publet-cli 0.2.3

0.2.3 - 2026-10-29

Commit 4f38921f47bb; release record pub:sha2-256:3bi7h5ftyvrn4glj3t42k5wrz6ozcrw2pcv7fl77gtfhozfhfoxq.

Added

• A project states the pub it needs in pub-version.txt or as pub= in .publet/config; pub finds it in the current directory or a parent and, before running any command, stops with exit 2 naming the release to install when it is not met (PUB_IGNORE_VERSION=1 skips this). pub require [REQUIREMENT] checks one for scripts. An unknown command now says which release this is and how to install another.

Fixed

• pub reads a version requirement only from a regular file, at most 4 KiB of it, skips a byte-order mark and comments after the requirement, and refuses something that is not a requirement by name, quoted, instead of reporting it as unmet; the README documents exit status 2 and the files and variable involved

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (68 fully audited, 4 partially audited, 157 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.9.1) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• quality audit current: .venv/bin/pubkit audit --check (pubkit 0.9.1) -- audit/publet-cli-0.2.3.md: publet-cli 0.2.3 audited on 2026-10-29 by rust-crate-quality against the current standard (bc3c5b6eeba4); 0 findings block a release
• RustSec advisory database revision: 40f5be6fb12ed93fc591bf4ab23b7d793b3f2239 (2026-10-28)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, pubunit, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.3 publet-cli