chore: merge main into next by coderdan · Pull Request #1455 · cipherstash/stack

coderdan · 2026-10-30T23:59:35Z

Summary

next had fallen 30 commits behind main, and #1229 (next into main) showed merge conflicts. This PR merges main into next with the conflicts resolved. Merge it with a merge commit (not squash or rebase), so main's commits stay in next's history and #1229 stops conflicting.

What comes in from main: the constant-operation-count ORE block comparator (#1148), the cancellation-safe auth refresh (#1172), the OidcFederationStrategy README fix (#1342), and the dependency bumps (#1375, #1409, #1410, #1411, #1413).

How each conflict was resolved

packages/eql/src/v3/sem/ore_block_256/functions.sql. main rewrote the EQL v3 block ORE comparator so that its run time no longer depends on where two values differ. next had turned the same file into a template shared by the v3 and v4 bundles. The resolution takes main's comparator and writes its names with next's placeholders ({{prefix}}, {{ore_block}}), inside the v3-only block. Checked by rendering: for v3 the file is main's byte for byte, and for v4 it is next's. In the built v3 bundle, the comparator is identical to main's build. The bundle's other differences are next's own earlier changes (a lint scoping fix and directive comments).
packages/eql/docs/upgrading/v3.1.md. Both branches created this guide. next's notes U-001 to U-003 stay. main's note becomes U-004 ("Block-ORE text comparisons check every term"). The guide's intro, TL;DR, compatibility table, checklist, rollback and see-also sections now cover both. The guide no longer says the eql_v3 bundle is unchanged, which stopped being true once main's comparator arrived.
Changesets. The two changesets from main that linked the note now link U-004. next's three changesets that said "the v3 bundle is unchanged, byte for byte" now say their own change leaves it as it was. Nothing has been released at 3.1.0 yet (npm's latest @cipherstash/eql is 3.0.6), so no published link moves.
languages/golang/go.mod, go.sum. next's requirements, with main's golang.org/x/tools 0.52.0 and golang.org/x/mod 0.42.0. go.sum comes from go mod tidy.
Cargo.lock, packages/eql/Cargo.lock, both Go guest Cargo.lock files. Each started from next's version, then had main's version bumps reapplied with cargo update --precise. Every one of main's new versions is present, and no version main removed came back.

One follow-up fix

proptest 1.12, from main's dependency bumps, moved to rand_core 0.10. In that release the trait that provides next_u32, next_u64 and fill_bytes is Rng, and RngCore is a deprecated alias that no longer brings them into scope. Two stack-encrypt leakage-test modules that exist only on next imported RngCore. So every job compiling stack-encrypt's tests failed on the first CI run (clippy and nextest, udeps, CRAP, and the Go job's native guest tests). The second commit imports Rng instead and raises stack-encrypt's proptest dev-dependency to 1.12. The json_leakage tests pass with it (12 of 12).

Verification

mise run build in packages/eql: passed, including the renderer's lints and the v4 isolation gate.
cargo test --locked -p eql-codegen: passed.
cargo clippy --locked -p stack-encrypt --all-features --all-targets -D warnings, and the json_leakage nextest binary: passed after the follow-up fix.
cargo metadata --locked passes for every Cargo workspace in the tree except packages/stack-auth/fuzz and packages/stack-kms/fuzz. Those two already fail on next before this merge and pass on main; this PR does not touch them.
Not run locally: the PostgreSQL suites (no database available here), and pnpm run test:scripts (this checkout has no node_modules). CI covers both.

https://claude.ai/code/session_01MrxG73fnX1p7oiizh3GRG5

…xample OidcFederationStrategy.create() returns a Result<OidcFederationStrategy, AuthFailure>, not the strategy. The README's Authentication example passed that envelope straight to config.authStrategy, so Encryption() failed with "[encryption]: Credential error: opts.strategy.getToken is missing". Reproduced against @cipherstash/stack 1.2.1. Unwrap it the way the Encryption() JSDoc and the stash-auth skill already do: check .failure, then pass .data. Fixed in the root README, its copy in the stack package, and the LockContext JSDoc example, which had the same mistake.

