44 posts
OxiText 0.2.3 fixes a font-fallback bug where a single `.notdef` hit could re-point every already-shaped glyph in a run to the wrong font's glyph table — invisible whenever two fonts share glyph-id numbering. Adds a script-tag introspection API. 851 tests passing. The sovereign Pure Rust text layer for COOLJAPAN.
OxiHTTP 0.2.1 is a security-hardening release for the COOLJAPAN Pure-Rust HTTP stack: it closes a redirect credential leak, two WebSocket unbounded-memory DoS paths, a chunked-encoding body-limit bypass, a spoofable rate-limiter key, a client decompression bomb, and more — 320 tests passing (446 with all features), the sovereign HTTP layer for the COOLJAPAN ecosystem.
OxiRPC 0.2.1 adds a 100% Pure-Rust HTTP/3 (gRPC-over-QUIC) transport behind the opt-in http3 feature, closes a bug where a missing grpc-status trailer could look like a successful empty stream, adds a frame-size overflow guard, and validates gRPC Content-Type on every native transport path — 702 tests passing (801 with all features), the sovereign gRPC layer for the COOLJAPAN ecosystem.
OxiSQL 0.4.1 ships oxisql-cache — a first-publish crate that inverts a former oxisql⇄oxistore dependency cycle — plus CREATE TRIGGER/row-trigger execution, TEMP objects and ATTACH/DETACH DATABASE multi-database support, PRAGMA index_list/index_info, fuzz targets, and quickstart examples for every driver. Six process-abort and undefined-behavior fixes land in the C-free oxisqlite engine. Part of the NoFFI sovereign Rust stack.
OxiStore 0.3.0 is a minor release that structurally severs the oxistore ⇄ oxisql circular dependency, adds EnvelopeTxn/EnvelopeSnapshot for encrypted stores, ships a PKCS#11 HSM-backed KeyProvider, and fixes S3/Azure key percent-encoding bugs. Part of the NoFFI sovereign Rust stack — zero *-sys crates on default features.
OxiAudio 0.2.1 is a deep Opus conformance-hardening release: the CELT frame-size ceiling is raised from 80 bytes (~32 kbps) to the RFC's real 1275-byte limit (510 kbps mono) by fixing a celt_bits2pulses/celt_pulses2bits partition-scale clamp bug, CBR frames stop silently shrinking, hybrid packets are now entropy-exact, and encode_opus is RFC 6716-conformant by default. Pure Rust audio codec + DSP layer for the COOLJAPAN ecosystem.
OxiCrypto 0.3.0 completes the FIPS 205 SLH-DSA parameter-set matrix (all 12 of 12), ships a new negotiate_aead TLS 1.3 cipher-suite resolver alongside negotiate_mac/negotiate_sig/negotiate_kex, adds coverage-guided fuzzing across AEAD/MAC/PQ/KDF, gives every sub-crate a runnable example, and fixes a byte/char-boundary panic-DoS in bcrypt verification — the sovereign Pure Rust cryptography layer for the COOLJAPAN ecosystem.
OxiFont 0.2.2 ships oxifont-subset::instance() for pinning a variable font to one design location, a drop_variations subset option, TrueType Collection (.ttc) face-index support that unlocks stock Windows CJK fonts like msgothic.ttc, a public SubsetGidMap for PDF CIDFont embedding, and full GSUB/GPOS contextual-lookup remapping — the sovereign Pure Rust font layer for the COOLJAPAN ecosystem.
OxiH5 0.2.3 closes six writer roadmap gaps — compound records, vlen sequences, array/opaque/bitfield types, big-endian/half-precision floats, soft/external/hard links — makes extensible-array chunk indexes readable, fixes five crash/OOM classes. 987 tests passing — COOLJAPAN's sovereign scientific-data layer.
OxiNum 0.1.4 closes an unbounded-allocation class across add/sub, remainder, and binary-splitting transcendentals — a legitimately valid but extreme BigFloat exponent could previously drive memory proportional to the exponent gap, aborting the process. New MAX_EXACT_CONVERSION_BITS-guarded try_* fallible APIs, an enforced BigFloat exponent range (EMAX/EMIN, ilogb), a fixed IEEE-754 subnormal-rounding double-rounding bug, and a Rem correctness fix. Pure Rust, no GMP, no MPFR, no FFI.
