QRL Weekly, 2026-November-13

Weekly Development Snapshot

Status

• September 18th: QRL Release Verifier audit complete
• September 11th: Ledger app audit and remediation complete
• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 released
• Audits & Remediation: 70%

QRL 2.0 Testnet V3 remaining checklist:

• [80%] Config parameters
• [85%] Testnet V2 scoped internal audits (goqrl, qrysm remaining)
• [60%] QRL v1.0 -> v2.0 migration testing
• Note: No ETA, but watch this space, things are getting close.

QRL v2.0

Hyperion

• Multiple audit/fix PRs + Hyperion 0.3.1 released
• Continued compiler audit remediation: parser/nesting robustness, struct getters and array clearing, storage-slot width constrained below 2^256, plus substantial compiler correctness work.

QRVMone

• Major VM/state-test alignment: storage keys constrained to 32 bytes like go-qrl
• normalised storage-key JSON decoding
• CREATE2/trie/transaction encoding aligned with go-qrl
• runner added
• t8n allocation (transition allocation) handling corrected and docs substantially rewritten.
• Released QRVMone 0.13.0.

hypc-js

• Significant runtime/CLI hardening, including restricted import directories, safer callbacks/SMT handling, compiler recovery and linker work.
• Updated to Hyperion v0.3.1, followed by an npm-publish fix.

hypc-bin

• Hyperion v0.3.1 binary release merged
• Added the Hyperion 0.3.1 compiler binary and release metadata, completing the compiler release chain across Hyperion, hypc-bin and hypc-js.

ledger-app-qrl-v2

• Updated dependencies/CI, corrected the P2 range for requesting signature chunks, adjusted coverage behaviour and prevented incompatible pycryptodome 4.x Dependabot upgrades.

qrypto.js

• Consolidated dependency maintenance, updated globals/Rollup and related tooling, tidied minimatch handling and updated Zizmor CI tooling.

wallet.js

• Dependency and CI maintenance plus an .mjs build asset and Zizmor/tooling updates.

js-qrl-cryptography

• Consolidated dependency/CI updates and pinned monocart-coverage-reports for compatibility with c8.

qrlft

• Updated the go-qrllib dependency used by the file-signing tooling.

rust-qrllib

• Applied pending Rust/demo dependency and CI-action updates.

QRL v1.0

QRL node

• Security backport merged
• Hardening for the wallet API and OTS queries into QRL v1.

Ledger-QRL-JS

• Added device-free and Speculos emulator tests, CI and dependency updates, substantially improving Ledger integration testing without requiring physical hardware.

block-explorer

• Upgraded to Meteor 3.6 and Node 26, added Playwright smoke tests and Actions linting, pinned the Playwright image, fixed smoke CI and Windows bundle preparation, and updated dependencies.

qrl-cli

• Dependency consolidation covering moment, @grpc/grpc-js, brace-expansion, handlebars, fast-uri and undici.

webtools

• Tightened the Node engine range, updated the ML-DSA signing-action pin, and refreshed Vue/Tailwind/Vite and CI dependencies.

qrl-wallet

• Electron / undici / fast-uri maintenance.

offline-wallet-generator

• Dependency and CI maintenance, including grouped dev-dependency and Zizmor updates.

api.theqrl.org

• Updated dependencies and README documentation.

dice

• Development dependency fixes including serialize-javascript and fast-uri.