…-result docs(stack): unwrap the OidcFederationStrategy Result in the README example

A token refresh ran inside the caller's get_token future, so cancelling that future (a request timeout, a dropped connection, a select! that lost) dropped the refresh with it. With a rotating device-session refresh token, a refresh the server had already accepted could be lost before it was saved: the old credential was spent, the new one was gone, and the client could not authenticate again until the process restarted. On native targets the refresh now runs in a spawned Tokio task that owns the exchange, persistence, token installation and waiter notification. Cancelling get_token abandons only that caller's wait. wasm32 refreshes still run inline, since browser futures are not Send and WASI hosts drive the export to completion. This also closes a missed-wakeup race: a caller waiting on an in-flight refresh now joins the notify list while it still holds the state lock and rechecks the in-progress flag before parking. Cancellation and seeded soak tests cover both, and CI runs the soak on PRs and before a crates release. BREAKING CHANGE: On native targets a token refresh now needs a current Tokio runtime, and `TokenStore` (with the closures given to `TokenStoreFn`) must be `Send + Sync + 'static`, because the spawned refresh task holds the store until the new token is saved. A store that borrows request state must own it instead (for example an `Arc` captured by `move` closures), and save callbacks run in the refresh task, not the caller's. Callers that drive `get_token` with another executor (`futures::executor::block_on`, smol) must run it inside a Tokio runtime. wasm32 is unchanged. Refs #1170.

Native token refresh now runs in an owned Tokio task, so the guest header test must await its exchange inside a runtime. Add Tokio only as a development dependency and retain the existing header assertions. Refs #1170.

Assert which token the initiating caller receives immediately before, at, and after expiry so both surviving comparison mutations fail. Keep cfg(test) separate on the cancellation and soak modules so cargo-mutants recognises the test harnesses without weakening production mutation coverage. The full PR mutation sweep passes with 5 caught and 9 unviable mutants, no survivors or timeouts. Refs #1170.

…talled After a successful non-blocking refresh the engine installed the new token but handed the caller that started the refresh the old one, unless the old one had already expired. A non-blocking refresh starts only when the cached token is inside the 90-second expiry leeway, so that caller could get a token with seconds left and a 401 partway through its request. install_refreshed_token already returns the new ServiceToken; return it. That removes the expiry comparison on the success path, so the boundary test now asserts the refreshed token is returned before, at and after the old token's expiry. The failure path still returns the old token while it is unexpired, which is unchanged. The behaviour predates the cancellation work; it was raised in review of PR #1172.

The seeded soak runs on a current-thread runtime with paused time so a seed replays exactly. That also means it never interleaves callers across worker threads, so it cannot find a bug that only parallel workers expose. Add a short run on a four-worker runtime in real time. A Pace divides every scripted delay and speeds the engine's clock by the same factor, so token lifetimes and the expiry leeway keep their proportions; at Pace(100) the run takes about four seconds. It is not replayable, so it checks the session invariants (no reuse, newest rotation saved and installed, no expired token returned, no caller stranded) and that the session rotated, but no coverage floor. The stranded-caller bound is a fixed ten seconds of real time there, so a busy CI runner cannot trip it. The seeded runs pass Pace(1) and behave exactly as before.

On native targets stack-auth now spawns a token refresh onto the current Tokio runtime. futures::executor::block_on provides none, so token and refresh in the auth guest would panic on the first refresh in a native build. Today only the wasm32 abi exports reach them, where stack-auth refreshes inline and block_on is sound. A cfg(target_arch = "wasm32") gate would leave their helpers dead on the native test build, so record the constraint where block_on is imported instead, before a native test finds the panic by accident.

The long soak ran on every push matching release-plz.yml's path filter, even when the stack-* crates line is not armed and release-crates is skipped anyway. Give it the same crates-armed gate as release-crates. It still runs before release-crates' preflight asks crates.io whether any version is unpublished, so a failed soak also holds stack-kms and stack-encrypt. Moving that preflight into its own job would let the soak run only for an unpublished stack-auth, but release-crates would then need a status function to run past a skipped soak, which the soak gate test forbids on the publish job. Left as is. eql-pipeline-armed.test.mjs pins exactly which jobs the switch gates; it now lists the soak beside the publish job.

