chore(release): 0.7.5 - #14
Merged
Merged
Conversation
Dependency and security maintenance. No functional changes — the CLI surface, exit codes, stdout JSON shapes, and upload wire format are byte-for-byte identical to 0.7.4, so no integrator needs to move its version floor. Security fixes that reach the shipped binary: - `quick-xml` 0.39.4 -> 0.41.0 (via `plist`) — RUSTSEC-2026-0194 (quadratic run time checking a start tag for duplicate attribute names) and RUSTSEC-2026-0195 (unbounded namespace-declaration allocation in `NsReader`). Reachable: `build-env read-plist` parses XML Info.plist files through `plist`. - `time` 0.3.48 -> 0.3.55 — 0.3.48 was yanked upstream and had shipped since before 0.7.4. The `quinn-proto` and `h2` advisories flagged by `cargo audit` do NOT apply: both are absent from the release build (`reqwest` is configured without `http2`; `h2` comes only from the `wiremock` dev-dependency). Verified by inspecting compiled artifacts rather than trusting the lockfile. Also carries the accumulated dependabot batch — `zip` 2.4.2 -> 8.6.0 across two majors, `sha1`/`sha2`/`md-5` 0.10 -> 0.11, tokio 1.52 -> 1.53 and friends — plus the removal of the unused `indicatif`, the MSRV correction to the real 1.88 floor, and the `allow-dirty = ["ci"]` fix that unbroke tag releases. Archive output was diffed against a v0.7.4-built binary and is byte-identical: same entry names, STORED artefacts, method 93 mappings, fixed 1980-01-01 stamps. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release PR for v0.7.5 — dependency and security maintenance.
No functional changes.
git diff v0.7.4..main -- src/is empty; not one lineof shipped source changed since 0.7.4. The CLI surface, exit codes, stdout JSON
shapes, and upload wire format are identical, so no integrator needs to move its
version floor.
Why release at all
Two security fixes that actually reach the shipped binary:
quick-xml0.39.4 → 0.41.0 (viaplist)build-env read-plistparses XML Info.plist throughplisttime0.3.48 → 0.3.55 (viaplist)cargo auditalso flagsquinn-proto(RUSTSEC-2026-0185) andh2(RUSTSEC-2026-0258). Neither applies: both are absent from the release build —
reqwestis configured withouthttp2, andh2is pulled in only by thewiremockdev-dependency. Verified by counting compiled artifacts intarget/release/depsrather than trusting the lockfile.h2will keep showingup in
cargo auditoutput; it is not in the binary.Also carries the accumulated dependabot batch (PRs #1–#12) and the fixes from
#10/#13.
Notable non-security changes
zip2.4.2 → 8.6.0, across two majors. Archive output diffed against abinary built from
e7de272(pre-dependabot): byte-identical — same entrynames, STORED artefacts, method 93 (Z_STANDARD) mappings, fixed 1980-01-01
timestamps, same extract-version and flag bits.
sha1/sha2/md-50.10 → 0.11. Content fingerprints, chunk identities,and md5-derived Java-compatible
BUILD_UUIDs all unchanged.1.79. This documents reality ratherthan dropping support — the locked tree already required 1.88 via
gimli,globset,plist,time, and had for several releases. No toolchain thatcould build 0.7.4 loses the ability to build 0.7.5. Source builds only;
released binaries unaffected.
indicatifremoved — declared but referenced nowhere. Also prunes theunmaintained
number_prefix(RUSTSEC-2025-0119).Validation
Full local CI replication, matching the workflows exactly (
RUSTFLAGS="-D warnings",cargo test --all-targets):dist plancargo +1.88 check --all-targetscargo audith2--versionbugsee-cli 0.7.5After merge
Tag
v0.7.5and push it to triggerrelease.yml(cargo-dist builds the fivetarget triples + GitHub Release + installers), then
mirror-to-s3.ymlfordownload.bugsee.com/cli/0.7.5/.🤖 Generated with Claude Code