Repository navigation
release: v1.0.2 security and dependency update - #198
Merged
Merged
Conversation
Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) and [actions/setup-python](https://github.com/actions/setup-python) to permit the latest version. Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.4.0...3d3c42e) Updates `dtolnay/rust-toolchain` to 18f0487477426dce244608110aa2660c2893deb7 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/commits/18f0487477426dce244608110aa2660c2893deb7) Updates `actions/setup-python` from 5.6.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a26af69...6d4fd22) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dtolnay/rust-toolchain dependency-version: 18f0487477426dce244608110aa2660c2893deb7 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
- Update wasmtime/wasmtime-wasi to 50.0.1 and zstd/zstd-safe to 0.13.4/7.4.0 (RUSTSEC-2026-0391, 0395-0406, 0420, 0422-0424) - Update sysinfo to 0.40.1 and adapt fallible constructors/statics and OsString network interface names - Include the GitHub Actions group bump (checkout 7.0.1, setup-python 7.1.0, pinned rust-toolchain) - Bump crate version to 1.0.2, refresh installer/verification examples and add the v1.0.2 changelog - Limit CI push triggers to main to avoid duplicate runs for release branches
- Refresh the semver-compatible dependency graph and bump the manifest floors for clap, console, image, serde, serde_json and wat. - Migrate the updater, public IP probe and wasm HTTP host from ureq 2.12 to 3.5.1, including config builders, status handling and body readers. - Add a local HTTP success test for the wasm host operation.
- Add a shared addons module for installed metadata, capability summaries and configuration snippets. - Print the configuration snippet and declared capabilities after a successful plugin, effect or extension install. - Add list --verbose and info <name> for all three addon families. - Add --name and --manifest for direct wasm file or URL installs. - Add command aliases for plugins, effect and extensions. - Update the plugin, effect and extension documentation and the v1.0.2 changelog.
- Add a catalog module that reads the plugin, effect and extension index.json files and filters entries by name, description, kind or runtime. - Add search/available commands for the three addon families, with optional --json output and local/remote catalog overrides. - Document the new commands and record them in the v1.0.2 changelog.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Accumulated v1.0.2 update for the v1.0.1 line. This branch folds in all four open Dependabot updates plus the RustSec fixes, bumps the crate to 1.0.2, refreshes the release examples, and adds the addon discovery/onboarding tooling.
Security
wasmtime/wasmtime-wasi48.0.7 -> 50.0.1zstd/zstd-safe0.13.3 / 7.3.0 -> 0.13.4 / 7.4.0cargo audit --deny warningsreports no vulnerabilities and no warnings.Dependencies
sysinfo0.39.6 -> 0.40.1, including the fallible constructors/statics andOsStringnetwork interface names.actions/checkout7.0.1,actions/setup-python7.1.0, pinneddtolnay/rust-toolchaincommit. All actions remain pinned by commit SHA.Addon tooling
list --verboseandinfo <name>for all three addon families. They report the manifest kind, runtime, version, capabilities, limits and enabled state.--nameand--manifeston install. Directory and repository installs keep using their own name and manifest.plugins,effectandextensions.Addon catalogs
search(aliasavailable) for the plugin, effect and extension catalogs, with optional--jsonoutput.XFETCH_PLUGIN_INDEX,XFETCH_EFFECT_INDEXandXFETCH_EXTENSION_INDEXfor local review or forks.mainbranch of each addon repository. The catalog PRs are separate and not merged yet:Release
Cargo.tomlversion 1.0.2 andCargo.lockupdated.CHANGELOG.mdsection without emojis.main; release branches are validated through their pull requests.Verification
cargo fmt --all --checkpasscargo check --all-targetspasscargo test --locked: 250 passed, 1 ignored; 6 e2e tests passedcargo clippy --all-targets -- -D warningspasscargo audit --deny warningspass (0 vulnerabilities, 0 warnings)cargo check --no-default-featurespassplugins,effectsandextensionsindex.jsonfiles (20, 4 and 5 entries respectively).x86_64-w64-mingw32-gccis not installed; the release workflow's Windows build job validates it.Supersedes
Closes #192
Closes #195
Closes #196
Closes #197
After merge, tag
v1.0.2to run the release gate and publish the signed artifacts.