compare_ore_block_256_term(s), behind every ordered ORE operator and the ORE operator class, took time that depended on where its operands first differ. A party able to time queries, without reading the stored ciphertexts, could learn how long a prefix their query value shares with stored values: the information the constant-time comparator in ore.rs keeps from them. - Within a term, every block after the first difference ran extra statements, and the `OR` short-circuit skipped a comparison on each of them. On PostgreSQL 17 (aarch64) the two nearly cancel (t = +4.9 and +13.9 through the operator path); with the short-circuit removed the extra statements alone gave t = +388, about 0.7 µs per comparison. - Across terms (text, up to six), the comparison stopped at the first unequal term: about 11 µs when the first term differs, 47 µs when only the sixth does (t below -1500). The term comparator now runs the same statements for every block: both comparisons always evaluated (integer `|`), one statement per block collecting a bitmask of differing blocks, the first difference read off its lowest set bit with arithmetic, and exactly one encrypt() and one get_bit() on every path. The array comparator keeps a fast path for single-term values and, for multi-term values, scans every paired term, latches the first unequal term and block without branching, and hashes once; its multi-term variables live in an inner block so the single-term path does not initialise them. Term counts and NULL elements are public structure and still branch. Measured with tests/timing/ore_block_256 (next commit): single-term t = +1.8 and +1.1 at about 3-8% more time; six-term t = +4.5 and +2.7 at about 31 µs either way. Results are unchanged: all 1,500 harness checks (1-6 terms, every shared-prefix length) match plaintext order and are antisymmetric, and the structural edge cases (NULL elements, equal prefixes of different lengths, empty and NULL arrays) match the previous implementation exactly. Behaviour change: multi-term values length-check every paired term, so a malformed term after the first unequal one now raises instead of being skipped. A new creds-free test pins that and the multi-term structure.

tests/timing/ore_block_256 runs by hand against a database with EQL installed (run.sh, DATABASE_URL). ctgen encrypts real legacy ORE ciphertexts with ore-rs under a throwaway key, so no CipherStash credentials are needed; it is a detached crate with its own workspace. The harness first checks the comparator against plaintext order on 1,500 pairs of 1-6 terms, then times two classes (operands that first differ early vs late) for single-term and six-term values through compare_ore_block_256_terms. Both classes share one randomly ordered table, each sample times several comparisons, and it reports the plain Welch t: separate per-class storage and percentile-cropped statistics each produced false signals in the ore.rs timing work. Against the previous comparator it reports t of -460 to -2575 for six-term values; against the current one every |t| is below 5.

Review of the constant-operation-count comparator found three remaining data-dependent paths and a width limit: - When paired terms were all equal and the arrays had different term counts, the array comparator returned without hashing, so timing showed whether one value's terms are a prefix of the other's (about 7 µs against 9 µs). - When the first unequal pair had a NULL element, it also returned without hashing, so timing showed whether the terms before the NULL were equal. - The first differing block was read off a bitmask with round(ln(mask & -mask) / ln(2)). glibc's log() returns early for exactly 1.0, which is the first-block case, and the int4 mask failed at 32 or more blocks: "integer out of range" at 32, the wrong block at 33. The term comparator now latches the first differing block with one arithmetic statement per block (latch := latch + (latch = 0) * (block + 1) * differs): no mask, no float, no width limit. The array comparator compares each paired term whole in one statement (its PRP bytes and left blocks, the deterministic part) and latches the first unequal pair. It then calls compare_ore_block_256_term exactly once on every path: on the latched pair, or, when every pair is equal or the latched pair has a NULL element, on a NULL-free pair whose result is discarded. The result is selected arithmetically. This removes the copy of the block scan and hash from the array comparator, and every element is read once per iteration. A malformed term paired with a NULL element now raises too. Measured on PostgreSQL 17.11 (aarch64), through the operator path: single-term t = -0.78 and +0.48 (200k samples of 16), six-term t = +1.10 and -1.00 (50k samples of 8), and two new shapes at 100k samples of 8: an equal prefix of different-length arrays against a first-term difference, t = -0.45 and +0.79; a NULL after equal terms against a first-term difference, t = +0.26 and +1.24. A six-term comparison now takes about 18 µs either way (31 µs before this change); single-term comparisons cost about 6% more than the original comparator. Results are unchanged: 21,000 random arrays of 1-6 terms with NULL elements and truncation, and random terms of 8 to 64 blocks, give exactly what the original comparator gives, and the harness's 1,500 plaintext checks pass.

