# QRL Weekly, 2026-October-16

> For the complete documentation index, see [llms.txt](/llms.txt). This markdown page mirrors [the canonical HTML page](/weekly/2026-october-16/).





Published: 2026-10-16
Updated: 2026-10-16



Author: The QRL Core Contributors
















Weekly Development Snapshot Status September 18th: QRL Release Verifier audit complete September 11th: Ledger app audit and remediation complete August 4th: Audit results published for go-qrllib April 3rd: Audit complete of 2 cryptographic libraries March 31st: QRL 2.0 Testnet V2 released Audits & Remediation: 60% QRL 2.0 Testnet V3 remaining checklist:
[80%] Config parameters [70%] Testnet V2 scoped internal audits (goqrl, qrysm remaining) [40%] QRL v1.0 -> v2.0 migration testing (added) Note: No ETA, but watch this space, things are getting close. QRL v2.0 rust-qrllib
Added a Falcon-1024 signature primitive in Rust with ACVP signature verification, added ML-DSA sigVer to CI, enabled SHAKE zeroization, expanded Rustdoc, and released v0.1.6. Subsequent CI/dependency work restricted Codecov uploads appropriately and refreshed Vite/setup-node. go-qrllib
Follow-up Falcon testing fixed the zero-padding test so signatures are regenerated until sufficient padding space exists. CI also received an SBOM action update. qrypto.js
Updated nine dependencies plus Turbo and the Anchore SBOM action, keeping the JavaScript crypto stack and CI/tooling current. go-qrl
regenerate stale gencodec output fix: count new-account password attempts from 1 accounts/abi/bind/backends: price calls with the executing block’s base fee Update tests Ported upstream fixes Removed unused code, comment & deprecated APIs Name related fixes Migration code currently being implemented qrysm
fix(slasher): report double votes found before a span-loading failure fix(slasher,db,node): keep slasher progress atomic and evidence intact, validate the archive interval fix(db,stategen,blockchain,slasher): persist migration progress, make restore and deletes safe, verify checkpoint identity fix(db,stategen,slasher): persist the migration cursor, make restore replace-safe, migrate slasher record keys QRL v1.0 -> v2.0 Migration QRL v1 archive
Archive work moved from scaffolding into implementation and large-scale rehearsal. Added a qrl-archive CLI for exact-byte block export and structural verification, pinned protobuf schema/binding/descriptor digests with mainnet API fixtures, ran a 1,620,000-block testnet rehearsal, and added native-node recovery work. QRL v1 archive explorer
Integrated the 1,620,000-block rehearsal into the explorer work and added the archive shard format, advancing the read-only explorer from placeholder/rehearsal UI toward consuming the actual archive structure. QRL v1.0 qrl-wallet
Significant wallet maintenance around the Meteor 3 branch: upgraded to qrllib 1.3.2 and synchronised WASM assets, pinned dependencies and bumped the wallet to 1.9.2, improved malformed wallet-file error handling, added the ability to re-download a wallet JSON from the recovery tool, fixed CRLF/LF handling for web-libjsqrl.js, and disabled passphrase input while wallet generation is running. integration_tests
Modernised the QRL v1 integration-test infrastructure: updated qrllib, upgraded CircleCI config to 2.1, aligned master CI with the bionic-old image, increased Fastnet block-addition timeouts and stopped running tests_fastnet_long on master where it already runs against noble-work-in-progress. qrllib
Restored the v1.2.4 address-validity behaviour in addressIsValid, preventing newer descriptor hardening from changing legacy QRL v1 validity semantics. Also improved release reliability by making npm/PyPI publishing idempotent and allowing more time for post-publish verification. QRL node
Pinned the address-validity rule directly into QRL and upgraded pyqrllib to 1.3.2, ensuring the legacy node retains expected v1 mainnet address behaviour independently of library changes. webtools
Development dependencies and actions/setup-node were updated. Misc qrlft
Hardened file signing/verification semantics: verify now checks every supplied path, while both signing and verification read the entire file contents rather than risking partial processing. The change touched 8 files with 483 additions / 33 deletions. actions-MLDSA-sign
Updated the GitHub Action to use the newer qrlft release and Go 1.25, then refreshed the action definition and README. This keeps the reusable ML-DSA signing workflow aligned with the hardened qrlft behaviour.