sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410; CI: the avx2 leg on the framework runner #492
2026-10-26
CI: the avx2 leg declares the units the runner's processor has
All checks were successful
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Successful in 3m23s
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Successful in 13m10s
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 2m23s
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 1m42s
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Successful in 9m4s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 6m15s
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 7m26s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 11m18s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m47s
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m50s
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 15m26s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m32s
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 26s
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 53s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 11m33s
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 8m52s
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 27s
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 17m51s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 7m24s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m30s
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 16m37s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 5m56s
wai-quantum CPU vector units / member · vector unit absent (macos) (pull_request) Successful in 14s
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Successful in 19m39s
wai-pack / wai-pack · macos (pull_request) Successful in 2m41s
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m28s
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 10m1s
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 1m44s
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Successful in 2m34s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 46m45s
The `linux` label now has two runners: jetson-hub, whose processor has avx2, and framework-128gb-linux (since 2026-10-26), whose processor has avx512 too. The avx2 leg declared avx2 alone, so on the framework the engine's probe found avx2 and avx512, the declaration did not match, and all nine device tests failed (#487's run, task 29781). On silicon the declaration now comes from the kernel's own flags (avx512f in /proc/cpuinfo), never from the probe under test, and the leg checks the avx2 member exactly as before: its 256-bit length, its four bit-exact certificates and its three killed mutants. Co-Authored-By: Claude Opus 5.5 <[email protected]>
sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410
Four advisories against the zstd crates, published October 2026, failed the repository check on every pull request: - RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks into the next stream on a reused context; - RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec length past its capacity; - RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a legacy frame's streaming decompression fails; - RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts memory on allocation failure. Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs, joule-moq-room and examples/transport-moqt. The one copy left is wasmtime 49's, under wasmtime-internal-cache, which compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm builds its engine from Config::new() with fuel metering only and never configures a cache, so zstd's code does not run in the sandbox. It is allowed in scripts/check-advisories.py at those exact versions, so a direct use regressing to them is not excused. Co-Authored-By: Claude Opus 5.5 <[email protected]>