[kixelated]

Problem

release still has two security bugs fixed on main. On WebTransport and WebSocket, a SETUP Path can override the request URI (moq-dev/moq#7206). Persisted iroh keys are written readable by everyone (moq-dev/moq#7213). This PR holds the claim on quest/m0/backport-security-fixes.md.

Approach

Like earlier backports, the code lands in a separate PR against release: moq-dev/moq#7389. It ports both fixes with their tests, passes just ci check/just ci test against origin/release, and changes no published API. Codex's local review reported no findings. Its body lists the choices made without asking. The main one: an empty SETUP Path is still accepted on URI bindings, since refusing it would need new moq-net API.

This PR only records #7389 (now merged) in the quest's Plan. After the patch release publishes, it should delete the quest and its m0 link, as moq-dev/moq#6958 did.

Decisions needed

1. Merge moq-dev/moq#7389 into release. Settled 2026-10-30: the maintainer approved it, and it merged into release with no version bump and no release cut.
2. Patch release (deferred). The maintainer decided on 2026-10-30 to ship one combined patch release later. It comes after moq-dev/moq#7298 and the dot-segment/auth-redirect backport land on release. The maintainer picks versions by hand at that cut. Nothing to decide here until then.
   Combined cut contents (maintainer, 2026-10-30):
   • moq-dev/moq#7389: SETUP-path and iroh-key fixes (merged).
   • moq-dev/moq#7290: audio groupDuration, shipping as @moq/publish 0.5.5 (landing).
   • moq-dev/moq#7298: outbound HTTP trust isolation.
   • The dot-segment and auth-redirect backport, quest/m0/backport-release-hardening.md from moq-dev/moq#7406.
   • Python moq-rs 0.5.2 and Dart moq 0.1.1 (moq-dev/moq#6634). Python publishes through the moq-ffi-v0.4.20 tag once moq-dev/moq#7421 is on release. The moq-dart-v0.1.1 tag is pushed during the cut.

After that combined release publishes, rerun /quest-iterate here to delete the quest and mark this PR ready.

Impact

• Public API and wire: none in this PR (quest file only).

Validation

quest check --base origin/main passes.

Review

Skipped: this PR changes only the quest Plan text. The code change is reviewed in moq-dev/moq#7389.

Follow-ups

• moq-dev/moq#7366 (refuse dot-segment SETUP paths) is still open on main and is not in this quest's Plan. Once it merges, consider a release backport through /quest-plan.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[kixelated]

Closing as done elsewhere: both security fixes reached release in #7389 and shipped in moq-tokio 0.19.32 on 2026-11-03. The m0 quest audit deletes quest/m0/backport-security-fixes.md.

(Written by Claude Opus 5.5)