Audit zig-js against Zig 0.18.0-dev.146+35accc0 and keep the migration evidence on main.
Scope:
- inventory std.crypto error-union signature changes and preserve checks for operations that still return attacker-input validation errors;
- identify any std.Io signature migration gaps;
- classify OptimizeMode spelling changes versus semantic changes;
- verify tests and shipped artifacts use the same libc/link/runtime configuration;
- add only evidence-backed compatibility fixes and focused regressions;
- run serialized Debug, ReleaseSafe, unsuppressed TSan, conformance, and shipped-artifact gates before closing.
Initial read-only baseline on 2026-10-14:
- current main already builds with Zig 0.18.0-dev.146+
35accc0; - dependency-audit passed: 16 classified edges, 0 migration targets, 65 classified repository tools;
- production zig build exited 0;
- no X25519 generateDeterministic/recoverPublicKey/scalarmult call sites were found;
- repository OptimizeMode uses qualified lowercase .debug/.fast tags; no legacy .ReleaseFast/.ReleaseSafe enum literals were found;
- the shipped static library and primary unit test root both explicitly use link_libc = false.
Keep this issue open until the shipped-artifact gates and any remaining audit findings are evidenced.