[neekolas]

Malformed hybrid keys and short encapsulation seeds can panic in libcrux-kem 0.0.9. Upgrade both HPKE provider chains to libcrux-kem 0.0.10 and regenerate the lockfile and workspace-hack dependencies. The resolved graph contains no KEM 0.0.9.

Keep HPKE 0.6.1 for the Welcome wrapper and HPKE 0.7.0 for OpenMLS. Keep the existing XWing 0x004D codepoint and public SDK APIs. The direct ECDH, HKDF, and AEAD provider dependencies retain their prior versions; the patched KEM brings its required newer dependencies.

Provider changes:

• fix: upgrade legacy HPKE provider to libcrux-kem 0.0.10 hpke-rs#2
• fix(hpke): update 0.7 provider to libcrux-kem 0.0.10 libcrux#1

Both provider PRs are merged. The pins use their immutable merge commits. The libcrux merge also fixes an unused package manifest that named a missing README; both complete Nix source-vendor derivations pass locally.

This replaces the two KEM exceptions proposed in #4464. The separate RUSTSEC-2026-0329 HMAC-DRBG exception remains because the pinned OpenMLS provider still requires its old version. No KEM advisory exception is added.

Validation:

• CI is green at 97862fa5fa: 46 checks pass, 0 fail, 12 are skipped, and none are running. This includes the full WASM test job.
• All 958 xmtp_mls_common tests pass, including three new tests with persisted old XWing keys and Welcome ciphertexts. All three new tests also pass under the WASM test runner.
• An isolated old/new legacy-provider harness produces identical keys, encapsulation bytes, Welcome ciphertext, and metadata ciphertext with fixed randomness. Each provider decrypts the other provider's output. The fixture source and reproduction steps are committed. Nix includes the fixture files in its filtered test source; all four bytestrings were checked against the committed files.
• The 0.7 provider passes old/new interoperability in both directions for X25519, P-256, and XWing, including encoded and restored keys.
• Provider known-answer suites pass. Malformed-input regressions reproduce panics with 0.0.9 and pass with 0.0.10. Negative controls confirm the new tests fail when the checked behavior is broken.
• Native, WASM, iOS (aarch64-apple-ios), and Android API 23 (aarch64-linux-android) Rust SDK checks pass. CI also passes iOS tests, Android SDK staging, Swift seam and consumer tests, the SDK façade tests, all Node/browser shards, and agent SDK tests.
• Identity key-package tests and all 13 cryptography tests pass.
• Full just lint and all four Cargo-Deny checks pass locally.
• Independent review is complete. The fork fuzz and no-std checks also pass after correcting their trait sources.

The direct KEM entropy-failure test covers the new fallible RNG API. Provider construction still uses its existing OS-seeded ChaCha20 generator; this change does not alter that behavior.

The SDK façade CI job now uses shallow checkout. Its commands use the current source and index. Full-history fetch failed with a connection reset and stalled again on retry. Config lint and workflow fixtures pass.

The docs checkout keeps full commit history with filter: blob:none. A real partial clone preserves the last-change commit and timestamp for all 64 docs files. Config lint and workflow fixtures pass. This avoids fetching old file contents after repeated checkout failures.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR updates production HPKE/libcrux implementations, affecting key generation and Welcome encryption/decryption compatibility. Existing tests cover legacy ciphertext opening and upgraded-provider round trips, but reverse interoperability with the old provider is only documented in an external harness rather than enforced in CI, so the cryptographic wire-compatibility change needs human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

[P1] Keep reverse legacy interoperability covered in CI

This only round-trips ciphertext with the upgraded provider, so it passes even if a new XWing encapsulation can no longer be opened by clients still on libcrux-kem 0.0.9. Those clients must decrypt Welcomes sent under their persisted keys. Please retain an automated reverse-direction compatibility check (for example, a known-answer output validated by the old provider); the documented standalone harness is not run in CI.

^{Posted via Macroscope — Code Quality}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.86%. Comparing base (ff6109b) to head (97862fa).

Additional details and impacted files

@@             Coverage Diff              @@
##           self-hosted    #4465   +/-   ##
============================================
  Coverage        87.86%   87.86%           
============================================
  Files              539      539           
  Lines           102659   102698   +39     
============================================
+ Hits             90201    90237   +36     
- Misses           12458    12461    +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.