Claude finished @tylerhawkes's task —— View job

PR Review Complete ✓

Review Date: July 17, 2026 08:21 UTC

Summary

This is a critical security patch that correctly bumps the openmls fork dependency from e125674 to 2c8d8aec to close a dictionary immutability bypass vulnerability. The changes are minimal, focused, and appropriate.

Changes Reviewed

The PR updates the openmls git rev across:

• Cargo.toml (5 openmls packages): Cargo.toml:88-98
• crates/xmtp-workspace-hack/Cargo.toml (5 openmls packages × 2 sections): crates/xmtp-workspace-hack/Cargo.toml:65-69, 157-161
• Cargo.lock (7 openmls packages): all refs updated to new commit

Review Findings

✅ Code Quality

• Dependency bump is consistent across all openmls packages (openmls, openmls_basic_credential, openmls_libcrux_crypto, openmls_rust_crypto, openmls_traits, openmls_memory_storage, openmls_test)
• No version number changes, only git rev update (appropriate for fork workflow)
• hakari workspace-hack correctly regenerated with matching revs in both [dependencies] and [build-dependencies] sections

✅ Security

• Addresses high-severity bypass: any member could manipulate app_data_dictionary via bare GroupContextExtensions proposals on migrated groups
• Attack vector closed: fraudulent COMPONENT_REGISTRY poisoning, protocol version manipulation, and metadata corruption
• Fix aligns with MLS draft §4.7-6 compliance
• Upstream PR referenced: Enforce app_data_dictionary immutability for bare GroupContextExtensions proposals openmls/openmls#2125

✅ Test Coverage

• libxmtp has extensive app_data validation tests in crates/xmtp_mls/src/groups/tests/test_validate_app_data_update.rs:1
• Per PR description, openmls includes regression test test_group_context_update_dictionary_without_app_data_update
• All 108 existing openmls app_data_update_proposal_validation tests pass

⚠️ Process Note

• Before v1.11 release: The tyler/gce-dict-immutability branch pin must be merged to the canonical insipx/bincode-fixes branch and the pin updated. The PR correctly notes this but there's no tracking issue/todo referenced to ensure this happens before the release cut.

Recommendation

Approve with action item: Create a pre-release checklist item to re-point the openmls pin from tyler/gce-dict-immutability to insipx/bincode-fixes after the commit is merged into the canonical branch. Otherwise, v1.11 would ship with a personal branch dependency.

Approvability

Verdict: Approved

This is a mechanical dependency version bump updating openmls git revisions to pull in an upstream security fix. No code changes in this repository, and the author owns all modified Cargo.toml files.

^{You can customize Macroscope's approvability policy. Learn more.}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.55%. Comparing base (089279c) to head (3e87b77).
⚠️ Report is 1 commits behind head on main.

@@            Coverage Diff             @@
##             main    #3872      +/-   ##
==========================================
+ Coverage   85.48%   85.55%   +0.07%     
==========================================
  Files         415      415              
  Lines       66906    66927      +21     
==========================================
+ Hits        57193    57262      +69     
+ Misses       9713     9665      -48     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.