v2.0.8

Fixed

• Backend resource bounds hardened (from audit #1/#2): an overflowing
  response fails immediately instead of draining stderr from a blocked
  writer (up to 8s stall per tick), and the curl child is killed and reaped
  on every path so read failures can't leak orphans/zombies.
• Watchlist cap counts deduplicated symbols (#3): duplicate entries no
  longer falsely reject a valid watchlist.
• Symbol suggestion lookups cache negative results (#4): unresolvable
  symbols stop re-querying the search endpoint every poll tick.

Fixed (QML frontend, from audit #5-#10)

• Panel chart fetch has a watchdog: a backend that fails to spawn or hangs
  no longer leaves the panel on "Loading" forever.
• A watch process exit always clears and reseeds quotes; the PATH fallback
  no longer keeps rendering a stale price as live.
• A watcher that spawns but dies instantly counts toward the fallback
  threshold instead of crash-looping every 5 seconds.
• Rotation pauses while the panel is open and opening prefers the persisted
  selection.
• formatPrice keeps the sign of negative prices; normalizeSymbol strips
  commas/semicolons so entries can't break the CSV round-trip.

Artifact: omastonk-qs-2.0.8-linux-x86_64.tar.gz (statically linked musl x86_64).

Reproducible-build attestation

Produced by the verify bundle and publish GitHub release job at commit d1c50b2040a4b5359d4ce404d9e89af8f3d3e4d0, with all third-party actions pinned to immutable commit SHAs.

source_commit=d1c50b2040a4b5359d4ce404d9e89af8f3d3e4d0
version=2.0.8
committed_sha256=213479c239ec797347183ab0d860c1fdd8736616f7fdbdb6a92c45591be9dad7
rebuilt_sha256=213479c239ec797347183ab0d860c1fdd8736616f7fdbdb6a92c45591be9dad7
source_id=146b9c2216f45e794d6b95c37f75de390075b2d21d7df504f26091245f2f16d9
tarball_sha256=c79be3cbb82390ec31c11f15d464a504248c0c506a3b439b4b406af0a18a3485

v2.0.7

Added

• Symbol suggestions on failures: when Yahoo reports a symbol as unknown or
  delisted (ISINs and bare company names are not Yahoo tickers), the backend
  asks the search endpoint for what the instrument is called instead, and the
  hint surfaces in the bar tooltip and panel ("did you mean VWRA.L?").
• API-level error descriptions from Yahoo now reach the UI instead of a bare
  curl exit line.

Changed

• Panel chart errors show the backend's error message (wrapped) rather than
  a generic "No data".

Artifact: omastonk-qs-2.0.7-linux-x86_64.tar.gz (statically linked musl x86_64).

Reproducible-build attestation

Produced by the verify bundle and publish GitHub release job at commit e6ce9b3f97f814f596e42cd185d98b236919b48e, with all third-party actions pinned to immutable commit SHAs.

source_commit=e6ce9b3f97f814f596e42cd185d98b236919b48e
version=2.0.7
committed_sha256=9f01e13d08de6a8eeb7b4c6657c8241c551d9778cfe47b7c7f69b536aa91d8a1
rebuilt_sha256=9f01e13d08de6a8eeb7b4c6657c8241c551d9778cfe47b7c7f69b536aa91d8a1
source_id=86b8edd1ed048b58c278c54e45b3780eac66a10d9f91e85e7d9d129947b78b14
tarball_sha256=9826c1767258d74d067dd10c46754f17ca26a04b3b0d5c34e1f0259ea0520a92

v2.0.6

Changed

• Supply-chain hardening for the release pipeline: every third-party GitHub
  Action is pinned to an immutable commit SHA (actions/checkout v4.4.0,
  dtolnay/rust-toolchain 1.97.1 branch head, Swatinem/rust-cache v2), checkouts
  run with persist-credentials: false, and the release job now publishes a
  reproducible-build attestation (source commit, committed and freshly rebuilt
  ELF SHA-256, source id, tarball SHA-256) in the release notes.

