/joule-moq-room && cargo update --workspace) ``` One line changes, `wai-quantum 0.6.12 -> 0.6.14`. No registry crate moves. ## Tested, on the build host - `scripts/check-lockfiles.sh`: 47 lockfiles, all current. On main it reports this one as STALE. - joule-moq-room: `cargo check --locked --all-targets` and `cargo test --locked` pass (11 + 4 tests). - Run locally, all pass: check-tests-in-ci, workflow concurrency, spec references, WAI section references, no-vanity-metrics, comparative prose and orphan sources. ## Note on #444 #444 merges into current main without conflicts. With both merged, the relay's and the room's locks audit clean against the RustSec database as of 2026-10-22, except libcrux-kem 0.0.9 (RUSTSEC-2026-0330/0331). That one has no compatible fix yet: openmls_rust_crypto 0.6.0 pins hpke-rs 0.7. This PR does not overlap #444's changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
joule-moq-room: its lockfile follows wai-quantum 0.6.14
All checks were successful
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 6s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 5s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 2m43s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 4m0s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 4m16s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 22s
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m42s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m33s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m24s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 10m17s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 8m6s
Details
b5bf133d67 
#427 moved wai-quantum to 0.6.14, and joule-moq-room path-depends on it,
but the room's own Cargo.lock still records 0.6.12. The lockfile step of
repository checks has failed on main since then (aa61ab3b, 41c5bafba),
and so on every pull request, including the security update in #444.

Regenerated with the command the check prints:
  (cd joule-code/joule-code-rs/crates/joule-moq-room && cargo update --workspace)
One line changes. No registry crate moves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!447
No description provided.