sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410; CI: the avx2 leg on the framework runner #491
2026-10-26
CI: the avx2 leg declares the units the runner's processor has
All checks were successful
wai-quantum CPU vector units / member · vector unit, sve 512-bit (aarch64, emulated) (pull_request) Successful in 10s
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 6m21s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 5m39s
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 2m11s
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Successful in 9m5s
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 8m38s
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Successful in 3m26s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 11m16s
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 2m25s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 13m4s
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 38s
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Successful in 13m19s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 5m25s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 12m20s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 5m16s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m38s
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 10m9s
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 16m47s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 7m31s
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 18m50s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 6m28s
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 18m35s
wai-pack / wai-pack · macos (pull_request) Successful in 3m3s
wai-quantum CPU vector units / member · vector unit absent (macos) (pull_request) Successful in 20s
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m53s
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Successful in 22m11s
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 1m50s
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 10m32s
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Successful in 2m47s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 50m27s
The `linux` label now has two runners: jetson-hub, whose processor has avx2, and framework-128gb-linux (since 2026-10-26), whose processor has avx512 too. The avx2 leg declared avx2 alone, so on the framework the engine's probe found avx2 and avx512, the declaration did not match, and all nine device tests failed (#487's run, task 29781). On silicon the declaration now comes from the kernel's own flags (avx512f in /proc/cpuinfo), never from the probe under test, and the leg checks the avx2 member exactly as before: its 256-bit length, its four bit-exact certificates and its three killed mutants. Co-Authored-By: Claude Opus 5.5 <[email protected]>
sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410
Some checks failed
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
wai-pack / wai-pack · linux (pull_request) Has been cancelled
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
wai-pack / wai-pack · macos (pull_request) Has been cancelled
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Has been cancelled
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been cancelled
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
Four advisories against the zstd crates, published October 2026, failed the repository check on every pull request: - RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks into the next stream on a reused context; - RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec length past its capacity; - RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a legacy frame's streaming decompression fails; - RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts memory on allocation failure. Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs, joule-moq-room and examples/transport-moqt. The one copy left is wasmtime 49's, under wasmtime-internal-cache, which compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm builds its engine from Config::new() with fuel metering only and never configures a cache, so zstd's code does not run in the sandbox. It is allowed in scripts/check-advisories.py at those exact versions, so a direct use regressing to them is not excused. Co-Authored-By: Claude Opus 5.5 <[email protected]>