…ed paths Review follow-ups for the ORE block comparator work. - A creds-free ordering test (T4c in encrypted_domain/family/sem.rs). It encrypts u64 arrays in-process with ore-rs (the legacy 8-bit block scheme behind ore_block_256, already in the lockfile through cipherstash-client) under a fresh throwaway key, and checks every ordered pair against plaintext order: single terms first differing in each block, multi-term values sharing prefixes of every length, differences in early and late blocks of later terms, and a NULL second element against real terms. Nothing is committed and no CipherStash credentials are needed. Mutating the pair the comparator hashes, the block latch, or the NULL latch each fails it. - T4b builds its terms with ore-rs too, instead of synthetic blobs (its malformed term stays malformed on purpose). The module docs no longer describe the removed recursion. - The timing harness gains two classes for the paths the review found: an equal prefix of different-length arrays, and a NULL after equal terms, each against a first-term difference. Against the PR's first version they give t = -60 to -70; against the original comparator, +459 to +682; against the current one, |t| < 1 (50k samples of 8). - run.sh refuses to start if an ore_timing schema already exists, and drops only the schema it created. - Dependabot covers the ctgen crate's lockfile.

The harness comment called each sample's pairs distinct; they are drawn independently, with replacement, from a pool of the same size for both classes.

…omparator The multi-term path raised 'Malformed ORE term' for a pair that the term comparator reports as 'Ciphertexts are different lengths'. Both paths now check the width first. Tests cover a later pair of different widths after an earlier unequal pair, and a malformed term paired with a NULL element.

Adds an equal-term class to the ORE timing harness (a single term against itself, against a first-block difference) and records a second machine's results, including a small C-level difference in the prefix and NULL kinds there and the cost of hashing equal terms. run.sh now tells an unreachable database apart from an existing ore_timing schema. The README says who can already run the comparator, scopes the operation-count claim to operands of the same shape, and gives sample counts per kind rather than per class.

…rors Multi-term ORE values now raise on a malformed or mismatched-width term the comparator used to skip. That is a behaviour change, so the changeset is minor, and U-001 in a new 3.1 upgrade guide shows how to find such rows before upgrading.

…comparator The 3.1.0 baseline and upgrade edge were baked on main when 3.1.0's SQL changed only the version stamp. The constant-operation ORE block comparator changes that SQL, so the Version Packages PR would rebuild a 3.1.0 bundle whose digest no migration bakes, and a bare re-pin would ship a "3.1.0" migration still carrying the leaky comparator. Build 3.1.0 from this branch (af316179 -> c9404de3; the diff is confined to the comparator), re-emit only the baseline and the 3.1.0 edge, keeping their createdAt, and copy both into the prisma example. Re-pin the migrationHash and installSqlSha256 values. Neither directory has been published. The 3.1.0 migration changeset, both migration headers and the absorption plan no longer describe 3.1.0 as stamp-only; the changeset links EQL's U-001 note for the new raise on malformed text terms.

…efresh fix(auth): preserve token refreshes across caller cancellation

…ant-op-count fix(eql): constant operation count for the ORE block comparator

Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.51.0 to 0.52.0. - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

… 11 updates Bumps the cargo-minor-patch group with 11 updates in the /languages/typescript/packages/protect-ffi directory: | Package | From | To | | --- | --- | --- | | [rust_decimal](https://github.com/paupino/rust-decimal) | `1.42.1` | `1.43.0` | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [uuid](https://github.com/uuid-rs/uuid) | `1.24.0` | `1.28.0` | | [zeroize](https://github.com/RustCrypto/utils) | `1.9.0` | `1.9.1` | | [neon](https://github.com/neon-bindings/neon) | `1.1.1` | `1.1.2` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.3` | | [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.3` | `1.8.7` | | [lazy_static](https://github.com/rust-lang-nursery/lazy-static.rs) | `1.5.0` | `1.5.1` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` | | [rustls](https://github.com/rustls/rustls) | `0.23.45` | `0.23.46` | | [rustls-webpki](https://github.com/rustls/webpki) | `0.103.15` | `0.103.16` | Updates `rust_decimal` from 1.42.1 to 1.43.0 - [Release notes](https://github.com/paupino/rust-decimal/releases) - [Changelog](https://github.com/paupino/rust-decimal/blob/master/CHANGELOG.md) - [Commits](paupino/rust-decimal@1.42.1...1.43.0) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `uuid` from 1.24.0 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.0...v1.28.0) Updates `zeroize` from 1.9.0 to 1.9.1 - [Commits](RustCrypto/utils@zeroize-v1.9.0...zeroize-v1.9.1) Updates `neon` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/neon-bindings/neon/releases) - [Changelog](https://github.com/neon-bindings/neon/blob/main/RELEASES.md) - [Commits](https://github.com/neon-bindings/neon/commits) Updates `tokio` from 1.53.1 to 1.53.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.3) Updates `blake3` from 1.8.3 to 1.8.7 - [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases) - [Commits](BLAKE3-team/BLAKE3@1.8.3...1.8.7) Updates `lazy_static` from 1.5.0 to 1.5.1 - [Release notes](https://github.com/rust-lang-nursery/lazy-static.rs/releases) - [Commits](https://github.com/rust-lang-nursery/lazy-static.rs/commits) Updates `reqwest` from 0.13.4 to 0.13.5 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5) Updates `rustls` from 0.23.45 to 0.23.46 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.45...v/0.23.46) Updates `rustls-webpki` from 0.103.15 to 0.103.16 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.15...v/0.103.16) --- updated-dependencies: - dependency-name: rust_decimal dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: zeroize dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: neon dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tokio dependency-version: 1.53.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: blake3 dependency-version: 1.8.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: lazy_static dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: reqwest dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: rustls dependency-version: 0.23.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: rustls-webpki dependency-version: 0.103.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

