[moq-bot]

🤖 New release

• moq-net: 0.3.16 -> 0.3.17 (✓ API compatible changes)
• hang: 0.21.17 -> 0.21.18 (✓ API compatible changes)
• moq-mux: 0.10.17 -> 0.10.18 (✓ API compatible changes)
• moq-tokio: 0.19.29 -> 0.19.30 (✓ API compatible changes)
• moq-boy: 0.5.18 -> 0.5.19
• moq-hls: 0.5.17 -> 0.5.18 (✓ API compatible changes)
• moq-relay: 0.17.8 -> 0.17.9 (✓ API compatible changes)
• moq-cli: 0.14.8 -> 0.14.9
• moq-ffi: 0.4.18 -> 0.4.19
• moq-json: 0.5.14 -> 0.5.15
• moq-binary: 0.1.16 -> 0.1.17
• moq-loc: 0.2.25 -> 0.2.26
• moq-audio: 0.1.16 -> 0.1.17
• moq-video: 0.1.16 -> 0.1.17
• libmoq: 0.6.18 -> 0.6.19
• moq-archive: 0.0.17 -> 0.0.18
• moq-uring: 0.0.18 -> 0.0.19
• moq-stats: 0.2.18 -> 0.2.19
• moq-rtc: 0.3.18 -> 0.3.19
• moq-rtmp: 0.3.17 -> 0.3.18
• moq-srt: 0.3.17 -> 0.3.18
• moq-transcode: 0.1.16 -> 0.1.17
• moq-e2ee: 0.0.17 -> 0.0.18
• moq-gst: 0.4.18 -> 0.4.19
• moq-room: 0.2.17 -> 0.2.18

Changelog

moq-net

0.3.17 - 2026-10-28

Fixed

• (net) a restarted publisher wins over its lingering session on release

hang

0.21.18 - 2026-10-28

Fixed

• (moq-mux) send the H.265 picture aspect, not the pixel aspect (backport fix(moq-mux): send the H.265 picture aspect, not the pixel aspect #5574)

moq-mux

0.10.18 - 2026-10-28

Fixed

• (mux) backport malformed container import checks
• (moq-mux) send the H.265 picture aspect, not the pixel aspect (backport fix(moq-mux): send the H.265 picture aspect, not the pixel aspect #5574)

Fixed

• Refuse malformed MKV hierarchy, incomplete elements, zero timestamp scales, duplicate or zero track numbers, and block timestamp overflow.
• MKV audio/video tracks and FLV tags with unsupported codecs now fail the import instead of being silently dropped. Transcode or remove unsupported tracks before importing.
• Preserve VP9 keyframe dimensions up to 65536 instead of wrapping them to zero.

moq-tokio

0.19.30 - 2026-10-28

Fixed

• (moq-tokio) grant qmux sessions the QUIC stream limit

moq-boy

0.5.19 - 2026-10-28

Other

• update Cargo.lock dependencies

moq-hls

0.5.18 - 2026-10-28

Fixed

• (hls) hold import resources and redirects to the playlist origin (backport fix(hls)!: hold import resources and redirects to the playlist origin #6374)

moq-relay

0.17.9 - 2026-10-28

Other

• update Cargo.toml dependencies

moq-cli

0.14.9 - 2026-10-28

Other

• update Cargo.lock dependencies

moq-ffi

0.4.19 - 2026-10-28

Added

• (ffi) add an async MoqSession.drain()

Other

• share default FFI artifacts across Go, Kotlin and Swift (#5549)
• Merge pull request feat(ffi): backport draining shutdown as drain() and the qmux stream limit to release #6642 from moq-dev/fix/release-ffi-drain
• (ffi) say IETF sessions close without draining on release

moq-json

0.5.15 - 2026-10-28

Other

• updated the following local packages: moq-net

moq-binary

0.1.17 - 2026-10-28

Other

• updated the following local packages: moq-net

moq-loc

0.2.26 - 2026-10-28

Other

• updated the following local packages: moq-net

moq-audio

0.1.17 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux

moq-video

0.1.17 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux

libmoq

0.6.19 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux, moq-tokio, moq-json, moq-audio, moq-video

moq-archive

0.0.18 - 2026-10-28

Other

• updated the following local packages: moq-net

moq-uring

0.0.19 - 2026-10-28

Other

• updated the following local packages: moq-net

moq-stats

0.2.19 - 2026-10-28

Other

• updated the following local packages: moq-net, moq-json

moq-rtc

0.3.19 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux, moq-tokio

moq-rtmp

0.3.18 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux

moq-srt

0.3.18 - 2026-10-28

Other

• updated the following local packages: moq-net, moq-mux

moq-transcode

0.1.17 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux, moq-video

moq-e2ee

0.0.18 - 2026-10-28

Other

• updated the following local packages: moq-net

moq-gst

0.4.19 - 2026-10-28

Other

• updated the following local packages: moq-net, hang, moq-mux, moq-tokio

moq-room

0.2.18 - 2026-10-28

Other

• updated the following local packages: moq-net, moq-json

---

This PR was generated with release-plz.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T05:20:58.175925Z	1091a7e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: c666ee1

No actionable bugs found in release metadata changes. The 25 crate version bumps agree with workspace requirements and lockfile; the transitive lockfile refresh has no dangling package references. Keeping this PR limited to generated release metadata is sensible.

Verification: static changes against release, manifests, changelog entries and lockfile only. No builds, tests, platform-specific dependency validation or publication dry-run; already-merged source changes were not re-reviewed.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 30fd9d4

No actionable bugs found in this update. Compared with my last published review at c666ee1, separating the advanced release base from generated changes: the meaningful new changes are eight transitive dependency upgrades (crypto-bigint, ctutils, der, notify-types, openssl-probe, ordered-float, rustix and unicode-width). The 25 crate versions remain consistent with workspace requirements and the lockfile, whose package references resolve internally. There were no earlier findings to carry forward.

Keeping the release PR confined to manifests, lockfile and changelogs remains a sensible direction. Verification was static only: no builds, tests, platform/MSRV validation, dependency-source audit or publication dry-run; already-merged base changes were not re-reviewed.

[kixelated]

Landing summary for head 30fd9d450bd380f8cac77d97d44b42976ba16878:

• Base check: this head was generated on top of 11dbdb5ab (fix(mux): backport malformed container import checks #6974). The later release merges (fix(flate): stop oversized release frames during inflation #6961, fix(net): close IETF peer violations with their error code #6959, fix(net): refuse partial lite groups on release #6967) touch only js/, so Release RS correctly did not re-run and release-plz has nothing to add for them. The Rust crate bumps here are current.
• The earlier BLOCKED state came from the Release gate: run 40629351028 was cancelled by the gate's own cancel-in-progress concurrency; sibling run 40629352812 on the same head passed. Required Check and Release gate pass; merge state is clean.
• Review: the OpenAI review of this head found no issues.
• quest check against origin/release passes.

(Written by Claude Opus 5.5)