Skip to content

Repository navigation

0.18.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Nov 04:15
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
0.18.0
d9e70bf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Breaking Changes

  • refactor!: remove dead api surface, stale deps, and duplicated env-var constants by @ken-matsui in #1535
  • feat(cli)!: remove the cabin port subcommand and cabin add --port by @ken-matsui in #1611
  • feat(ports)!: remove the builtin-port dependency kind by @ken-matsui in #1613
  • refactor(port)!: remove the embedded foundation-port recipe table by @ken-matsui in #1615
  • refactor(ports)!: move the ports tree to the repo root by @ken-matsui in #1621
  • refactor(port)!: delete the cabin-port crate by @ken-matsui in #1622
  • refactor(fs)!: remove the callerless is_non_empty_safe_relative_path by @ken-matsui in #1623
  • refactor(manifest)!: rename the upstream sha256 key to a self-describing checksum by @ken-matsui in #1666
  • refactor(registry)!: store and serve the canonical prefixed checksum spelling by @ken-matsui in #1674
  • feat(core)!: restrict package names to lowercase ascii, digits, _, and - by @ken-matsui in #2050

New Features

  • feat(registry): experimental remote-registry groundwork behind -Z remote-registry by @ken-matsui in #1485
  • feat(cabin): credential storage and authenticated reads for the remote registry by @ken-matsui in #1486
  • feat(cabin): add remote registry publish behind -Z remote-registry by @ken-matsui in #1487
  • feat(cabin): add cabin yank behind -Z remote-registry by @ken-matsui in #1488
  • feat(registry): bootstrap hosted registry worker service by @ken-matsui in #1489
  • feat(registry): implement publish and yank write routes by @ken-matsui in #1491
  • feat(registry): github sign-in and token management page by @ken-matsui in #1493
  • feat(registry): enforce per-user quotas and a free-plan budget circuit breaker by @ken-matsui in #1495
  • feat(registry-api): map budget, rate-limit, and quota refusals to actionable errors by @ken-matsui in #1496
  • feat(registry): back up blobs and d1 to r2 with a rehearsed restore path by @ken-matsui in #1498
  • feat(registry): add an asynchronous verification lifecycle for published versions by @ken-matsui in #1499
  • feat(registry): add the external archive verifier and verification pipeline by @ken-matsui in #1500
  • feat(artifact): harden client-side archive extraction against hostile input by @ken-matsui in #1501
  • feat(registry): serve one role per hostname and move the browser plane to cabinpkg.com by @ken-matsui in #1502
  • feat(website): crates.io-style account pages for the registry by @ken-matsui in #1503
  • feat(website): account menu with sign out by @ken-matsui in #1504
  • feat(registry): collapse to a single production-named environment behind a launch guard by @ken-matsui in #1507
  • feat(registry): move identity to registry-native users with provider identities by @ken-matsui in #1510
  • feat(registry): scoped package names and scope-membership authorization by @ken-matsui in #1512
  • feat(registry): scope claiming via github oauth proof and session-plane membership management by @ken-matsui in #1513
  • feat(client): scoped package names across the name model, build tree, and publish flows by @ken-matsui in #1514
  • feat(client): speak the scoped registry wire protocol for reads, publish, yank, and add by @ken-matsui in #1515
  • feat(website): show the github avatar in the header and profile by @ken-matsui in #1516
  • feat(registry): count artifact downloads and show stats on the website by @ken-matsui in #1517
  • feat(website): publish the registry usage policy at /policies by @ken-matsui in #1519
  • feat(registry): halve the free-plan storage quota to 128 mib by @ken-matsui in #1520
  • feat(registry): migrate the package archive format from tar.gz to a strict zip profile by @ken-matsui in #1522
  • feat(registry): add a source viewer for published package versions by @ken-matsui in #1524
  • feat(registry): session-plane package search, package detail, and reverse dependencies by @ken-matsui in #1530
  • feat(publish): require canonical scoped dependency keys at publish by @ken-matsui in #1531
  • feat(registry): read-side budget breaker (reads_blocked) and r2 class b monitoring by @ken-matsui in #1532
  • feat(registry): deterministic name rules and the verifier's abstain channel by @ken-matsui in #1533
  • feat(standards): bounded interface-standard requirements across the compatibility pipeline by @ken-matsui in #1554