OxiProto 0.1.5 ships Editions 2023 support end to end: full feature resolution (field_presence, enum_type, repeated_field_encoding, utf8_validation, message_encoding, json_format), enforcement at decode time, and a downlevel-to-proto2 rewrite so the prost-reflect facade — which panics trying to even format the 'unknown syntax editions' error — can handle Editions files at all. Plus a wrong-buffer bug in generated packed-repeated decode, a proto2 packing default that diverged from protoc, and two new nesting-depth DoS bounds. Pure Rust Protocol Buffers, no protoc required.
OxiQUIC 0.2.1 closes five RFC 9000 security gaps — spoofed-source reflection amplification, unbounded per-stream and CRYPTO-buffer memory growth, and a forgeable Retry handshake — adds bidirectional ECN (RFC 9000 §13.4 / RFC 9002 §7.4) and true per-path congestion control for multipath, and ships runnable QUIC/HTTP-3 examples. 445 tests passing, the sovereign Pure Rust QUIC layer for the COOLJAPAN ecosystem.
OxiSound 0.2.1 ships oxisound-pulse — a brand-new, 100% Pure Rust PulseAudio/PipeWire native-protocol backend with zero C in its Linux audio path — plus three denial-of-service fixes in oxisound-osc's untrusted-UDP decode path (an out-of-bounds read, unbounded nesting, and a 32-bit integer wraparound), a new fuzz workspace, and a stream_stats() correctness fix. The sovereign audio device I/O layer for the COOLJAPAN ecosystem.
OxiText 0.2.2 vendors its own fork of swash to fix a Devanagari reph-duplication bug and an out-of-bounds panic that has sat open and unfixed upstream since April 2025, adds a Pure-Rust PNG decoder to fully remove the `png`/`flate2` dependency chain, and fixes color-glyph misdetection for sbix/CBDT/SVG fonts — 845 tests passing, the sovereign text layer for the COOLJAPAN ecosystem.
OxiTLS 0.3.0 fixes an OCSP staple false-rejection on leaf-only certificate chains, converts an HPKE LabeledExpand panic into a propagated Result, and adds three new fuzz targets covering its own hand-rolled TLS parsers — 364 tests passing, the sovereign Pure Rust TLS layer for the COOLJAPAN ecosystem.
OxiUI 0.2.2 wires the facade's multi-window registry and menu bar into a real rendering path for the first time (egui opens real OS viewports, iced/headless render the bar too), makes oxiui-slint and oxiui-dioxus return an honest error instead of a fabricated Ok(()), fixes GPU device-loss/OOM panics in oxiui-compute-wgpu, and restores wasm32 compilation for oxiui-web. 2,024 tests passing, the sovereign Pure Rust GUI layer for the COOLJAPAN ecosystem.
OxiFont 0.2.1 ships oxifont-hinting, a from-scratch Pure Rust TrueType bytecode hinting interpreter (grid-fitting VM) that never panics on hostile input, plus a WOFF2 spec-compliance fix and a closed large-allocation DoS in bundled CJK font resolution. The sovereign font layer for the COOLJAPAN ecosystem.
OxiText 0.2.1 fixes COLRv0/COLRv1 color-glyph rendering — previously 0% pixel coverage on every color emoji — into a complete paint-graph interpreter with gradients, transforms, clips, and all 28 composite modes, swaps in a Pure-Rust PNG encoder to clear the last banned dependency, and cuts font-cache overhead by up to 13,000x. The sovereign text layer for the COOLJAPAN ecosystem.
OxiUI 0.2.1 wires on_close/on_resize/on_focus into the real egui and iced event loops for the first time, makes with_persistent_state actually write to disk via oxicode, and closes an integer-overflow bounds bypass plus an unbounded-iteration DoS in the CPU rasterizer. The sovereign GUI layer for the COOLJAPAN ecosystem.
OxiProto 0.1.4 ships oxiproto-protoc — a protoc-argv-compatible binary letting any prost-build/tonic-build project skip the C++ compiler entirely by pointing PROTOC at pure Rust. This release also closes an unbounded-recursion decode DoS across all three nested-message paths and removes OxiProto's own last internal protoc dependency. Pure Rust, Apache-2.0.
OxiH5 0.2.2 ships a 44-agent interop audit against h5py 3.16 and netCDF4-python 1.7.4, fixing 33 conformance defects and closing 9 writer gaps — shuffle/Fletcher32 pipelines, custom fill values, true netCDF coordinate variables. 862 tests passing — the sovereign scientific-data layer for COOLJAPAN.
