Finalize MSRV and Cargo feature design; review every dependency for purpose, version, license, maintenance, native code, security advisories, and transitive cost.
Deliverables
Remove unused/speculative dependencies and duplicate capability stacks.
Run MSRV builds, dependency tree/duplicate checks, advisory/license audits, and feature-unification tests.
Document native build/runtime requirements and update policy.
Validation
MSRV and supported feature combinations build/test/document cleanly.
No unapproved advisory or license issue remains.
Each dependency maps to an implemented need in RUSTREWRITE.md.
Prerequisite
All implementation and program milestones are complete with their fixed parity suites green.
Project constraints
The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
## Objective
Finalize MSRV and Cargo feature design; review every dependency for purpose, version, license, maintenance, native code, security advisories, and transitive cost.
## Deliverables
- Remove unused/speculative dependencies and duplicate capability stacks.
- Run MSRV builds, dependency tree/duplicate checks, advisory/license audits, and feature-unification tests.
- Document native build/runtime requirements and update policy.
## Validation
- MSRV and supported feature combinations build/test/document cleanly.
- No unapproved advisory or license issue remains.
- Each dependency maps to an implemented need in `RUSTREWRITE.md`.
## Prerequisite
All implementation and program milestones are complete with their fixed parity suites green.
## Project constraints
- The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
- Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
- Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
hugo
added this to the 12 - Hardening and release milestone 2026-08-08 08:26:25 +00:00
Replaced the unmaintained audiopus/audiopus_sys stack (RUSTSEC-2026-0150) with a private safe Rust libopus 1.3+ adapter. The reviewed ABI boundary owns encoder/decoder handles, validates sample rates/frame and packet shapes, requires exclusive mutation, and discovers libopus through pkg-config on Linux/macOS/Windows GNU or vcpkg on Windows MSVC.
Added a machine-checked policy for all 31 direct third-party dependencies and all 21 exact duplicate-version sets, including purpose, locked version, maintenance status, transitive cost, native-code status, consumers, scopes, and RUSTREWRITE mapping.
Added pinned cargo-deny 0.20.2 and cargo-machete 0.9.2 gates in an ubuntu-latest-only Gitea workflow. Advisory and license exceptions remain empty; non-crates.io sources, unreviewed graph drift, external wildcard requirements, and unused dependencies fail closed.
Documented the Rust 1.96 MSRV versus current stable, quarterly/immediate-security update policy, feature isolation, and Linux/Windows/macOS native build requirements. Extended the MSRV matrix to compile the libopus and WebRTC boundary.
Isolated validation on the final diff:
Rust 1.96 clean MSRV profile: 2/2 commands passed, including WebRTC/libopus.
Rust 1.97 current stable workspace all-target/all-feature unification: passed.
Strict issue-scoped all-feature Clippy and warning-free docs: passed.
Dependency policy audit: 31 direct crates and 21 reviewed duplicate sets passed.
cargo-deny: advisories ok, bans ok, licenses ok, sources ok.
cargo-machete: no unused dependencies.
libremetaverse-opus: 2/2 real system-codec tests passed.
libremetaverse-voice-webrtc: 5/5 tests passed, including encrypted UDP loopback Opus media and teardown.
Related compatibility test webrtc_protocol_semantics: 3/3 passed.
Standalone public API compile with its locked graph: passed.
Release-matrix audit and ubuntu-only workflow policy: passed.
No related test was skipped, and no advisory or license issue was ignored.
Implemented and pushed in commit 9e3b532.
Implementation:
- Replaced the unmaintained audiopus/audiopus_sys stack (RUSTSEC-2026-0150) with a private safe Rust libopus 1.3+ adapter. The reviewed ABI boundary owns encoder/decoder handles, validates sample rates/frame and packet shapes, requires exclusive mutation, and discovers libopus through pkg-config on Linux/macOS/Windows GNU or vcpkg on Windows MSVC.
- Added a machine-checked policy for all 31 direct third-party dependencies and all 21 exact duplicate-version sets, including purpose, locked version, maintenance status, transitive cost, native-code status, consumers, scopes, and RUSTREWRITE mapping.
- Added pinned cargo-deny 0.20.2 and cargo-machete 0.9.2 gates in an ubuntu-latest-only Gitea workflow. Advisory and license exceptions remain empty; non-crates.io sources, unreviewed graph drift, external wildcard requirements, and unused dependencies fail closed.
- Documented the Rust 1.96 MSRV versus current stable, quarterly/immediate-security update policy, feature isolation, and Linux/Windows/macOS native build requirements. Extended the MSRV matrix to compile the libopus and WebRTC boundary.
Isolated validation on the final diff:
- Rust 1.96 clean MSRV profile: 2/2 commands passed, including WebRTC/libopus.
- Rust 1.97 current stable workspace all-target/all-feature unification: passed.
- Strict issue-scoped all-feature Clippy and warning-free docs: passed.
- Dependency policy audit: 31 direct crates and 21 reviewed duplicate sets passed.
- cargo-deny: advisories ok, bans ok, licenses ok, sources ok.
- cargo-machete: no unused dependencies.
- libremetaverse-opus: 2/2 real system-codec tests passed.
- libremetaverse-voice-webrtc: 5/5 tests passed, including encrypted UDP loopback Opus media and teardown.
- Related compatibility test webrtc_protocol_semantics: 3/3 passed.
- Standalone public API compile with its locked graph: passed.
- Release-matrix audit and ubuntu-only workflow policy: passed.
No related test was skipped, and no advisory or license issue was ignored.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Objective
Finalize MSRV and Cargo feature design; review every dependency for purpose, version, license, maintenance, native code, security advisories, and transitive cost.
Deliverables
Validation
RUSTREWRITE.md.Prerequisite
All implementation and program milestones are complete with their fixed parity suites green.
Project constraints
Implemented and pushed in commit
9e3b532.Implementation:
Isolated validation on the final diff:
No related test was skipped, and no advisory or license issue was ignored.