  • feat(registry): reduce default quota class max total packages from 50 to 20 by @ken-matsui in #1555
  • feat(registry): hard r2 cost governor with a sqlite durable object ledger by @ken-matsui in #1556
  • feat(registry): governor rollout tooling, guards, and recovery procedures by @ken-matsui in #1558
  • feat(build): resolve bare dependency deps to the sole library-like target by @ken-matsui in #1564
  • feat: optional machine-verifiable upstream provenance for published packages by @ken-matsui in #1565
  • feat(port-publish): publish foundation-port recipes as cabin-ports registry packages by @ken-matsui in #1566
  • feat(ports): automate cabin-ports publishing in ci and present scoped packages on the website by @ken-matsui in #1575
  • feat(registry): add the operator quota class for bulk ports publishing by @ken-matsui in #1577
  • feat(registry): stabilize hosted-registry reads and default to the hosted index by @ken-matsui in #1579
  • feat: migrate examples and ordinary-dependency tests to cabin-ports registry packages by @ken-matsui in #1580
  • feat(registry): introduce packaging revisions for republishing recipe corrections by @ken-matsui in #1581
  • feat(manifest): add target-level links native-library identity with graph-wide uniqueness by @ken-matsui in #1582
  • feat(upstream): add declared patch files to provenance and port recipes by @ken-matsui in #1583
  • feat(registry): serve verified reads publicly and narrow the uniform 401 to the mutation surface by @ken-matsui in #1585
  • feat(ports): accept provenance-bearing package dirs beside recipes during the migration by @ken-matsui in #1588
  • feat(registry): gate new-account sign-ups on a 30-day github account age by @ken-matsui in #1683
  • feat(website): explain the account-age sign-in refusal with the eligible date by @ken-matsui in #1684
  • feat(registry): cap lifetime scope claims per user with an append-only claim history by @ken-matsui in #1685
  • feat(website): pin script-less page content and add sign-in and source-viewer fallbacks by @ken-matsui in #1687
  • feat(registry): add trusted-publishing schema and token expiry and scope-limit invariants by @ken-matsui in #1686
  • feat(website): show versions, dependencies, and features on package pages by @ken-matsui in #1689
  • feat(registry): add a github actions oidc jwt verification module for trusted publishing by @ken-matsui in #1688
  • feat(registry): add trusted-publishing token exchange and revocation endpoints by @ken-matsui in #1691
  • feat(cli): auto-exchange github actions oidc tokens for registry tokens when publishing by @ken-matsui in #1692
  • feat(cli): publish an ordered multi-package batch in one invocation by @ken-matsui in #1693
  • feat(registry): make repeat rejection verdicts an idempotent no-op by @ken-matsui in #1708
  • feat(xtask): teach the deploy wait the change-gated registry run shape by @ken-matsui in #1716
  • feat(registry): authenticate verifier verdicts with github actions oidc by @ken-matsui in #1718
  • feat(registry): mint per-verdict github oidc tokens in the verify client by @ken-matsui in #1722
  • feat(registry): resolve abstained versions through registry-verify dispatch inputs by @ken-matsui in #1727
  • feat(registry): mint verify-scoped exchange tokens for the pinned verifier workflow by @ken-matsui in #1734
  • feat(registry): mint the verify run token via the exchange and assert the inspected bytes by @ken-matsui in #1754
  • feat(registry): add login-session token mint and revocation endpoints by @ken-matsui in #1759
  • feat(registry): remove the legacy long-lived api token system by @ken-matsui in #1802
  • feat(credentials): accept login-session cabin_ses_ tokens by @ken-matsui in #1803
  • feat(credentials): replace token-paste login with device-flow sessions by @ken-matsui in #1805
  • feat(registry): seed the operator's pre-promoted account in the baseline migration by @ken-matsui in #1809
  • feat(registry): gate the oidc endpoints behind deployment-pinned admission control by @ken-matsui in #1822
  • feat(registry): raise the operator quota class for bulk ports publishing by @ken-matsui in #1948
  • feat(cli): report each fetched archive's checksum match under -v by @ken-matsui in #1986
  • feat(cli): name the registry api url under -v for publish and yank by @ken-matsui in #1987
  • feat(build): name declared-but-unlisted deps when a compile misses a header by @ken-matsui in #1990