OxiH5 0.2.1 adds DEFLATE compression on write, per-chunk tiling, in-place dataset overwrite, and nested groups — and fixes 9 correctness bugs, including a chunk B-tree defect that made every chunked dataset the writer produced unreadable by libhdf5. 682 tests passing — the sovereign scientific-data layer for COOLJAPAN.
OxiCrypto 0.2.1 measures ML-DSA-87's worker-thread stack down to 2 MiB from a hardcoded 8 MiB, ships a default-on alloc feature for genuine no_std core-only builds, adds a PQ-to-AEAD hybrid encryption test, and fixes a truncated-HMAC panic — the sovereign Pure Rust cryptography layer for the COOLJAPAN ecosystem.
OxiH5 0.2.0 adds superblock v1 parsing, v2/v3 superblock-extension decoding (B-tree K values, shared message table, file space info, driver info), and fixes a silent OCHK object-header creation-order misdecode. 494 tests passing across four crates — the sovereign scientific-data layer for the COOLJAPAN ecosystem.
OxiSQL — the COOLJAPAN ecosystem's sovereign Pure-Rust SQL layer and C-free SQLite-compatible engine — ships 0.4.0: every inter-crate dependency floor across all 17 crates is pinned to the exact full-triple 0.4.0, a clean 0.4.x baseline no stale Cargo.lock can break. A packaging bump, no source changes since 0.3.3.
OxiH5 0.1.4, the COOLJAPAN Pure-Rust HDF5 reader, adds Virtual Dataset (VDS) resolution, chunked variable-length dataset reads, szip RAW-mode chunk decoding, and soft-link-to-external-link chains, plus a fix for a silently mis-decoded global-heap reference. 486 tests passing across four crates — the sovereign scientific-data layer for the COOLJAPAN ecosystem.
OxiSQL 0.3.3 makes SQLite views first-class, lets compound SELECTs act as FROM-clause subqueries, adds open_from_bytes for WASI/browser use and PostgreSQL logical replication, and fixes a silent b-tree index-corruption bug — the sovereign Pure Rust SQL layer for the COOLJAPAN ecosystem.
OxiTLS 0.2.1 eliminates RUSTSEC-2026-0104 by forking its Pure-Rust CryptoProvider into a webpki-free oxitls-rustcrypto-provider crate, closes an OCSP staple replay bypass, and fixes SCT parsing — 443 tests passing, the sovereign Pure Rust TLS layer for the COOLJAPAN ecosystem.
OxiSQL 0.3.2 closes the final C-FFI gap in its --all-features dependency closure with a new Pure-Rust zstd-shim replacing zstd-sys (pulled in by DataFusion's Arrow IPC), and fixes a GROUP BY … HAVING COUNT(*) accumulator-reset bug in the oxisqlite-core query engine. The sovereign SQL layer for the COOLJAPAN ecosystem.
OxiSQL is the COOLJAPAN Pure-Rust unified SQL layer: a single async facade over embedded engines, PostgreSQL and MySQL wire clients, and a C-free SQLite-compatible path — replacing libpq, libmysqlclient, libsqlite3, and rusqlite with no FFI. Part of the NoFFI / COOLJAPAN sovereign Rust stack.
OxiHTTP is the COOLJAPAN Pure-Rust HTTP stack: an async client and server for HTTP/1.1, HTTP/2, and HTTP/3 with no curl, no OpenSSL, and no -sys crates. Transport security comes from OxiTLS. A reqwest/hyper-free facade and part of the NoFFI sovereign Rust stack.
OxiRPC is the COOLJAPAN Pure-Rust gRPC stack: tonic-style gRPC over HTTP/2 whose proto codegen, TLS, and compression are 100% Pure Rust. No protoc binary, no OpenSSL, no ring by default — codegen via OxiProto, TLS via OxiTLS, gzip/zstd via OxiARC. Part of the NoFFI sovereign Rust stack.
Meet OxiStore: the COOLJAPAN Pure Rust low-level storage layer — embedded key-value (B-tree + LSM), columnar in-memory & on-disk, and a blob abstraction (local fs + S3/Azure/GCS). Replaces librocksdb-sys, lmdb-sys, and leveldb-sys with zero FFI. Part of the NoFFI sovereign Rust stack.
