Fix SHA-2 dependency chain with an API-compatible oauth2 v5 fork

jlxq0 commented

2026-10-28 21:55:15 +00:00

Owner

Matrix MCP retains an older SHA-2/digest/block-buffer dependency through oauth2 5.0.0. This narrow fork of the released 5.0.0 source upgrades that chain while preserving rand 0.8, public argument types, OAuth behavior and HTTP-client features. It requires Rust 1.96, matching the existing Matrix consumer, and cannot publish to crates.io.

The example HMAC import, explicit elided lifetimes and small Clippy adjustments support the declared compiler; an unused async-std development dependency was removed. The stale 1.65 lock/CI is replaced by one committed lock and pinned, read-only Forge CI without any publish/deploy step. Upstream attribution remains. Consumers must pin the independently reviewed full Git revision and retire the fork when an upstream fixed release passes consumer qualification.

Validation: all-feature, default examples, no-default doc and curl-only tests; 67 unit tests and 11 doc tests pass (two existing ignored incomplete function-signature snippets). RFC 7636 Appendix B plus 43/64/65/128-character independent PKCE goldens preserve S256 and the u32 API. Clippy on Rust 1.96 is clean. Fresh RustSec audit and OSV report no findings. A provisional local Matrix consumer build passed all 380 existing tests, including encrypted-store/SDK 0.17 compatibility; immutable consumer pin/review/CI remain a separate change.

Independent exact-head review and actual Forge CI are required before this source-only merge. No Matrix deployment, store operation, credential change or provider write occurs here.

Final gate: fresh independent source review at 371fb6d4da found no defects; a fresh independent CI closeout passed actual run 3/job 31335 and run 4/job 31336. Rust 1.96 default/all/no-default docs and WASM coverage are included. No advisory ignores. Source merge only; consumer pin, release artifact and live deployment remain separate gates.

Matrix MCP retains an older SHA-2/digest/block-buffer dependency through oauth2 5.0.0. This narrow fork of the released 5.0.0 source upgrades that chain while preserving rand 0.8, public argument types, OAuth behavior and HTTP-client features. It requires Rust 1.96, matching the existing Matrix consumer, and cannot publish to crates.io. The example HMAC import, explicit elided lifetimes and small Clippy adjustments support the declared compiler; an unused async-std development dependency was removed. The stale 1.65 lock/CI is replaced by one committed lock and pinned, read-only Forge CI without any publish/deploy step. Upstream attribution remains. Consumers must pin the independently reviewed full Git revision and retire the fork when an upstream fixed release passes consumer qualification. Validation: all-feature, default examples, no-default doc and curl-only tests; 67 unit tests and 11 doc tests pass (two existing ignored incomplete function-signature snippets). RFC 7636 Appendix B plus 43/64/65/128-character independent PKCE goldens preserve S256 and the u32 API. Clippy on Rust 1.96 is clean. Fresh RustSec audit and OSV report no findings. A provisional local Matrix consumer build passed all 380 existing tests, including encrypted-store/SDK 0.17 compatibility; immutable consumer pin/review/CI remain a separate change. Independent exact-head review and actual Forge CI are required before this source-only merge. No Matrix deployment, store operation, credential change or provider write occurs here. Final gate: fresh independent source review at 371fb6d4da6e00b911de11079095529444f9a874 found no defects; a fresh independent CI closeout passed actual run 3/job 31335 and run 4/job 31336. Rust 1.96 default/all/no-default docs and WASM coverage are included. No advisory ignores. Source merge only; consumer pin, release artifact and live deployment remain separate gates.

jlxq0 added 1 commit

2026-10-28 21:55:15 +00:00

Fix SHA-2 dependency chain while preserving oauth2 v5 behavior

CI / cargo (push) Successful in 4m9s

Details

CI / cargo (pull_request) Successful in 3m31s

Details

71a8bc1792

jlxq0 added 1 commit

2026-10-28 21:59:50 +00:00

Retain upstream WASM and default doctest coverage

CI / cargo (push) Successful in 4m29s