… 13 updates Bumps the cargo-minor-patch group with 13 updates in the /packages/eql directory: | Package | From | To | | --- | --- | --- | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [schemars](https://github.com/GREsau/schemars) | `1.2.2` | `1.2.3` | | [zeroize](https://github.com/RustCrypto/utils) | `1.8.2` | `1.9.1` | | [rust_decimal](https://github.com/paupino/rust-decimal) | `1.42.1` | `1.43.0` | | [rand](https://github.com/rust-random/rand) | `0.8.6` | `0.8.8` | | [uuid](https://github.com/uuid-rs/uuid) | `1.23.1` | `1.28.0` | | [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.5` | `1.8.7` | | [lazy_static](https://github.com/rust-lang-nursery/lazy-static.rs) | `1.5.0` | `1.5.1` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` | | [rustls](https://github.com/rustls/rustls) | `0.23.45` | `0.23.46` | | [rustls-webpki](https://github.com/rustls/webpki) | `0.103.15` | `0.103.16` | | [tracing](https://github.com/tokio-rs/tracing) | `0.1.41` | `0.1.44` | | [url](https://github.com/servo/rust-url) | `2.5.7` | `2.5.8` | Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `schemars` from 1.2.2 to 1.2.3 - [Release notes](https://github.com/GREsau/schemars/releases) - [Changelog](https://github.com/GREsau/schemars/blob/master/CHANGELOG.md) - [Commits](GREsau/schemars@v1.2.2...v1.2.3) Updates `zeroize` from 1.8.2 to 1.9.1 - [Commits](RustCrypto/utils@zeroize-v1.8.2...zeroize-v1.9.1) Updates `rust_decimal` from 1.42.1 to 1.43.0 - [Release notes](https://github.com/paupino/rust-decimal/releases) - [Changelog](https://github.com/paupino/rust-decimal/blob/master/CHANGELOG.md) - [Commits](paupino/rust-decimal@1.42.1...1.43.0) Updates `rand` from 0.8.6 to 0.8.8 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/0.8.8/CHANGELOG.md) - [Commits](rust-random/rand@0.8.6...0.8.8) Updates `uuid` from 1.23.1 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.23.1...v1.28.0) Updates `blake3` from 1.8.5 to 1.8.7 - [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases) - [Commits](BLAKE3-team/BLAKE3@1.8.5...1.8.7) Updates `lazy_static` from 1.5.0 to 1.5.1 - [Release notes](https://github.com/rust-lang-nursery/lazy-static.rs/releases) - [Commits](https://github.com/rust-lang-nursery/lazy-static.rs/commits) Updates `reqwest` from 0.13.4 to 0.13.5 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5) Updates `rustls` from 0.23.45 to 0.23.46 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.45...v/0.23.46) Updates `rustls-webpki` from 0.103.15 to 0.103.16 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.15...v/0.103.16) Updates `tracing` from 0.1.41 to 0.1.44 - [Release notes](https://github.com/tokio-rs/tracing/releases) - [Commits](tokio-rs/tracing@tracing-0.1.41...tracing-0.1.44) Updates `url` from 2.5.7 to 2.5.8 - [Release notes](https://github.com/servo/rust-url/releases) - [Commits](servo/rust-url@v2.5.7...v2.5.8) --- updated-dependencies: - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: schemars dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: zeroize dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: rust_decimal dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: rand dependency-version: 0.8.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: blake3 dependency-version: 1.8.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: lazy_static dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: reqwest dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: rustls dependency-version: 0.23.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: rustls-webpki dependency-version: 0.103.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tracing dependency-version: 0.1.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: url dependency-version: 2.5.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…ith 8 updates Bumps the dev-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.15` | | [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.11.10` | | [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.16.7` | `3.26.0` | | [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js) | `2.112.3` | `2.118.0` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.118.0` | | [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` | | [fta-cli](https://github.com/sgb-io/fta) | `3.0.1` | `3.1.0` | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | Updates `@biomejs/biome` from 2.5.9 to 2.5.15 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/@biomejs/biome@2.5.15/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome) Updates `turbo` from 2.10.10 to 2.11.10 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.10...v2.11.10) Updates `@clerk/backend` from 3.16.7 to 3.26.0 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.26.0/packages/backend) Updates `@supabase/postgrest-js` from 2.112.3 to 2.118.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/postgrest-js) Updates `@supabase/supabase-js` from 2.112.3 to 2.118.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js) Updates `fast-check` from 4.9.0 to 4.10.2 - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check) Updates `fta-cli` from 3.0.1 to 3.1.0 - [Release notes](https://github.com/sgb-io/fta/releases) - [Changelog](https://github.com/sgb-io/fta/blob/main/CHANGELOG.md) - [Commits](sgb-io/fta@v3.0.1...v3.1.0) Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@clerk/backend" dependency-version: 3.25.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/postgrest-js" dependency-version: 2.118.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/supabase-js" dependency-version: 2.118.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: fast-check dependency-version: 4.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: fta-cli dependency-version: 3.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: turbo dependency-version: 2.11.9 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

