deps: bump moq-noq stack to 2.0.1

[kixelated]

Bumps web-transport-moq, moq-noq, moq-noq-proto, and moq-noq-udp from 2.0.0 to 2.0.1 on dev.

• RUSTSEC-2026-0185: the stream and CRYPTO assembler caps buffered out-of-order chunks (port of quinn#2694), plus an unordered-compaction fix.
• fix(web-transport-moq): send raw QUIC stream codes as is noq#27: raw QUIC sessions (moqt://, moql://) send RESET_STREAM and STOP_SENDING codes as-is instead of HTTP/3-mapped, and still decode an older peer's mapped codes.

Only these four packages change version in Cargo.lock. The other lock edits re-point existing edges (moq-noq-udp 2.0.1 moves to socket2 0.6, already locked, and some windows-sys edges settle on 0.60); no packages are added or removed.

qmux is unchanged: 0.6.1 is the newest 0.6.x and predates moq-dev/web-transport#406, so that fix waits for a qmux 0.6.2.

Impact

• Public API: none.
• Wire (raw QUIC only): stream reset/stop codes become the application's own values. Accepted for dev in fix: raw QUIC stream codes stay raw #4614. A fixed peer reads older peers' mapped codes; an older moq peer reads a fixed peer's codes as a transport error (stream-scoped on moq-lite).

Quests

• quest/m1/raw-stream-codes.md stays open: fix: raw QUIC stream codes stay raw #4614 finishes it once web-transport-iroh 0.8.x with fix: send raw QUIC stream codes as is in iroh and quinn web-transport#408 is released.
• quest/m0/noq-reassembly-cap.md stays open on main (fix(moq-tokio): finite default connection receive window (noq reassembly cap, part 1) #4605): main's pin, the receive-window default, and upstream iroh noq-proto remain.

Tests

just check and just test interop --all pass.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[kixelated]

MERGE — clean patch bump of the moq-noq stack on dev. Reviewed head 799b87090309ac328aba2a1bff2e686a235af827.

Workspace pins (moq-noq-proto, moq-noq-udp, web-transport-moq) and the lockfile all land on 2.0.1; moq-noq is pulled transitively at 2.0.1 via web-transport-moq ^2.0.1. Diff confirms only those four package versions change in Cargo.lock (socket2/windows-sys edges re-point only). Matches crates.io and CHANGELOG-MOQ for 2.0.1: RUSTSEC-2026-0185 assembler/CRYPTO cap (#25), raw QUIC stream codes as-is (#27), plus reset-before-header (#19) and close-capsule delivery (#23). No public API break.

Non-blocking

1. CI still queued on this head (Check/Test/Platform/WASM/etc.). Author notes just check / just test interop --all locally; merge once CI is green.
2. Raw QUIC wire is one-way compatible (older peer reads plain codes as InvalidReset/InvalidStopped). Accepted for dev via fix: raw QUIC stream codes stay raw #4614; still worth keeping in mind for any mixed-version moqt:///moql:// rollout until peers catch up.
3. Quest leftovers stay open as stated: iroh/upstream noq still unfixed; finite receive_window is fix(moq-tokio): finite default connection receive window (noq reassembly cap, part 1) #4605; qmux 0.6.2 not out yet — none of that belongs in this bump.

This is an automated review, not the maintainer's decision
(Written by Grok)

[kixelated]

Automated review by review (OpenAI)

Reviewed head: 799b87090309ac328aba2a1bff2e686a235af827

No actionable bug found in this dependency bump. The direction is sound for dev: all three workspace minimums require 2.0.1, the four updated registry packages are published and not yanked, and their checksums match Cargo.lock. The dependency MSRV remains below this workspace's floor. Only four package versions change; the inspected socket2/windows-sys edge changes satisfy their registry constraints.

I checked the upstream reassembly-cap and raw-stream-code changes against the adapter consumers. The existing review's mixed-version warning remains important: legacy mapped codes are accepted by the new adapter, but older raw peers do not interpret its new codes correctly. That limitation is explicitly recorded in #4614; this is not a compatibility-neutral rollout. Leaving the iroh and receive-window follow-ups open is appropriate.

Verification: static manifest/lockfile, registry metadata, upstream patch, and consumer inspection. No build or tests run here; the author's local test results were not independently reproduced, and CI was still pending.

[kixelated]

Merging: CI green on 799b87090309ac328aba2a1bff2e686a235af827, both automated reviews found nothing actionable. The raw-QUIC stream code wire change was accepted for dev by the maintainer in #4614. 2.0.1 also carries moq-dev/noq#19 (reset before header) and #23 (close-capsule delivery). Follow-ups stay with their owners: #4614 (needs web-transport-iroh 0.8.x), #4605 (receive window, main pin), and a qmux 0.6.2 bump once web-transport#406 is released.

(Written by Claude Opus 5.5)