  • feat(xtask): publish ports in resumable batches of one cabin publish run each by @ken-matsui in #2007
  • feat(registry): empty the backup bucket and every storage pool in the pre-launch wipe by @ken-matsui in #2028
  • feat(xtask): run committed consumer tests in the port preflight on every platform by @ken-matsui in #2033
  • feat(manifest): select target sources per platform with cfg-conditional sources tables by @ken-matsui in #2035
  • feat(build): assemble .S sources with the gcc/clang driver and .asm sources with ml64 by @ken-matsui in #2037
  • feat(package): archive only the paths a [package] include list names by @ken-matsui in #2038
  • feat(ports): add the boost 1.92.0 port ledger and header-only ports, part 1 of 5 by @ken-matsui in #2040
  • feat(ports): add header-only boost 1.92.0 ports, part 2 of 5 by @ken-matsui in #2041
  • feat(ports): add header-only boost 1.92.0 ports, part 3 of 5 by @ken-matsui in #2042
  • feat(ports): add header-only boost 1.92.0 ports, part 4 of 5 by @ken-matsui in #2043
  • feat(ports): add header-only boost 1.92.0 ports, part 5 of 5 by @ken-matsui in #2044
  • feat(ports): add compiled boost 1.92.0 libraries and their dependents, part 1 of 2 by @ken-matsui in #2046
  • feat(ports): add compiled boost 1.92.0 libraries and their dependents, part 2 of 2 by @ken-matsui in #2047
  • feat(ports): add the remaining 18 buildable boost 1.92.0 ports by @ken-matsui in #2052
  • feat(resolver): resolve registry features and optional dependencies with versions by @ken-matsui in #2055
  • feat(build): scope dependency interfaces by edge visibility and add interface-defines by @ken-matsui in #2056
  • feat(build): order final-link system libraries by the dependency graph and add frameworks by @ken-matsui in #2057
  • feat(build): add per-source x86 instruction sets by @ken-matsui in #2058
  • feat(ports): build the boost stacktrace, contract, atomic, and log ports as upstream does by @ken-matsui in #2059
  • feat(index): resolve pinned packaging revisions with their own metadata by @ken-matsui in #2060
  • feat(test): forward arguments after -- to every test executable by @ken-matsui in #2061
  • feat(registry): serve each packaging revision its own resolution metadata by @ken-matsui in #2062
  • feat(test): run test executables concurrently with timeouts by @ken-matsui in #2063
  • feat(resolver): lock every platform's cfg dependencies in one lockfile by @ken-matsui in #2064
  • feat(test): write a JUnit report of the test run with --junit by @ken-matsui in #2065
  • feat(trace): capture opt-in performance traces with CABIN_TRACE_DIR by @ken-matsui in #2068
  • feat(build): build for another platform with --target by @ken-matsui in #2069
  • feat(bench): add the cargo perf benchmark harness by @ken-matsui in #2071
  • feat(build): rebuild everything when the detected toolchain changes by @ken-matsui in #2072
  • feat(trace): trace the build path, Ninja actions, and test runs by @ken-matsui in #2073
  • feat(build): build [build-dependencies] for the build machine by @ken-matsui in #2081
  • feat(run): run --target executables through a configured runner by @ken-matsui in #2084
  • feat(build): collect unused build outputs by @ken-matsui in #2088
  • feat(build): build against an explicit sysroot or the discovered Apple SDK by @ken-matsui in #2087
  • feat(bench): record where benchmark numbers come from and what each covers by @ken-matsui in #2096
  • feat(metadata): report build jobs and terminal settings in the config view by @ken-matsui in #2100
  • feat(toolchain): probe compile, link, and run checks; name a sysroot that cannot link by @ken-matsui in #2102
  • feat(build): give build dependencies the build machine's own toolchain under --target by @ken-matsui in #2110
  • feat(toolchain): pick the chosen compiler's siblings and name windows executables .exe by @ken-matsui in #2156
  • feat(build): plan against the supplied interfaces of system-provided targets by @ken-matsui in #2181
  • feat(workspace): load system packages cabin synthesizes in place of fetched ones by @ken-matsui in #2195
  • feat(build): take root-selected packages from the system through pkg-config by @ken-matsui in #2205
  • feat(build): take a multi-target package from the system with one module per target by @ken-matsui in #2263
  • feat(config): take [system-provided] entries from config files by @ken-matsui in #2273
  • feat(registry): restrict the hosted registry to its maintainer during private alpha by @ken-matsui in #2277