…th 8 updates Bumps the cargo-minor-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [rustls](https://github.com/rustls/rustls) | `0.23.45` | `0.23.46` | | [rustls-webpki](https://github.com/rustls/webpki) | `0.103.15` | `0.103.16` | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [tokio](https://github.com/tokio-rs/tokio) | `1.50.0` | `1.53.3` | | [proptest](https://github.com/proptest-rs/proptest) | `1.11.0` | `1.12.0` | | [syn](https://github.com/dtolnay/syn) | `3.0.6` | `3.0.9` | Bumps the cargo-minor-patch group with 3 updates in the /languages/golang/auth/guest directory: [serde_json](https://github.com/serde-rs/json), [tokio](https://github.com/tokio-rs/tokio) and [proptest](https://github.com/proptest-rs/proptest). Bumps the cargo-minor-patch group with 5 updates in the /languages/golang/encrypt/guest directory: | Package | From | To | | --- | --- | --- | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.2` | `1.53.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.27.0` | `1.28.0` | | [proptest](https://github.com/proptest-rs/proptest) | `1.11.0` | `1.12.0` | | [schemars](https://github.com/GREsau/schemars) | `1.2.2` | `1.2.3` | Bumps the cargo-minor-patch group with 1 update in the /packages/stack-encrypt/fuzz directory: [uuid](https://github.com/uuid-rs/uuid). Updates `rustls` from 0.23.45 to 0.23.46 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.45...v/0.23.46) Updates `rustls-webpki` from 0.103.15 to 0.103.16 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.15...v/0.103.16) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `tokio` from 1.50.0 to 1.53.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.53.3) Updates `proptest` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/proptest-rs/proptest/releases) - [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md) - [Commits](proptest-rs/proptest@v1.11.0...v1.12.0) Updates `syn` from 3.0.6 to 3.0.9 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](dtolnay/syn@3.0.6...3.0.9) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `tokio` from 1.53.2 to 1.53.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.53.3) Updates `proptest` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/proptest-rs/proptest/releases) - [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md) - [Commits](proptest-rs/proptest@v1.11.0...v1.12.0) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `tokio` from 1.53.2 to 1.53.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.53.3) Updates `uuid` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.27.0...v1.28.0) Updates `proptest` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/proptest-rs/proptest/releases) - [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md) - [Commits](proptest-rs/proptest@v1.11.0...v1.12.0) Updates `schemars` from 1.2.2 to 1.2.3 - [Release notes](https://github.com/GREsau/schemars/releases) - [Changelog](https://github.com/GREsau/schemars/blob/master/CHANGELOG.md) - [Commits](GREsau/schemars@v1.2.2...v1.2.3) Updates `uuid` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.27.0...v1.28.0) --- updated-dependencies: - dependency-name: rustls dependency-version: 0.23.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: rustls-webpki dependency-version: 0.103.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tokio dependency-version: 1.53.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: proptest dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: syn dependency-version: 3.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tokio dependency-version: 1.53.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: proptest dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tokio dependency-version: 1.53.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: proptest dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: schemars dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…-dependencies-e9476be3d8 chore(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates

