Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

sec: drop hpke-rs 0.2 from joule-code's test graph; h2 0.4.20 in smart-byte #450

Closed
dcharlot wants to merge 1 commit from sec/after-443-2026-10-22 into main
pull from: sec/after-443-2026-10-22
merge into: Transaction-Science:main
Conversation 0 Commits 1 Files changed 4 +90 -231

2026-10-22

Transaction Science
sec: drop hpke-rs 0.2 from joule-code's test graph; h2 0.4.20 in smart-byte
Some checks failed
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 2m19s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 4m27s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 15s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 2m42s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 6m45s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 3m22s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
Details
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 4m10s
Details
standards workspaces build + test / macOS energy backends (pull_request) Failing after 4m53s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Failing after 45s
Details 
What #443 left that has a fix on its own line:

- joule-code-collab's MLS keying test moves to openmls 0.9.1, matching
  joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to
  hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072),
  so both leave the lockfile. export_secret now takes the crypto provider.
- smart-byte-rs: h2 0.4.14 -> 0.4.20 (RUSTSEC-2026-0258).

After this, every advisory left in the workspaces needs a major-version
move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub),
hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via
open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via
hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (no fix).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
b56cccede4
2026-10-22 12:58:34 -04:00