release 0.2.0: iroh 1.0-rc.0 / gossip 0.99

RUSTSEC-2026-0119 (hickory-proto O(n²) name-compression DoS) and
RUSTSEC-2026-0120 (hickory-net NSEC3 unbounded loop / OOM) both fire
against hickory 0.26.0-beta.4. Fixed upstream in hickory 0.26.1, but
iroh 0.98.2 hard-pins hickory-resolver = "=0.26.0-beta.4" so we
can't bump transitively. Unblock once iroh releases a version that
relaxes the pin.

.github/dependabot.yml

@@ -1,21 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: cargo
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    groups:
-      patch-updates:
-        update-types: [patch]
-
-  - package-ecosystem: cargo
-    directory: /fuzz
-    schedule:
-      interval: monthly
-    open-pull-requests-limit: 2
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
         toolchain: [stable, "1.93.0"] # MSRV
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.toolchain }}
@@ -48,7 +48,7 @@ jobs:
     name: cargo deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-deny
@@ -58,11 +58,13 @@ jobs:
     name: cargo audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-audit
-      - run: cargo audit
+      # cargo-audit doesn't read deny.toml, so mirror its ignore list here.
+      # See deny.toml [advisories] for rationale on each ID.
+      - run: cargo audit --ignore RUSTSEC-2026-0119 --ignore RUSTSEC-2026-0120
 
   # ── Public-API semver compliance (PR only) ────────────────────────
   semver:
@@ -70,7 +72,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
@@ -84,7 +86,7 @@ jobs:
     name: coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: llvm-tools-preview
@@ -94,7 +96,7 @@ jobs:
           tool: cargo-llvm-cov,cargo-nextest
       - name: lcov
         run: cargo llvm-cov nextest --all-features --lcov --output-path lcov.info
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         with:
           files: lcov.info
           fail_ci_if_error: false
@@ -106,7 +108,7 @@ jobs:
     name: examples build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --example quickstart
@@ -117,7 +119,7 @@ jobs:
     name: stateright BFS N=3 K=2
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --test stateright_model --release --all-features -- bfs_n3_k2 --ignored

.github/workflows/nightly.yml

@@ -17,7 +17,7 @@ jobs:
     name: miri (sync modules)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@nightly
         with:
           components: miri
@@ -37,7 +37,7 @@ jobs:
       matrix:
         shard: [0, 1, 2, 3]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
@@ -57,7 +57,7 @@ jobs:
           - fuzz_crypto_open
           - fuzz_merge
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@nightly
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
@@ -69,7 +69,7 @@ jobs:
     name: kani
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: model-checking/kani-github-action@v1
         with:
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --test stateright_model --release --all-features -- random_large --ignored
@@ -89,7 +89,7 @@ jobs:
     name: criterion benches
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo bench --all-features

.gitignore

@@ -32,6 +32,9 @@ lcov.info
 # jj (Jujutsu) workspace
 .jj/
 
+# Claude Code session state
+.claude/
+
 # Direnv
 .envrc
 .direnv/

CHANGELOG.md

@@ -6,6 +6,32 @@ format is based on [Keep a Changelog], and this project adheres to
 
 ## [Unreleased]
 
+## [0.2.0] — 2026-05-11
+
+### Changed
+
+- **Breaking:** bumped `iroh` to `=1.0.0-rc.0` and `iroh-gossip` to `0.99`.
+  Public API exposes iroh types (`Endpoint`, `SecretKey`, `PublicKey`,
+  `iroh_gossip::api::*`), so consumers must move to the iroh 1.0-rc.0
+  ecosystem in lockstep.
+- **Breaking:** bumped `ed25519-dalek` to `=3.0.0-pre.7` to match
+  iroh-base 1.0.0-rc.0. The version is pinned with `=` because iroh-base
+  itself hard-pins the pre-release; drop the `=` when iroh-base relaxes.
+- Loosened the `sha2` pin from `=0.11.0-rc.5` to `^0.11`. iroh-base
+  1.0.0-rc.0 no longer hard-pins the rc, so we follow the same
+  caret-range convention as the rest of the crypto stack.
+- Bumped transitive crypto deps via `cargo update`: `mainline` 6.0.1 →
+  6.1.2, plus the usual sweep of tokio/hyper/rustls patches.
+
+### Notes
+
+- No source changes were required: the iroh/gossip APIs we touch
+  (`Endpoint::builder`, `endpoint::presets::N0`, `SecretKey::generate`,
+  `PublicKey`, `iroh_gossip::api::{Event, GossipSender}`) survived the
+  bump verbatim.
+- All 96 lib tests, property tests, and integration tests pass against
+  the new stack.
+
 ## [0.1.0] — 2026-04-22
 
