Repository navigation
quest(m0): finish the dependency and alternatives audit - #6053
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gstreamer 0.24 keeps the 1.91 MSRV (0.25 needs 1.92) and swaps paste for pastey. Its Bus::timed_pop_filtered never polls with a zero timeout, so the tests' non-blocking pops use pop_filtered instead. The paste advisory stays ignored for its other parents, now named in deny.toml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Takes jemalloc 5.3.1. moq-tokio re-exports tikv_jemallocator, so the major reaches its public API. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The one lazy_static use predates std::sync::LazyLock, stable since Rust 1.80. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
reqwest-middleware is already on 0.5 through the http-cache-reqwest alpha, and uniffi is already on 0.32 with a matching Go generator, so both holds were blocking nothing. uniffi now holds at the next minor, which needs the generator bumped with it. infra/moq-sh has its own Bun lock that `just js audit` checks but Dependabot never updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
unsafe-libopus has not been pushed since 2024-11, and the opus crate no longer goes through audiopus_sys. The pure-Rust build is still the reason to keep it; the Opus backend quest now lists the current alternatives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ipv6Addr::is_unique_local and is_unicast_link_local (stable since 1.84) are the same fc00::/7 and fe80::/10 masks the check spelled out by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hex.toBytes fed each pair to parseInt, which yields NaN (stored as 0) for a non-hex pair, so a mistyped serverCertificateHashes entry pinned a different hash instead of failing. It now validates like @moq/hang's copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@moq/auth already depends on jose, whose base64url encodes the same unpadded alphabet, so the second base64 package goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason lived only in a Dependabot hold that no longer applies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Records the m0 baselines, upstream-owned duplicates, kept dependencies, and open majors in the m1 successor, and plans the three hand-rolled replacements the audit found: H.264 parsing on h264-reader, avcC/hvcC through mp4-atom, and relay metrics through prometheus-client. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
This PR is a draft because three decisions are open (details in the description).
Status:
Once the decisions are settled, this can go through (Written by Claude Opus 5.5) |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 28 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe changes replace the JavaScript authentication package’s base64 helper with jose base64url utilities and add hex parsing validation. They update dependency automation and Rust dependency versions, and revise Rust initialization and IPv6 address checks. The dependency audit moves from m0 to m1, and new m2 documents describe planned dependency and implementation work. Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 55.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 9 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Title check The title clearly identifies the main change: completing the m0 dependency and alternatives audit. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description check The pull request description directly matches the changeset. It explains the dependency audit, dependency updates, utility replacements, validation fixes, documentation changes, new quests, API change… Full details: Description check
-
Explanation
The pull request description directly matches the changeset. It explains the dependency audit, dependency updates, utility replacements, validation fixes, documentation changes, new quests, API changes, and test results.
-
✨ Finishing Touches
-
✨ Simplify code
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
# Conflicts: # quest/m1/README.md
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b597a11ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
key.ts still imported @hexagon/base64 after the dependency left the manifest and lockfile, so a clean install could not resolve it. Encode generated HMAC secrets with jose's base64url and decode through it too, mapping standard base64 onto the url alphabet. The old decoder never threw: unknown characters became zero bytes, so malformed fields passed validation and the standard-base64 fallback was unreachable. Both are now covered by tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 62ef955bf8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
plugin_init, plugin_register_static, and the glib::Enum impls on ConnectionStatus and MediaContainer now carry gstreamer 0.24 / glib 0.21 types, so a crate linking gstmoq must bump its own gstreamer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # quest/m0/README.md
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e24f770862
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The stricter Hex.toBytes accepted "" (and "0x") as a zero-length hash, which the old regex-free version refused. An empty /certificate.sha256 body or serverCertificateHashes value is a config error, so throw. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Merging.
(Written by Claude Opus 5.5) |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The queue dropped this PR as unmergeable once moq-dev/moq#6060 (usage-rs 7) landed.
Checks after the merge: Review gate: the only change since CodeRabbit's clean review of (Written by Claude Opus 5.5) |
The m0 dependency audit finished in #6053; its recurring successor lives in m1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Finishes the m0 run of the dependency and alternatives audit, picking up where moq-dev/moq#5975 left off. It compares direct dependency majors, maintenance and alternatives, who owns each duplicate, and hand-rolled utilities. The quest is then deleted and the m1 run is scheduled, carrying the baselines.
