Merge main into dev (#1848)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: moq-bot[bot] <186640430+moq-bot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: quidamschwarz <113550619+quidamschwarz@users.noreply.github.com>
Co-authored-by: nuts-rice <red44443@gmail.com>
Co-authored-by: Luke Curley <luke.curley@discordapp.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: 7 people

.github/dependabot.yml

@@ -32,6 +32,13 @@ updates:
       cargo:
         patterns:
           - "*"
+    ignore:
+      # reqwest-middleware 0.5 requires reqwest 0.13, but http-cache-reqwest's
+      # latest stable (0.16) still pins reqwest 0.12 / reqwest-middleware 0.4.
+      # The only pairing is http-cache-reqwest 1.0.0-alpha (pre-release), so we
+      # hold reqwest-middleware at 0.4 until that line ships stable.
+      - dependency-name: "reqwest-middleware"
+        versions: [">=0.5"]
 
   - package-ecosystem: "bun"
     directory: "/"

.github/workflows/check.yml

@@ -6,15 +6,22 @@ permissions:
 
 on:
   pull_request:
+    # `closed` is here only so merging/closing a PR cancels its in-flight run
+    # via the concurrency group below; the job itself is skipped on close.
+    types: [opened, synchronize, reopened, closed]
 
-# Cancel in-flight runs when a new commit lands on the same PR.
+# Cancel in-flight runs when a new commit lands on the same PR, or when the PR
+# is merged/closed (the close event shares this group and supersedes the build).
 concurrency:
   group: check-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   check:
     name: Check
+    # Skip the actual work on close/merge: this run exists only to cancel the
+    # superseded in-flight build via the concurrency group above.
+    if: github.event.action != 'closed'
     # Trusted events run on the moq-dev self-hosted A1 runner (warm /nix/store +
     # persistent CARGO_TARGET_DIR). Fork PRs fall back to GitHub-hosted ARM so
     # untrusted code never runs on the box.

CLAUDE.md

@@ -215,11 +215,14 @@ Changes in one area usually need matching updates elsewhere, including docs. If
 | `rs/moq-token` | `js/token` |
 | `rs/moq-relay` config/behavior | `doc/bin/relay/` |
 | `rs/moq-cli` | `doc/bin/cli.md` |
+| `rs/moq-token-cli` | `doc/bin/relay/auth.md`, `doc/lib/rs/crate/moq-token.md`, `doc/lib/rs/index.md` |
 | `rs/moq-gst` | `doc/bin/gstreamer.md` |
 | `js/{watch,publish}` UI/API | `demo/web` if it consumes the API |
 
 For `swift/`, the wrapper re-exports `moq-ffi` records/enums via typealias, so new catalog/audio *fields* flow through automatically. Only a new FFI *method* (or a renamed/removed one) needs a matching change in the de-prefixed `Sources/Moq` wrapper.
 
+**When a command-line tool's interface changes (a flag, argument, subcommand, or positional renamed/added/removed/reordered), update every doc that shows an example invocation, not just the tool's primary page.** Sample commands for `moq-cli`, `moq-relay`, and `moq-token-cli` are scattered across `doc/bin/`, `doc/lib/`, `doc/setup/`, and `doc/concept/`, plus the `justfile`s under `demo/`. Grep the whole repo for the binary name and reconcile each hit against the binary's `--help`. A stale example that no longer parses is worse than no example.
+
 ## Branch Targeting
 
 Two long-lived branches:

Cargo.lock

@@ -72,7 +72,7 @@ moq-token = { version = "0.6", path = "rs/moq-token" }
 # Standalone crate (moq-dev/vaapi); vendored from cros-libva + cros-codecs.
 moq-vaapi = "0.0.2"
 moq-video = { version = "0.0.4", path = "rs/moq-video" }
-qmux = { version = "0.1.3", default-features = false }
+qmux = { version = "0.2", default-features = false }
 serde = { version = "1", features = ["derive"] }
 tokio = "1.48"
 web-async = { version = "0.1.4", features = ["tracing"] }