Repository navigation
deps: str0m 0.24.1, the desktop lock catches up, RUSTSEC-2026-0387 ignored until a fix exists; the lock re-pinned - #7
Closed
SovereignTechnology wants to merge 2 commits into
Closed
SovereignTechnology wants to merge 2 commits into
SovereignTechnology wants to merge 2 commits into
Conversation
… crypto-bigint 0.5.5 ignored until a fix exists - str0m 0.23.1 → 0.24.1 (and its `is` 0.11.0 → 0.11.1); nfx-node builds unchanged. - crypto-bigint 0.5.5 stays: str0m 0.24.1, str0m-rust-crypto 0.6 and dimpl 0.7 (and 0.8) all sit on ecdsa/p256/p384 → elliptic-curve 0.13, and the fix exists only in 0.7.6. It is ignored in both deny.toml files with the path, the reason and a revisit date (2026-12-31); it is in the WebRTC (DTLS) path only, and no money crate depends on it. - crates/desktop/Cargo.lock had none of the main workspace's advisory fixes: tokio 1.53.3, ctutils 0.4.5, crypto-bigint 0.7.6, negentropy 0.5.2, rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots 1.0.10, webpki-root-certs 1.0.10, and the yanked iroh-blobs 0.103.0 and yoke-derive 0.8.3 replaced by 0.103.1 and 0.8.4. cargo deny passes in both workspaces. The money facts change with the feature unification (tokio resolves windows-sys 0.61.2 again, not 0.52.0): the lock is re-pinned in the next commit.
…windows-sys back to the round-31 pins) From probe r33-str0m-pin (run 40158203300) on fb1cfb6: PINRC=0, 124 facts, 39 guarded files and sections. With str0m 0.24.1 the workspace unifies windows-sys 0.61.2 onto tokio again: windows-sys 0.52.0, windows-targets 0.52.6 and its eight windows_* target crates leave the money closure, and windows-sys 0.61.2 gets back Win32_System_Diagnostics(_Debug). Every windows line now equals the round-31 pins (66f40f9); the money closure differs from them only by tokio 1.53.3.
SovereignTechnology
added a commit
that referenced
this pull request
Oct 25, 2026
…nored until a fix exists; the lock re-pinned (#7) - str0m 0.23.1 → 0.24.1; nfx-node builds unchanged. - crypto-bigint 0.5.5 (str0m > dimpl 0.7 > elliptic-curve 0.13; WebRTC DTLS only, no money crate) has no fixed release on its line: RUSTSEC-2026-0387 is ignored in both deny.toml files with the path, the reason and a revisit date (2026-12-31). - crates/desktop/Cargo.lock brought up to the main workspace's advisory fixes (tokio, ctutils, crypto-bigint 0.7.6, negentropy, rustls, rustls-webpki, webpki-roots, webpki-root-certs) and the yanked iroh-blobs 0.103.0 / yoke-derive 0.8.3 replaced. cargo deny passes in both. - The lock re-pinned from probe r33-str0m-pin (run 40158203300): windows-sys 0.52.0, windows-targets and its eight windows_* crates leave the money closure, windows-sys 0.61.2's features return to the thirty-first round's pins; the closure differs from those pins only by tokio 1.53.3.
Owner
Author
|
Squash-merged as 85b3782 (main, as sovtech). |
SovereignTechnology
added a commit
that referenced
this pull request
Oct 25, 2026
…decisions of 2026-10-25 (#8) - status.md: header at 85b3782; a "Since 2026-10-19" section (the interop: NFX-12 rewritten, ADR 0102, spike S5′ FAIL and the course sovtech chose; the dependency fixes #5 to #7; the publish gate's baseline); the M2 next list records sovtech's decisions; the NFX-12 gap no longer speaks of the Hypercore profile. - m2-plan.md: "Decided (sovtech, 2026-10-25)": one unanswered request at a time for a seeder and a video, the licensed due before the next request after a refusal, and "answered" as served whole and checked, refused or abandoned; the thirty-first round's five requirements accepted; a fault that names one mint added now; reading A and "that much, not merely at most" kept. - docs/README.md: what left with the demo mirror on 2026-10-11 removed (five links that pointed at nothing); where the demo's ADRs are now; the add-only rule marked void.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the last advisory that keeps
checkred onmain(RUSTSEC-2026-0387). It also brings the desktop workspace's lockfile up to date.1. Dependencies (
fb1cfb6)str0m0.23.1 → 0.24.1, the latest release, withis0.11.0 → 0.11.1. nfx-node builds unchanged (cargo check -p nfx-node).crypto-bigint0.5.5 is ignored, with a reason and a revisit date (2026-12-31), incrates/deny.tomlandcrates/desktop/deny.toml.str0m0.24.1,str0m-rust-crypto0.6, anddimpl0.7 and 0.8 all sit onecdsa/p256/p384→elliptic-curve0.13 →crypto-bigint0.5. The fix exists only in 0.7.6.str0m/dimplrelease onelliptic-curve0.14, or switchstr0m's crypto backend.crates/desktop/Cargo.lockhad none of the main workspace's advisory fixes. Now it has:tokio1.53.3,ctutils0.4.5,crypto-bigint0.7.6;negentropy0.5.2;rustls0.23.46,rustls-webpki0.103.16;webpki-rootsandwebpki-root-certs1.0.10;iroh-blobs0.103.0 andyoke-derive0.8.3 replaced by 0.103.1 and 0.8.4.cargo deny checkpasses in both workspaces (advisories, bans, licenses, sources).2. Lock re-pin (
dee647a). Needs sovtech's reviewFrom probe
r33-str0m-pin(run 40158203300) onfb1cfb6: PINRC=0, 124 facts, 39 guarded files and sections.str0m0.24.1, the workspace unifieswindows-sys0.61.2 ontotokioagain. Sowindows-sys0.52.0,windows-targets0.52.6 and its eightwindows_*target crates leave the money closure, which reverses what ci(spike-s5): run only by hand; deps: tokio/ctutils/crypto-bigint advisories, with the lock re-pin #6's re-pin added.windows-sys0.61.2 gets backWin32_System_DiagnosticsandWin32_System_Diagnostics_Debug.windowsline now equals the round-31 pins (66f40f9). The money closure differs from them only bytokio1.53.3.locked.sha256: only thelocked-compiled.txtline changes.Merge
Squash, locally as sovtech, after the locked diff is reviewed and CI is green.