Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

sec: drop hpke-rs 0.2 from joule-code's test graph; h2 0.4.20 in smart-byte #450

Closed
dcharlot wants to merge 1 commit from sec/after-443-2026-10-22 into main
pull from: sec/after-443-2026-10-22
merge into: Transaction-Science:main
Conversation 0 Commits 1 Files changed 4 +90 -231
dcharlot commented 2026-10-22 13:00:01 -04:00
Owner
Copy link

What #443 left that has a fix on its own version line. Two lockfiles and one test.

  • joule-code-collab moves its MLS keying test to openmls 0.9.1, matching joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072), so both leave joule-code-rs/Cargo.lock. export_secret now takes provider.crypto().
  • smart-byte-rs: h2 0.4.14 → 0.4.20 (RUSTSEC-2026-0258).

Checked on the build host: cargo test -p joule-code-collab (11 unit tests, plus the MLS test cluster_members_derive_a_shared_group_key), and cargo check --all-targets in smart-byte-rs.

After this, cargo audit over all 49 lockfiles leaves only advisories that need a major-version move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub), hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (which has no fix). Two vendored crates' own lockfiles (vendor/wtransport, vendor/libwebrtc) also report advisories, but builds never read them.

Supersedes the rest of #444, whose other changes #443 brought to main by another route.

🤖 Generated with Claude Code

Closed: Superseded by #456, the same two lockfile fixes rebased onto main after #447 (whose joule-moq-room lockfile fix clears this PR's repository-checks and browser failures), plus the jouleclaw quick-xml 0.41 port that the macOS energy leg needed.

What #443 left that has a fix on its own version line. Two lockfiles and one test. - **joule-code-collab** moves its MLS keying test to openmls 0.9.1, matching joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072), so both leave `joule-code-rs/Cargo.lock`. `export_secret` now takes `provider.crypto()`. - **smart-byte-rs**: h2 0.4.14 → 0.4.20 (RUSTSEC-2026-0258). Checked on the build host: `cargo test -p joule-code-collab` (11 unit tests, plus the MLS test `cluster_members_derive_a_shared_group_key`), and `cargo check --all-targets` in smart-byte-rs. After this, `cargo audit` over all 49 lockfiles leaves only advisories that need a major-version move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub), hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (which has no fix). Two vendored crates' own lockfiles (`vendor/wtransport`, `vendor/libwebrtc`) also report advisories, but builds never read them. Supersedes the rest of #444, whose other changes #443 brought to main by another route. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Superseded by #456, the same two lockfile fixes rebased onto main after #447 (whose joule-moq-room lockfile fix clears this PR's repository-checks and browser failures), plus the jouleclaw quick-xml 0.41 port that the macOS energy leg needed.
sec: drop hpke-rs 0.2 from joule-code's test graph; h2 0.4.20 in smart-byte
Some checks failed
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 2m19s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 4m27s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 15s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 2m42s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 6m45s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 3m22s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
Details
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 4m10s
Details
standards workspaces build + test / macOS energy backends (pull_request) Failing after 4m53s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Failing after 45s
Details
b56cccede4 
What #443 left that has a fix on its own line:

- joule-code-collab's MLS keying test moves to openmls 0.9.1, matching
  joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to
  hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072),
  so both leave the lockfile. export_secret now takes the crypto provider.
- smart-byte-rs: h2 0.4.14 -> 0.4.20 (RUSTSEC-2026-0258).

After this, every advisory left in the workspaces needs a major-version
move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub),
hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via
open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via
hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (no fix).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-10-24 19:59:31 -04:00
Some checks failed
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 2m19s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 4m27s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 15s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 2m42s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 6m45s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 3m22s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
Details
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 4m10s
Details
standards workspaces build + test / macOS energy backends (pull_request) Failing after 4m53s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Failing after 45s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!450
No description provided.