QRL Weekly, 2026-November-06
6th November 2026
Weekly Development Snapshot
Status
- September 18th: QRL Release Verifier audit complete
- September 11th: Ledger app audit and remediation complete
- August 4th: Audit results published for go-qrllib
- April 3rd: Audit complete of 2 cryptographic libraries
- March 31st: QRL 2.0 Testnet V2 released
- Audits & Remediation: 65%
QRL 2.0 Testnet V3 remaining checklist:
- [80%] Config parameters
- [80%] Testnet V2 scoped internal audits (goqrl, qrysm remaining)
- [60%] QRL v1.0 -> v2.0 migration testing
- Note: No ETA, but watch this space, things are getting close.
QRL 2.0
Hyperion
- Fixed 512-bit integer aliases and word-sized operations, Panic(uint512) handling, CREATE/CREATE2 address derivation, full 64-byte log topics, unsigned u256 ABI zero-extension, legacy function pointers, call-option/value/balance widths, addmod/mulmod, storage/recursion/returndata bugs, and Yul stack-too-deep diagnostics with proper source locations.
- Also hardened Emscripten builds, tracked hypc-js as a submodule, produced a universal macOS binary, strengthened regression/differential tests, and formalised review of upstream Solidity bug advisories.
hypc-js
- Significant wrapper/runtime hardening: restricted CLI imports to allowed directories; hardened compiler recovery, remote loading, CLI and linker behaviour; validated callbacks before copying Standard JSON input; improved error handling for callback failures, SMT errors and oversized solver output; upgraded to ESLint 10, TypeScript 6 and Node 22; removed memorystream; and pinned attestation verification to the signing workflow.
web3.js
- Landed the prior audit/remediation work upstream, including dependency/security clean-up and subscription timing fixes.
- Release infrastructure gained a reattest mode for already-published versions, fixed SBOM output handling, and a breaking-change/version-bump trigger.
hypc-bin
- Tightened compiler-binary provenance by pinning attestation verification to Hyperion’s release workflow, documenting the required gh CLI version, and updating Zizmor CI tooling.
rust-qrllib
- Applied pending dependency and CI-action updates, including cargo-deny, crates.io auth, Rust cache and Vite.
Latch
- Added social/Open Graph metadata and aligned the QR-frame timing specification.
6th November 2026