Artifact: omastonk-qs-2.0.6-linux-x86_64.tar.gz (statically linked musl x86_64).

Reproducible-build attestation

Produced by the verify bundle and publish GitHub release job at commit 7b1ec07161c553880d7698beb633222b2702f758, with all third-party actions pinned to immutable commit SHAs.

source_commit=7b1ec07161c553880d7698beb633222b2702f758
version=2.0.6
committed_sha256=91a33e48ffa806086471c47da45005e989a8ccd7cf5f29607cc4259b53f7c5ac
rebuilt_sha256=91a33e48ffa806086471c47da45005e989a8ccd7cf5f29607cc4259b53f7c5ac
source_id=ab9538cd49b8f42c45f2546beee189a0d0792b0dea979a88c4a4dc583181b90b
tarball_sha256=4c9c559101d773e30ce6ec71f0af5e81de8576198ac9f425b21091a7c74696cd

v2.0.5

Changed

• Declared minimum Rust version bumped from 1.85 to 1.97.1, matching the
  pinned build toolchain; the MSRV CI job now checks 1.97.1.

Artifact: omastonk-qs-2.0.5-linux-x86_64.tar.gz (statically linked musl x86_64).

v2.0.4

Fixed

• Bound the memory a compromised or malfunctioning endpoint can consume:
  fetch_chart no longer buffers the complete curl output with
  Command::output(); stdout and stderr are read through a hard cap
  (4 MiB response / 4 KiB error detail), the child is killed on overflow,
  and curl additionally aborts oversized bodies itself (--max-filesize)
  with HTTPS-only transport (--proto =https).
• Bound the poll loop: --interval-secs 0 or a watchlist longer than the
  interval used to degrade to a tight request loop; the per-request tick
  now has a 2-second floor.
• Bound the watchlist: more than 64 symbols is refused with a JSON error
  line instead of growing the poller's state without limit.

Artifact: omastonk-qs-2.0.4-linux-x86_64.tar.gz (statically linked musl x86_64).

v2.0.3

Changed

• Updated screenshot assets: new preview image and a second panel screenshot
  in the README gallery.

Artifact: omastonk-qs-2.0.3-linux-x86_64.tar.gz (statically linked musl x86_64).

v2.0.2

Fixed

• Bar rotation restored: the rotation timer was dropped in the Rust backend
  rewrite, so the watchlist stayed on the first symbol.

Artifact: omastonk-qs-2.0.2-linux-x86_64.tar.gz (statically linked musl x86_64).

v2.0.1

Fixed

• Backend watchlist parsing: --symbols "A,B" no longer drops everything
  after the first comma (clap value_delimiter with a single String arg).
• Widget settings reading: injected shell settings hold QML lists, which
  Array.isArray rejects; the watchlist now survives a fresh shell start
  instead of only updating after a manual save.

Artifact: omastonk-qs-2.0.1-linux-x86_64.tar.gz (statically linked musl x86_64).

v2.0.0

Added

• Rust backend (omastonk-qs): staggered round-robin quote polling with a
  single streaming watch process, serde-typed Yahoo Finance parsing, and a
  chart subcommand that serves the panel's close-series.
• Bundled statically linked musl x86_64 backend (omarchy/bin/omastonk-qs)
  with a reproducible-build attestation (make verify-bundle, the
  marketplace gate); falls back to an omastonk-qs binary on PATH.
• Unit tests for the backend and node tests for the QML model helpers
  (make test, make plugin-test).
• GitHub Actions: cargo format/clippy/test, plugin model tests, MSRV check,
  and the independent marketplace bundle job; tag-driven release publishing
  the tarball with changelog notes.

Changed

• Quote fetching moved from per-symbol curl subprocesses in QML to the Rust
  backend; the QML is now pure presentation.
• Chart requests in the panel go through omastonk-qs chart instead of curl.
• Shared parsing/formatting helpers extracted to omarchy/Model.js.

Artifact: omastonk-qs-2.0.0-linux-x86_64.tar.gz (statically linked musl x86_64).