 First public release. Passphrase-based peer rendezvous for iroh-gossip

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "iroh-gossip-rendezvous"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.93.0"
 authors = ["Stephen Waits <steve@waits.net>"]
@@ -17,6 +17,7 @@ exclude = [
     ".github/",
     ".cargo/",
     ".config/",
+    ".claude/",
     "deny.toml",
     "justfile",
     "CODEOWNERS",
@@ -87,23 +88,22 @@ name = "keys"
 harness = false
 
 [dependencies]
-iroh = "0.98"
-iroh-gossip = "0.98"
+iroh = "=1.0.0-rc.0"
+iroh-gossip = "0.99"
 mainline = { version = "6", features = ["async"] }
 # Crypto stack — several deps are pinned by transitive constraints. See
 # `UPGRADING.md` or the release notes on any bump.
 #
-# * `ed25519-dalek = 2`: 3.0 is pre-release (`3.0.0-pre.6`). Move to 3 once stable.
+# * `ed25519-dalek = "=3.0.0-pre.7"`: matched to iroh 1.0.0-rc.0 / iroh-base 1.0.0-rc.0.
 # * `chacha20poly1305 = 0.10`: 0.11 is `rc`. Same story.
-# * `sha2 = 0.10` / `hkdf = 0.12`: **pinned by `mainline`**, which in turn
-#   hard-pins `digest = "=0.11.0-rc.9"`. Bumping sha2 or hkdf requires either
-#   a mainline release that relaxes the pin, or a coordinated fork. Attempting
-#   `sha2 = 0.11` / `hkdf = 0.13` fails cargo-outdated and `cargo check`.
+# * `hkdf = 0.13`: works as of mainline 6.1.2, which loosened its `digest`
+#   pin to `0.11`. The HKDF-SHA256 KAT covers compatibility — bump only if
+#   it still passes byte-for-byte.
 # * `rand = 0.9`: 0.10 is coordinated with iroh + bridge; hold until iroh bumps.
-ed25519-dalek = "2"
+ed25519-dalek = "=3.0.0-pre.7"
 chacha20poly1305 = "0.10"
-hkdf = "0.12"
-sha2 = "0.10"
+hkdf = "0.13"
+sha2 = "0.11"
 blake3 = "1"
 zeroize = { version = "1", features = ["derive"] }
 rand = "0.9"

deny.toml

@@ -15,15 +15,23 @@ all-features = true
 [advisories]
 version = 2
 yanked = "deny"
-# Allow transitive "unmaintained" advisories that come via iroh's dep graph
-# and can't be fixed downstream. Re-evaluate on each iroh bump.
-# Note: cargo-deny and cargo-audit disagree on which advisories currently fire;
-# cargo-audit reports atomic-polyfill, cargo-deny's db may not. We list it here
-# for cargo-audit's benefit via deny.toml being the canonical source.
+# Allow transitive advisories that come via iroh's dep graph and can't be
+# fixed downstream. Re-evaluate on each iroh bump.
+# Note: cargo-audit does NOT read this file — mirror any vulnerability-class
+# entries below into the `cargo audit --ignore …` flag list in ci.yml.
 ignore = [
     # paste — no longer maintained. Pulled in via iroh → portmapper → netwatch
     # → netlink-packet-core. No direct dep; stuck until iroh migrates.
     "RUSTSEC-2024-0436",
+    # hickory-proto 0.26.0-beta.4 — CPU exhaustion via O(n²) name compression
+    # during message encoding. Transitive via iroh → hickory-resolver
+    # (=0.26.0-beta.4, hard-pinned). Fixed in hickory 0.26.1; unblock when
+    # iroh releases a version that bumps the pin.
+    "RUSTSEC-2026-0119",
+    # hickory-net 0.26.0-beta.4 — NSEC3 closest-encloser proof enters an
+    # unbounded loop on cross-zone responses (OOM in release builds; panic
+    # in debug). Same transitive path and same iroh pin as RUSTSEC-2026-0119.
+    "RUSTSEC-2026-0120",
 ]
 
 # ── Licenses ───────────────────────────────────────────────────────