Changes (one commit each)
pastewithpastey. gstreamer-rs'sBus::timed_pop_filterednever polls when given a zero timeout, because it returns before popping once any time has elapsed. That made one sink test fail, so the tests' non-blocking pops now usepop_filtered. Thepasteadvisory ignore indeny.tomlnow names the parents that remain.tikv_jemallocator, soMIGRATE.mdhas an entry.lazy_staticin favor ofstd::sync::LazyLock. The workspace dependency is removed too.reqwest-middlewarehold, since we are already on 0.5 through the http-cache-reqwest alpha. The uniffi hold moves from>=0.32(we are on 0.32) to>=0.33, matching the Go generator pairing.infra/moq-sh's Bun lock is now covered;just js auditalready checked it, but Dependabot never updated it.opus0.4 now uses the maintainedopusic-sys. The Opus backend quest now lists the current candidates.Ipv6Addr::is_unique_local/is_unicast_link_local. Same masks, stable since Rust 1.84.Hex.toBytespassed non-hex pairs toparseInt, which produces NaN and is stored as 0. A mistypedserverCertificateHashesentry therefore pinned the wrong hash instead of failing. It now validates input like @moq/hang's copy, with a regression test.@hexagon/base64withjose'sbase64url, which was already a dependency and uses the same unpadded alphabet. Standard base64 is still accepted, by mapping it onto the url alphabet. The old decoder never threw: it turned unknown characters into zero bytes. So malformed key fields used to pass validation, and the standard-base64 fallback never ran. Both cases now have tests.http-cache-reqwestis a 1.0 prerelease. That reason used to live in the Dependabot hold.quest/m1/audit-deps.md, which records baselines, duplicate owners, the majors still open, and dependencies kept on purpose. Three new m2 quests cover the hand-rolled code a maintained crate replaces:quest/m2/h264-reader.md: moq-mux parses the SPS VUI with h264-reader and uses one bit reader.quest/m2/mp4-atom-config.md: avcC and hvcC go through mp4-atom.quest/m2/relay-prometheus-client.md:/metricsuses prometheus-client.Considered and left alone
quest/m2/usage-rs-7.md. The derive needs a crate-wide rename.tracing-wasmtowasm-tracing: the original repository is gone and the fork has the same defaults. The swap grewmoq_wasm.wasmby 2.9 KB gzipped (888,745 to 891,601 bytes), so I kept the original.tracing-androidtotracing-logcat: the replacement would add rustix 0.38.Public API and wire
jemalloc::tikv_jemallocatoris now 0.7 (breaking,MIGRATE.mdentry added).MIGRATE.mdentry added):plugin_init,plugin_register_static, and theglib::Enumimpls onConnectionStatusandMediaContainernow use gstreamer 0.24 / glib 0.21 types. A crate that linksgstmoqmust bump its own gstreamer to 0.24. Pipelines and the loadable plugin are unaffected.Key.parsenow refuses key fields with non-base64 characters, which it used to accept silently. The signatures are unchanged.Decisions (confirmed)
The maintainer confirmed each decision below, taking the PR's recommendation.
rust-version = "1.92", the same way moq-relay and moq-cli override theirs. It's a plugin, not a library other crates build on. This PR stops at 0.24.wasm-tracingswap.Checks
cargo test -p moq-gst: 144 + 51 tests pass. The one test that failed on 0.24 passes on 0.23, and now passes on 0.24 withpop_filtered.cargo test -p moq-tokio --features jemalloc --lib jemalloc.cargo test -p hang, theconnection::tests in moq-tokio, andbun testin js/net and js/auth (127 tests) all pass.tscpasses for js/auth.cargo deny check advisories bans sources: only the three known zbus-family unmaintained crates remain.just js audit: the same six root findings; the Worker locks are clean.quest checkpasses.just check: on the second run every suite passed, including 9,009 Rust tests and the JS, docs, and demo builds. The only failure was a TOML formatting slip, fixed in the last commit;taplo fmt --check,cargo sort --check, andcargo shearpass now (shear's one warning, a redundant ignore in moq-uring, predates this branch). The first run failedexport::redundant_importers_switch_through_bufferbloat_on_lite_07("stitching export exited") under load average around 50. Rerunning it in isolation passed 4/4 on both this branch and origin/main, after it failed 1 of 3 in an earlier stress run here. It looks like a load-sensitive flake in a test added in moq-dev/moq#5967. Nothing on this branch touches that path.Suggested follow-ups
rust-version = "1.92"(decision 1).moq-dev/web-transport(release PR moq-dev/web-transport#430 is open).web-transport-irohmain already takes kio 0.6, which removes the kio 0.5 duplicate.moq-dev/vaapi(bindgen 0.72, libloading 0.9, thiserror 2) andkixelated/mp4-atom(thiserror 2).timed_pop_filteredbug upstream. That's outside our orgs, so it needs approval.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code