Merge tag 'v0.86.11' into ci

v0.86.11

- net: Address issue with TLS proxy connectivity when using certain kinds of TLS certificates

Author: tulir

.cargo/audit.toml

@@ -1,6 +1,6 @@
 [advisories]
 ignore = [
     "RUSTSEC-2024-0370", # proc-macro-error is unmaintained, used by libcrux
-    "RUSTSEC-2024-0381", # pqcrypto-kyber is unmaintained
     "RUSTSEC-2024-0436", # paste is unmaintained, used by libsignal-bridge
+    "RUSTSEC-2025-0141"  # bincode is unmaintained, used by zkgroup
 ]

.github/actionlint.yaml

@@ -3,6 +3,9 @@ self-hosted-runner:
   labels:
     # Used in Slow Tests' AArch64 Linux Tests.
     - ubuntu-24.04-arm64-4-cores
+    # This is... not a custom worker label, but it's not included in actionlint for some reason.
+    # See: https://github.com/rhysd/actionlint/blob/f9408506b4c7f9cda1263bca8166271f65e65c3d/rule_runner_label.go#L29
+    - windows-latest-4-cores
 
 # Configuration variables in array of strings defined in your repository or
 # organization. `null` means disabling configuration variables check.

CODING_GUIDELINES.md

@@ -65,6 +65,10 @@ These should usually be prioritized in that order, but adjust the trade-off as n
 
     These are automatically detected on x86_64, but will require an opt-in for aarch64 until we can update to `aes 0.9` or newer (not out yet at the time of this writing). All our app library build scripts set this themselves, but doing a manual `cargo build --release` will not.
 
+- Our bridging logic uses code generation tools for the app-language interface files (C header for Swift, wrapper APIs for Java/Kotlin and TypeScript). These tools, or the macros used with them, depend on how types are written in `#[bridge_fn]` and other bridged APIs. Therefore, **use qualified names for non-std, non-libsignal types** in bridged signatures, so that they can be matched specifically and without ambiguity.
+
+    (There is one exception: `uuid::Uuid` has been `Uuid` for a long time, and is sufficiently unique to justify leaving it that way.)
+
 
 ## Async