Issues

• Low: security hardening batch — client-side size caps, unbounded decompressor/client state, stale SECURITY.md, deny.toml yanked policy

  infrastructureP3security
  bug-ops/pjs#551 · Filter by author bug-ops opened on Sep 30, 2026
  1

• Medium: GitHub Actions pinned to mutable tags/branches, including the OIDC publish jobs in release.yml

  ci/cdgithub-actionsP2security
  bug-ops/pjs#550 · Filter by author bug-ops opened on Sep 30, 2026

• Config validate() is opt-in: no consumer calls it, so MAX_SAFE_JSON_DEPTH and other invariants are unenforced

  architecturecoreP2securitytype-safety
  bug-ops/pjs#549 · Filter by author bug-ops opened on Sep 30, 2026

• Twelve hand-copied private serde helper modules for Priority/SessionId/StreamId across six files; domain serialization policy has drifted

  architecturedomainP3refactor
  bug-ops/pjs#548 · Filter by author bug-ops opened on Sep 30, 2026

• stream::StreamConfig carries dead fields (enable_compression, priority_threshold: u8) and ProcessResult::Complete is never produced

  architecturecoreP3refactortype-safety
  bug-ops/pjs#547 · Filter by author bug-ops opened on Sep 30, 2026

• Cargo.lock pins yanked chacha20 0.10.1 (cargo deny warning)

  dependenciesP3security
  bug-ops/pjs#545 · Filter by author bug-ops opened on Sep 30, 2026

• StreamFormat::from_accept_header rustdoc overclaims wildcard always votes for Json

  documentationinfrastructureP3
  bug-ops/pjs#529 · Filter by author bug-ops opened on Aug 19, 2026

• WebSocketRateLimiter name no longer matches its scope — reused by HTTP middleware and accept-level connection limiting

  architectureinfrastructureP4refactorsecurity
  bug-ops/pjs#528 · Filter by author bug-ops opened on Aug 19, 2026