From 41cafb836aaf8366712fd6b564ad724c0a88a18c Mon Sep 17 00:00:00 2001 From: Alexey Karimov Date: Mon, 24 Aug 2026 22:24:55 +0500 Subject: [PATCH] chore(release): 0.7.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependency and security maintenance. No functional changes — the CLI surface, exit codes, stdout JSON shapes, and upload wire format are byte-for-byte identical to 0.7.4, so no integrator needs to move its version floor. Security fixes that reach the shipped binary: - `quick-xml` 0.39.4 -> 0.41.0 (via `plist`) — RUSTSEC-2026-0194 (quadratic run time checking a start tag for duplicate attribute names) and RUSTSEC-2026-0195 (unbounded namespace-declaration allocation in `NsReader`). Reachable: `build-env read-plist` parses XML Info.plist files through `plist`. - `time` 0.3.48 -> 0.3.55 — 0.3.48 was yanked upstream and had shipped since before 0.7.4. The `quinn-proto` and `h2` advisories flagged by `cargo audit` do NOT apply: both are absent from the release build (`reqwest` is configured without `http2`; `h2` comes only from the `wiremock` dev-dependency). Verified by inspecting compiled artifacts rather than trusting the lockfile. Also carries the accumulated dependabot batch — `zip` 2.4.2 -> 8.6.0 across two majors, `sha1`/`sha2`/`md-5` 0.10 -> 0.11, tokio 1.52 -> 1.53 and friends — plus the removal of the unused `indicatif`, the MSRV correction to the real 1.88 floor, and the `allow-dirty = ["ci"]` fix that unbroke tag releases. Archive output was diffed against a v0.7.4-built binary and is byte-identical: same entry names, STORED artefacts, method 93 mappings, fixed 1980-01-01 stamps. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- CHANGELOG.md | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++ Cargo.lock | 10 ++++----- Cargo.toml | 2 +- 3 files changed, 64 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b0703f7..fac31d3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,63 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +## [0.7.5] - 2026-08-24 + +Dependency and security maintenance. **No functional changes** — the CLI +surface, exit codes, stdout JSON shapes, and upload wire format are byte-for-byte +identical to 0.7.4, so no integrator needs to move its version floor. Upgrade for +the dependency fixes below. + +### Security +- **`quick-xml` 0.39.4 -> 0.41.0** (via `plist`) — fixes two denial-of-service + advisories in XML parsing: [RUSTSEC-2026-0194] (quadratic run time when a start + tag is checked for duplicate attribute names) and [RUSTSEC-2026-0195] (unbounded + namespace-declaration allocation in `NsReader` enabling memory exhaustion). This + code is reachable: `build-env read-plist` parses XML `Info.plist` files through + `plist`. +- **`time` 0.3.48 -> 0.3.55** (via `plist`) — 0.3.48 was yanked upstream and had + shipped since before 0.7.4. +- **`anyhow` 1.0.102 -> 1.0.104** — fixes unsoundness in `Error::downcast_mut()`. + Not reachable here (this crate only calls `downcast_ref`), included for hygiene. +- Advisories that do **not** apply to the shipped binary, for the record: + `quinn-proto` [RUSTSEC-2026-0185] and `h2` [RUSTSEC-2026-0258] are absent from + the release build — `reqwest` is configured without `http2`, and `h2` is pulled + in only by the `wiremock` dev-dependency. Verified by inspecting compiled + artifacts, not the lockfile. + +### Changed +- `zip` 2.4.2 -> 8.6.0 (two major bumps). The upload ZIP is unchanged: entry + names, STORED artefacts, method 93 (Z_STANDARD) mappings, and the fixed + 1980-01-01 timestamps all produce byte-identical archives to 0.7.4. +- `sha1`, `sha2`, and `md-5` 0.10 -> 0.11 (RustCrypto `digest` 0.11). Content + fingerprints, chunk identities, and the md5-derived Java-compatible + `BUILD_UUID`s are unchanged. +- Routine bumps: `tokio` 1.52 -> 1.53, plus `clap`, `serde`, `serde_json`, + `regex`, `uuid`, `globset`, `libc`, `plist`, `thiserror`, `futures-util`. +- **Declared MSRV corrected to 1.88** (`rust-version`). The previous `1.79` was + inaccurate and had been for several releases — the locked tree already required + 1.88 via `gimli`, `globset`, `plist`, and `time`. This documents reality rather + than dropping support: no toolchain that could build 0.7.4 loses the ability to + build 0.7.5. Only affects building from source; released binaries are unaffected. + +### Removed +- `indicatif` — declared but referenced nowhere in the source. Also prunes + `console`, `encode_unicode`, `portable-atomic`, `unicode-width`, and the + unmaintained `number_prefix` ([RUSTSEC-2025-0119]). + +### Fixed +- **Tag releases were broken.** Dependabot's action bumps rewrote pins inside + `.github/workflows/release.yml`, which cargo-dist generates and its `plan` job + verifies; since `plan` is the first job of the release workflow, a `vX.Y.Z` tag + push would have failed before building any artefact. `[workspace.metadata.dist]` + now sets `allow-dirty = ["ci"]`. CI/release only — no effect on the binary. + +[RUSTSEC-2026-0194]: https://rustsec.org/advisories/RUSTSEC-2026-0194 +[RUSTSEC-2026-0195]: https://rustsec.org/advisories/RUSTSEC-2026-0195 +[RUSTSEC-2026-0185]: https://rustsec.org/advisories/RUSTSEC-2026-0185 +[RUSTSEC-2026-0258]: https://rustsec.org/advisories/RUSTSEC-2026-0258 +[RUSTSEC-2025-0119]: https://rustsec.org/advisories/RUSTSEC-2025-0119 + ## [0.7.4] - 2026-08-11 ### Added @@ -238,6 +295,7 @@ retry/chunking stacks. (`debug-files upload --type dsym`), dSYM UUID/slice inspection (`dsym`), and the canonical CI resolvers (`vcs-metadata`, `ios-deps`, `build-env`). +[0.7.5]: https://github.com/bugsee/bugsee-cli/compare/v0.7.4...v0.7.5 [0.7.4]: https://github.com/bugsee/bugsee-cli/compare/v0.7.3...v0.7.4 [0.7.3]: https://github.com/bugsee/bugsee-cli/compare/v0.7.2...v0.7.3 [0.7.2]: https://github.com/bugsee/bugsee-cli/compare/v0.7.1...v0.7.2 diff --git a/Cargo.lock b/Cargo.lock index 25ac754..81a6236 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -198,7 +198,7 @@ dependencies = [ [[package]] name = "bugsee-cli" -version = "0.7.4" +version = "0.7.5" dependencies = [ "anyhow", "assert_cmd", @@ -2172,9 +2172,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.48" +version = "0.3.55" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc1aa89044e7786ffb2ec017acb22cb7de5b0be46d0f21aea2b224b8561e5db2" +checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134" dependencies = [ "deranged", "num-conv", @@ -2192,9 +2192,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109" [[package]] name = "time-macros" -version = "0.2.28" +version = "0.2.32" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d3bfe86347f0cc659f586f01e26303ccd32418f26f30c7b0309b3ca3a07d695" +checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85" dependencies = [ "num-conv", "time-core", diff --git a/Cargo.toml b/Cargo.toml index 9bb2900..c95a53a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "bugsee-cli" -version = "0.7.4" +version = "0.7.5" edition = "2021" # Real floor, not an aspiration: the locked tree requires 1.88 (`gimli`, # `globset`, `plist`, `time`). Verify a bump with `cargo + check