…r-patch-9bc754fc85 chore(deps): bump the cargo-minor-patch group across 4 directories with 8 updates

…ql/cargo-minor-patch-b4a31617af chore(deps): bump the cargo-minor-patch group across 1 directory with 13 updates

…typescript/packages/protect-ffi/cargo-minor-patch-4d8f44c017 chore(deps): bump the cargo-minor-patch group across 1 directory with 11 updates

…ages/golang/golang.org/x/tools-0.52.0 chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /languages/golang

Brings next up to date with main: the constant-operation-count ORE block comparator (#1148), the cancellation-safe auth refresh (#1172), the OidcFederationStrategy README fix (#1342) and the dependency bumps (#1375, #1409, #1410, #1411, #1413). Conflicts resolved: - packages/eql/src/v3/sem/ore_block_256/functions.sql: main's comparator, with its names written as next's {{prefix}} and {{ore_block}} placeholders inside the v3 block. Rendered for v3, the file is main's byte for byte; rendered for v4, it is next's. - packages/eql/docs/upgrading/v3.1.md: both branches added this guide. Next's U-001 to U-003 stay; main's U-001 becomes U-004, and the guide no longer says the eql_v3 bundle is unchanged. The two changesets from main that link the note now link U-004, and next's three changesets that said the v3 bundle is unchanged byte for byte now say their change leaves it as it was. - languages/golang/go.mod and go.sum: next's requirements with main's golang.org/x/tools and golang.org/x/mod bumps; go.sum from go mod tidy. - Cargo.lock, packages/eql/Cargo.lock and both Go guest lockfiles: next's lockfile, then main's version bumps reapplied with cargo update --precise. Every lockfile resolves with --locked. Claude-Session: https://claude.ai/code/session_01MrxG73fnX1p7oiizh3GRG5

changeset-bot · 2026-10-30T23:59:40Z

🦋 Changeset detected

Latest commit: 5697451

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@cipherstash/auth	Patch
@cipherstash/stack-prisma	Minor
@cipherstash/eql	Minor
@cipherstash/stack	Minor
stash	Minor
@cipherstash/wizard	Minor
@cipherstash/ffi-integration-tests	Patch
@cipherstash/prisma-example	Patch
@cipherstash/bench	Patch
@cipherstash/stack-drizzle	Minor
@cipherstash/stack-supabase	Minor
@cipherstash/test-kit	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/auth-darwin-arm64	Patch
@cipherstash/auth-darwin-x64	Patch
@cipherstash/auth-linux-arm64-gnu	Patch
@cipherstash/auth-linux-x64-gnu	Patch
@cipherstash/auth-linux-x64-musl	Patch
@cipherstash/auth-win32-x64-msvc	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-10-30T23:59:45Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI; Enforced overrides: Organization
Review profile: CHILL
Plan: Advanced
Run ID: 4a43a40b-f401-4947-89fb-f4b749cf4b75

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-30T23:59:45Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T00:01:33.595706Z	`13bab61`	PR opened
🔒 Security Review	✅ Completed 2026-10-31T00:03:46.376442Z	`13bab61`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cipherstash-agent

Review attestation: automated code review (medium) and cross-check

Reviewed: head 13bab61, a merge of main into next. I read the merge-resolution diff (git show --cc), the ore_block_256/functions.sql template resolution, the v3.1.md upgrade guide merge and the changeset edits.

Result: no critical or blocking issues, and no new findings. There are no inline comments.

Checks:

The root Cargo.lock passes cargo metadata --locked at head.
main's rand 0.8.8, syn 3.0.9, socket2 0.6.5 and the vitaminc 0.8 crates are all present.
The v3-only {{#v3}} blocks in functions.sql keep main's comparator, with names turned into {{prefix}} and {{ore_block}} placeholders. The v4 blocks are next's.
The U-001..U-004 renumbering and the changeset links to U-004 are consistent. I found no dangling U-001 reference for the block-ORE note.

