Skip to content

chore(quest): complete the recorded pre-cut security audit #7611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moq-bot merged 3 commits into from
Nov 2, 2026
Merged

chore(quest): complete the recorded pre-cut security audit #7611

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
02b5815
chore(quest): claim quest/m1/security-audit/README.md
kixelated Nov 2, 2026
5ed7461
chore(quest): complete the recorded pre-cut security audit
kixelated Nov 2, 2026
7d6559c
quest land: merge tested base
Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions quest/m0/security-audit/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ backports to `release`.
An external AI audit at
[651c30fee9](https://github.com/moq-dev/moq/commit/651c30fee9) reported 8
Medium and 28 Low findings. Every claim was re-checked against source before
planning; the pre-cut remainder is the
[m1 epic](/quest/m1/security-audit/README.md), whose README records what was
dropped and why.
planning. The completed pre-cut epic's
[triage record](https://github.com/moq-dev/moq/blob/e3bd4b288e01f0c2e7fbe1e6a362d6f3d58057c8/quest/m1/security-audit/README.md)
preserves the maintainer's dropped findings and external owners.

Decided 2026-10-27 (maintainer): these two land in m0 because `release`
carries the same bugs. Each quest owns its own backport PR rather than a
Expand Down
1 change: 0 additions & 1 deletion quest/m1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,6 @@ per-frame CPU growth since #5926.
- [Address groups by timestamp](/quest/m1/time-addressing/README.md) - group start timestamps replace sequence numbers in the moq-net API and lite-07 wire, while old subscribers, old publishers, and published JS clients keep working
- [Pre-cut audit findings](/quest/m1/cut-audit/README.md) - fix the crashes, hostile-input costs, and correctness bugs the 2026-10-24 audit of main found
- [Vendored code has every upstream fix it needs](/quest/m1/vendor-sync/README.md) - quinn, libv4l-rs, nvidia-video-codec-sdk, rust-media-libs, cros-codecs, and UniFFI generator fixes are ported or planned, once per release cycle
- [Security audit findings](/quest/m1/security-audit/README.md) - fix the verified relay, importer, moq-c, browser, and CI findings of the 2026-10-27 external security audit
- [Delete the tests that don't earn their cost](/quest/m1/prune-tests.md) - an off-cycle test cost sweep deletes tests whose cost outweighs their signal and makes the rest cheaper
- [Remove the dependencies that don't earn their weight](/quest/m1/prune-deps.md) - Rust, JS, and vendored dependencies that are trivial, duplicated, or serve features not worth keeping are removed
- [Remove what dominates build time](/quest/m1/prune-build-time.md) - the crates, features, and code that cost the most build time are removed or made cheaper
Expand Down
54 changes: 0 additions & 54 deletions quest/m1/security-audit/README.md
View file
Open in desktop

This file was deleted.