deps: bump moq-noq to 1.3.3 for RUSTSEC-2026-0185

[kixelated]

Bumps the noq stack on main from 1.3.2 to 1.3.3 (moq-noq-proto, moq-noq-udp, web-transport-moq pins; only those four crates plus moq-noq move in Cargo.lock).

noq 1.3.3 (moq-dev/noq#26, #21) carries:

• RUSTSEC-2026-0185: the STREAM/CRYPTO assembler bounds buffered chunks at 1024 after compaction and closes the connection past it.
• A fix for compaction dropping unread data on unordered streams (found in review of the backport).
• Serve the certificate fingerprint over HTTP #20: a stream reset before its WebTransport header is reported as the reset, not UnknownSession.

This covers the main pin step of quest/m0/noq-reassembly-cap.md; the finite receive-window default stays with #4605.

Public API: none. Wire: none. just check passes.

🤖 Generated with Claude Code

[kixelated]

MERGE — reviewed a09e1ae9697aaca3ee11067fae7b41b9c3ead657

Security dep bump of the moq-noq stack on main from 1.3.2 → 1.3.3 (moq-noq-proto, moq-noq-udp, web-transport-moq workspace pins; lockfile also moves moq-noq). Diff is exactly those four packages plus the three Cargo.toml pins — no unrelated churn.

Advisory / version check

• RUSTSEC-2026-0185 is real (DoS via unbounded out-of-order stream/CRYPTO reassembly; CVSS 7.5). Upstream quinn-proto patched ≥0.11.15; moq-noq 1.3.3 carries the matching Assembler chunk cap (1024 after compaction → INTERNAL_ERROR) via moq-dev/noq#26 (merged) / release moq-dev/noq#21 (tag v1.3.3).
• crates.io checksums for moq-noq, moq-noq-proto, moq-noq-udp, and web-transport-moq 1.3.3 match Cargo.lock exactly; none yanked.

Findings: none. Public API unchanged; wire change is only closing peers that exceed the reassembly cap (intended). Finite receive-window default remains with #4605 as noted.

CI: Check / Test / platform jobs still pending at review time — wait for green before merge.

This is an automated review, not the maintainer's decision
(Written by Grok)

[kixelated]

Automated review by review (OpenAI)

Reviewed a09e1ae.

No actionable introduced bugs found. Cargo.toml:154–155,239 raises the three minimum versions coherently, and Cargo.lock:4538,4560,4591,9850 updates exactly the four fork packages. Independently confirming the existing review: all four 1.3.3 checksums match the published, non-yanked registry entries. Features are unchanged; their Rust 1.88 minimum fits the workspace's 1.91 requirement.

Direction is right: ship the released backport through both moq-tokio and moq-uring, without unrelated dependency churn. The upstream source includes the STREAM/CRYPTO cap, unordered-compaction fix, header-reset handling, and close-capsule lifetime fix. The raw-QUIC reset-code change from 2.0.1 is excluded from 1.3.3. This fulfills the fork pin step; the separate upstream noq-proto 1.3.0 used by iroh and the finite receive-window default remain outside this fix.

Verification: static manifest/lock, registry, consumer wiring, and upstream patch review. No local builds or tests run; the author's just check result was not independently reproduced. Exact-head CI was still running.

(Written by review (OpenAI))

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: cc6c12c6-b543-43d6-8af0-5c95534f1b87

📥 Commits

Reviewing files that changed from the base of the PR and between 521dd50 and a09e1ae.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.

---

Walkthrough

The workspace dependency versions for moq-noq-proto, moq-noq-udp, and web-transport-moq changed from 1.3.2 to 1.3.3.

Priority: ⬆️ High

Merge Risk: ⚪ Minimal · up to a09e1

The dependency update includes the reported fixes, and no concrete compatibility issue was found in inspected callers. No actionable merge-blocking risk is established.

Architecture Summary

Architecture risk: 🔵 Low · up to a09e1

The change affects 1 system.

Changed systems: Cargo.toml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — Cargo.toml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in Cargo.toml: The workspace dependency versions for moq-noq-proto and moq-noq-udp changed from 1.3.2 to 1.3.3.
• observed — Modified behavior in Cargo.toml: The web-transport-moq dependency version changed from 1.3.2 to 1.3.3.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency bump to noq 1.3.3 and its security purpose. It matches the main change.
Description check	✅ Passed	The description explains the dependency updates, security fix, related noq changes, validation result, and scope. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kixelated]

Merge summary: bumps the moq-noq stack (moq-noq, moq-noq-proto, moq-noq-udp, web-transport-moq) from 1.3.2 to 1.3.3 for RUSTSEC-2026-0185. Cargo.toml pins and Cargo.lock only; no public API change. All CI green on a09e1ae. Three automated reviews (Grok, OpenAI, CodeRabbit) found nothing actionable; maintainer approved. Out of scope follow-ups already tracked: the upstream noq-proto used by iroh, and the finite receive-window default (#4605).

(Written by Claude Opus 5.5)