QRL Weekly, 2026-October-30

Weekly Development Snapshot

Status

• September 18th: QRL Release Verifier audit complete
• September 11th: Ledger app audit and remediation complete
• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 released
• Audits & Remediation: 60%

QRL 2.0 Testnet V3 remaining checklist:

• [80%] Config parameters
• [80%] Testnet V2 scoped internal audits (goqrl, qrysm remaining)
• [50%] QRL v1.0 -> v2.0 migration testing
• Note: No ETA, but watch this space, things are getting close.

QRL v2.0

Hyperion

• Continued heavy compiler hardening following v0.2.0 / audit remediations
• Fixed Yul KnowledgeBase variable versioning so reassignment cannot leave stale offsets
• Corrected deletion of individual memory-byte elements; widened the bytecode regression corpus
• Prevented PyPI contamination of release builds
• Hardened release/tag verification
• Improved current macOS toolchain support and Windows verifier testing;
• Updated dependency tooling and documentation.

web3.js (active cyyber fork work)

• Large multi-pass audit/remediation effort across subscriptions, event filters, transports, RPC validation, receipts, ABI/raw-transaction handling and package-install policy.
• Added stricter response/nesting bounds, subscription buffering/delivery fixes, receipt/log identity checks and diagnostics
• Hardened QRNS registry-address handling
• Documented VM64 breaking changes
• Added a pinned two-CPU execution testnet launcher.

Latch

• Latch went public this week as the new QRL v2 offline-signing application.
• The shared PWA/iOS/Android design supports offline wallet creation/import, reviewed transaction signing, QR/file transaction exchange, encrypted vault/wallet backups and offline-install/storage checks.
• Team preview for internal testing at latch.theqrl.org

QRVMone

• Updated the QRVMC submodule, moved to QRVMC byte types, rejected invalid/out-of-range revisions, updated changelog/release metadata and fixed the Hunter/CMake 4 compatibility gate.
• This work also feeds directly into Hyperion’s compiler/test matrix.

QRVMC

• Replaced problematic std::char_traits<uint8_t> aliases with explicit byte_traits and released QRVMC 3.0.0, providing the byte types consumed by QRVMone.

hypc-js

• Hardened the JavaScript Hyperion distribution pipeline: added npm trusted publishing, required release tags to resolve to commits on main, refreshed GitHub Actions and vulnerable dependencies, and added CODEOWNERS.

hypc-bin

• Added compiler-binary verification workflows and release tooling, upgraded CI actions including Zizmor/setup-node, and added CODEOWNERS.

go-QRL

• Continued QRL 2 execution-client convergence: made genesis-era fields mandatory, converted WithdrawalsHash to a value, improved pending-block decoding and qrlclient behaviour, and switched API/GraphQL/statistics code to SyncProgress.Done for completion checks.

Qrysm

• Updated the consensus-client build against the corresponding go-qrl required-fields work (go-qrl#288), keeping Qrysm aligned with execution-layer API changes.

QRL v1.0

Zeus-Proxy

• Improved automatic reconnection to QRL nodes when upstream connections drop, improving proxy resilience for v1 node/API users.