OxiText is the COOLJAPAN Pure-Rust text pipeline — shaping, UAX #9 bidi reordering, UAX #14 line-breaking, layout, and glyph rasterization. A NoFFI replacement for the HarfBuzz + FriBidi + ICU + FreeType C/C++ stack, pairing with OxiFont. Part of the sovereign Rust stack.
OxiUI is the COOLJAPAN Pure Rust UI layer — no GTK (C), no Qt (C++), no SDL (C), no raw AppKit/Win32/Cocoa bindings. A thin facade over egui and iced, rendered through wgpu or a CPU rasteriser, windowed through winit, with text shaped by OxiText + OxiFont. Part of the NoFFI sovereign Rust stack.
OxiAudio is the COOLJAPAN Pure-Rust audio codec and DSP layer — decode FLAC/WAV/MP3/Vorbis/AAC/ALAC/Opus/WavPack/Musepack/MIDI and encode WAV/RF64/FLAC/AIFF/AU with no FFI, plus a full DSP toolkit (filters, dynamics, reverb, phase vocoder, pitch detection, EBU R128 loudness, MFCC/STFT). A clean, memory-safe alternative to libFLAC, libvorbis, libopus, and dr_libs — part of the NoFFI / COOLJAPAN sovereign Rust stack.
Meet OxiCrypto: the COOLJAPAN Pure Rust cryptographic primitives layer — hashes, MACs, AEADs, signatures, key exchange, KDFs, password hashing, CSPRNGs, and a post-quantum preview (ML-KEM / ML-DSA / SLH-DSA). Zero *-sys crates by default, no C toolchain, the NoFFI replacement for OpenSSL, BoringSSL, ring, and aws-lc-rs as crypto backends.
OxiFont is the COOLJAPAN Pure Rust font discovery, parsing, subsetting, and web-font layer for the oxi* ecosystem. It replaces the fontconfig + FreeType C/C++ pair with zero-FFI Rust: enumerate system fonts on Linux/macOS/Windows, parse TTF/OTF/TTC/WOFF/WOFF2, do CSS Level 4 family matching, and subset to WOFF2. Part of the NoFFI sovereign Rust stack.
OxiQUIC is the COOLJAPAN Pure Rust QUIC transport and HTTP/3 stack. It implements RFC 9000/9001/9002 directly on the rustls QUIC TLS 1.3 API, driven by a Pure Rust crypto provider over tokio UDP — with zero dependency on ring, aws-lc-rs, or any C/C++ cryptographic library. Part of the NoFFI sovereign Rust stack.
OxiSound is the COOLJAPAN Pure-Rust audio device I/O layer — cross-platform playback and capture over ALSA, CoreAudio, and WASAPI, plus MIDI, SMF, and OSC. A NoFFI replacement for cpal/PortAudio and raw ALSA/CoreAudio/WASAPI bindings, part of the sovereign Rust stack.
OxiTLS is the COOLJAPAN Pure Rust TLS transport stack — a NoFFI replacement for OpenSSL, native-tls, and the ring / aws-lc-rs C-and-assembly crypto backends. TLS 1.3 and 1.2, mTLS, ALPN, session resumption, OCSP stapling, post-quantum key exchange, and a Pure-Rust CryptoProvider by default. The transport-security foundation under OxiHTTP, OxiQUIC, and OxiRPC.
OxiH5 is the COOLJAPAN Pure-Rust HDF5 reader — it parses real HDF5 files written by h5py and libhdf5 from raw bytes, with no hdf5-sys, no C libhdf5, and no unsafe in production paths. All 11 datatype classes, every chunk index, deflate/shuffle/fletcher32/szip/nbit/scaleoffset filters, mmap, and a NetCDF-4 reader on top — part of the NoFFI sovereign Rust stack.
OxiNum is the COOLJAPAN Pure-Rust arbitrary-precision math layer: bignum integers, exact rationals, high-precision floats, and complex numbers — replacing GMP, MPFR, and the rug / gmp-mpfr-sys bindings with zero C and zero FFI. Part of the NoFFI sovereign Rust stack.
OxiProto is the COOLJAPAN Pure-Rust Protocol Buffers stack — a native .proto parser, codegen, and wire runtime that replaces the protoc C++ compiler. No protoc binary, no build-time C++, no -sys crates. Proto2 + proto3, multi-file imports, reflection, JSON, and a CLI, all part of the NoFFI sovereign Rust stack.