1a514b243c
Four advisories against the zstd crates, published October 2026, failed the repository check on every pull request: - RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks into the next stream on a reused context; - RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec length past its capacity; - RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a legacy frame's streaming decompression fails; - RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts memory on allocation failure. Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs, joule-moq-room and examples/transport-moqt. The one copy left is wasmtime 49's, under wasmtime-internal-cache, which compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm builds its engine from Config::new() with fuel metering only and never configures a cache, so zstd's code does not run in the sandbox. It is allowed in scripts/check-advisories.py at those exact versions, so a direct use regressing to them is not excused. Co-Authored-By: Claude Opus 5.5 <[email protected]>
30 lines
1.2 KiB
TOML
30 lines
1.2 KiB
TOML
[package]
|
|
name = "joule-moq-interop"
|
|
version = "0.1.0"
|
|
description = "An interoperability client for joule-moq: the MOQT interop runner's test cases (TAP 14) at draft -22, -18 or -16 against any relay, and a scenario that carries a WAI track and its receipts through a relay and verifies every object at the subscriber."
|
|
edition = "2024"
|
|
rust-version = "1.97"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/transaction-science/open-standards"
|
|
publish = false
|
|
|
|
[[bin]]
|
|
name = "joule-moq-interop"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
joule-moq = { path = "../joule-moq" }
|
|
joule-moq-relay = { path = "../joule-moq-relay" }
|
|
quinn = "0.11"
|
|
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
|
|
rustls-native-certs = "0.8"
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "time", "net"] }
|
|
bytes = "1"
|
|
ed25519-dalek = { version = "2", features = ["rand_core"] }
|
|
serde_json = "1"
|
|
zstd = "0.14.3"
|
|
hex = "0.4"
|
|
async-trait = "0.1"
|
|
blake3 = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = "0.3"
|