RUSTSEC-2026-0119 (hickory-proto O(n²) name-compression DoS) and
RUSTSEC-2026-0120 (hickory-net NSEC3 unbounded loop / OOM) both fire
against hickory 0.26.0-beta.4. Fixed upstream in hickory 0.26.1, but
iroh 0.98.2 hard-pins hickory-resolver = "=0.26.0-beta.4" so we
can't bump transitively. Unblock once iroh releases a version that
relaxes the pin.
Bot was generating mostly-wrong upgrade PRs that don't understand the
crypto stack's transitive pinning constraints. We'll bump deps by hand
when there's reason to.
mainline 6.1.2 loosened its digest pin, unblocking hkdf 0.13 (which
needs digest 0.11). sha2 stays on the prerelease '=0.11.0-rc.5' to
match iroh-base's hard-pin; can drop the '=' once iroh-base relaxes.
HKDF-SHA256 KAT (keys_hkdf_kat_passphrase_abc_app_test_v1_k3) passes
byte-for-byte, so on-wire/on-disk key material is unchanged.
Updates the pinning rationale comment in Cargo.toml accordingly.
Passphrase-based peer rendezvous for iroh-gossip swarms over the public
Mainline DHT. Two nodes that share a passphrase + application salt find
each other and join the same gossip topic — no bootstrap server, no
prior knowledge of peer addresses.
The algorithm is a clock-free variant of HyParView-style partition
healing on BEP 44 mutable items, with K-sharded slots, logical aging
with random-tie eviction, vouching of up to V neighbors at age 1, and
a two-layer AEAD record envelope. Full spec in PROTOCOL.md.
Ships with:
* 119 tests (unit / property / integration / doctest) all green
* 100% mutation-testing catch rate (cargo-mutants)
* cargo-fuzz harnesses for the parse surface
* Kani proofs of no-UB / no-panic on crypto::epoch_of and
wire::decode_entries across their full symbolic input spaces
* Stateright distributed-system model: safety invariants S1 + S2
proved exhaustively for N ≤ 6, K ≤ 3; liveness witness under weak
fairness
* Miri green on the synchronous modules
* cargo-deny + cargo-audit clean
* criterion benches
* Full-matrix CI (Linux + macOS + Windows × stable + MSRV 1.93.0)
* Dedicated nightly lane for Miri / mutation / fuzz / Kani / Stateright
Pinned iroh 0.98.x. License MIT.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
swaits