Not verified: I did not run the EQL mise run build, the PostgreSQL suites or pnpm run test:scripts; the PR notes the same gap. The other Cargo lockfiles were not checked individually. The Codex review was still running when I looked, so this does not cover its findings.

Merge note: merge this with a merge commit, as the PR description says.

Generated by Claude Code

github-actions · 2026-10-31T00:02:13Z

Mutation testing (cargo-mutants, `--in-diff`, stack-auth + stack-encrypt)

caught	missed	unviable	timeout
2	0	9	0

Every mutant in the changed lines was caught by a test.

proptest 1.12, from main's dependency bumps, moves to rand_core 0.10, where the trait that provides next_u32, next_u64 and fill_bytes is Rng and RngCore is a deprecated alias that no longer brings them into scope. The two leakage-test modules imported RngCore, so every job that compiles stack-encrypt's tests failed. Import Rng instead, and require proptest 1.12, the first release whose Rng provides those methods. Claude-Session: https://claude.ai/code/session_01MrxG73fnX1p7oiizh3GRG5

coderdan and others added 30 commits October 23, 2026 23:14

Merge pull request #1342 from cipherstash/docs/unwrap-oidc-federation…

c311f82

…-result docs(stack): unwrap the OidcFederationStrategy Result in the README example

test(auth): run native guest exchange under Tokio

6052281

Native token refresh now runs in an owned Tokio task, so the guest header test must await its exchange inside a runtime. Add Tokio only as a development dependency and retain the existing header assertions. Refs #1170.

docs(eql): say the timing harness samples pairs with replacement

609eeef

The harness comment called each sample's pairs distinct; they are drawn independently, with replacement, from a pool of the same size for both classes.

Merge pull request #1172 from cipherstash/fix/1170-cancel-safe-auth-r…

b26ed8d

…efresh fix(auth): preserve token refreshes across caller cancellation

Merge pull request #1148 from cipherstash/fix/eql-ore-block-256-const…

9ff5185

…ant-op-count fix(eql): constant operation count for the ORE block comparator

Merge pull request #1375 from cipherstash/dependabot/npm_and_yarn/dev…

b04dce0

…-dependencies-e9476be3d8 chore(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates

Merge pull request #1413 from cipherstash/dependabot/cargo/cargo-mino…

aa53596

…r-patch-9bc754fc85 chore(deps): bump the cargo-minor-patch group across 4 directories with 8 updates

Merge pull request #1411 from cipherstash/dependabot/cargo/packages/e…

7b5b873

…ql/cargo-minor-patch-b4a31617af chore(deps): bump the cargo-minor-patch group across 1 directory with 13 updates

Merge pull request #1410 from cipherstash/dependabot/cargo/languages/…

a376696

…typescript/packages/protect-ffi/cargo-minor-patch-4d8f44c017 chore(deps): bump the cargo-minor-patch group across 1 directory with 11 updates

Merge pull request #1409 from cipherstash/dependabot/go_modules/langu…

3a923ef

…ages/golang/golang.org/x/tools-0.52.0 chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /languages/golang

coderdan requested a review from a team as a code owner October 30, 2026 23:59

cipherstash-agent reviewed Oct 31, 2026

View reviewed changes

coderdan merged commit 704a50a into next Oct 31, 2026
71 checks passed

coderdan deleted the chore/merge-main-into-next-1031 branch October 31, 2026 00:47

coderdan mentioned this pull request Oct 31, 2026

docs(eql): say what native jsonb functions do on the v4 JSON tree domains #1444

Merged

Navigation Menu

Repository navigation

chore: merge main into next - #1455

chore: merge main into next#1455
coderdan merged 32 commits into
nextfrom
chore/merge-main-into-next-1031

coderdan commented Oct 30, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

cipherstash-agent left a comment

Uh oh!

github-actions Bot commented Oct 31, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

coderdan commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How each conflict was resolved

One follow-up fix

Verification

Uh oh!

changeset-bot Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

cipherstash-agent left a comment

Choose a reason for hiding this comment

Review attestation: automated code review (medium) and cross-check

Uh oh!

github-actions Bot commented Oct 31, 2026

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderdan commented Oct 30, 2026 •

edited

Loading

changeset-bot Bot commented Oct 30, 2026 •

edited

Loading

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading

Mutation testing (cargo-mutants, `--in-diff`, stack-auth + stack-encrypt)