Repository navigation
Release integrity: v1.6.1 truth pass and dependency audit gates - #2
Merged
Merged
Conversation
- apps/zk-agent: replace remaining curve25519_dalek_ng refs with curve25519_dalek 4.1.3; handle from_slice Result cleanly (fail closed) - apps/zk-agent: upgrade warp 0.3->0.4 (hyper 1.x) to clear RUSTSEC-2026-0258 h2 DoS; drop unused reqwest dev-dep. cargo audit now clean in both crates - packages/age-zk: add getrandom js feature for wasm32-unknown-unknown so the bulletproofs5/rand0.8 stack compiles to wasm (was: getrandom 0.2 had no wasm backend) - regenerate packages/age-zk/Cargo.lock and apps/zk-agent/Cargo.lock - regenerate committed WASM pkg/ artifacts; re-add type:module - remove temporary refresh-rust-lockfiles helper workflow (locks now committed)
…lldown build
The file contained a stray 0x95 byte (corrupted dash) in 'Mode: {mode} <byte> {status}'.
Vite 5/rollup tolerated it; the vite 8/rolldown production build (used in Linux CI
after the lockfile regeneration) rejects non-UTF-8 source as UNLOADABLE_DEPENDENCY.
Replace with a clean em-dash. Wallet-PWA and verifier-demo now build under rolldown.
…d boot docker-compose up -d is the documented deployment path (ROUTE_TEST_MATRIX), so broken container images were a release blocker. All three images now build and boot cleanly with health checks green: - registry: regenerate the stale per-app pnpm-lock.yaml (was pinned to fastify ^9.0.0 vs manifest ^10.1.3 -> ERR_PNPM_OUTDATED_LOCKFILE). Image now boots, serves :3000, real routes respond. - wallet-pwa: was running a Vite dev server in production. Rewrite to build the static bundle and serve it via nginx on :80 (compose maps 5173:80). Serves <title>Shielded ID Wallet</title> and the ZK WASM asset. - verifier-demo: was running a Vite dev server in production. Rewrite to build both the SDK and frontend, serve the built bundle via `vite preview` and the tsx callback backend on :5050. Workspace symlinks preserved in the runner. Frontend :5174 and backend :5050 both boot. Verified end-to-end: full `docker compose up -d --build` boots all three containers and every documented port returns HTTP 200 (registry :3000, wallet :5173, verifier :5174/:5050). No Vite dev servers in production images.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This patch closes the remaining v1.6.0 release-integrity gaps without changing the hardened cryptographic protocol construction.
Changes:
pnpm audit --audit-level=highand RustSeccargo-auditCI gates;masterSHA that passes a fresh post-merge push run.Acceptance:
master;v1.6.1at that exact greenmasterSHA.