Performance Improvements

  • perf(registry): read per-user quota tallies instead of scanning account history by @ken-matsui in #1994
  • perf(toolchain): poll toolchain probes every millisecond, not every 10 by @ken-matsui in #2070
  • perf(ninja): rewrite generated build files only when their contents change by @ken-matsui in #2085
  • perf(index): read only the package documents resolution needs by @ken-matsui in #2092
  • perf(test): observe test exits as they happen instead of polling by @ken-matsui in #2094
  • perf(ninja): compare generated files in blocks and write them side by side by @ken-matsui in #2095
  • perf(resolve): fetch registry metadata in concurrent waves and batch lazy rounds by @ken-matsui in #2105
  • perf(toolchain): run the compiler and archiver version probes side by side by @ken-matsui in #2109
  • perf(index): box the per-revision resolution metadata by @ken-matsui in #2113
  • perf(toolchain): wait for a probed tool to exit instead of polling it by @ken-matsui in #2114
  • perf(gc): remove emptied directories once every product is removed by @ken-matsui in #2126
  • perf(toolchain): look up the apple sdk while the toolchain probes run by @ken-matsui in #2127
  • perf(port-publish): build preflight probes in parallel and report per-port phase times by @ken-matsui in #2124
  • perf(gc): skip recording a plan already recorded today and record one command at a time by @ken-matsui in #2145
  • perf(build): compare output paths as bytes instead of parsed components by @ken-matsui in #2188
  • perf(resolver): look up an unfetched package only when it has no candidates by @ken-matsui in #2199
  • perf(gc): stop syncing the build-output catalog by @ken-matsui in #2278

Fixes

  • fix(registry): strip canonical envelope from served version entries by @ken-matsui in #1494
  • fix(website): keep feature dividers off the first grid row by @ken-matsui in #1518
  • fix(website): unify restricted and under-development labels as private alpha by @ken-matsui in #1521
  • fix: harden registry surfaces and pin deploy toolchains by @ken-matsui in #1550
  • fix(registry): answer 503 not 402 when the budget breaker blocks by @ken-matsui in #1551
  • fix: validate registry versions as full semver and prune dead code and stale docs by @ken-matsui in #1552
  • fix(registry): harden the cost governor against under-count paths and prove fail-closed accounting by @ken-matsui in #1557
  • fix(port-publish): retry rate-limited publishes with the advertised delay by @ken-matsui in #1578
  • fix(test): give each test process its own pinned config home by @ken-matsui in #1591
  • fix(website): align the ports loader's rejections with the publisher by @ken-matsui in #1628
  • fix(port-publish): check every declared requirement for satisfiability by @ken-matsui in #1627
  • fix(core): retry interrupted reads in the hash primitives and share the loop by @ken-matsui in #1663
  • fix(xtask): kill the whole phase group when the gate unwinds by @ken-matsui in #1664
  • fix(registry): keep token timestamp checks under d1's glob pattern limit by @ken-matsui in #1690
  • fix(xtask): fail the registry-deploy wait fast when the same-sha deploy was skipped by @ken-matsui in #1694
  • fix(core): cap cfg expression nesting so hostile input cannot overflow the parser stack by @ken-matsui in #1696
  • fix(ci): drop the workflow path filters and the tests that read workflow files by @ken-matsui in #1699
  • fix(index-http): pin config packages/artifacts subdirs to the index url origin and path by @ken-matsui in #1697
  • fix(cli): gate the registry token override on a user-chosen index origin by @ken-matsui in #1701
  • fix(registry): refuse a scope claim started by a cross-site navigation by @ken-matsui in #1702
  • fix(core): reject target include dirs that escape the package root by @ken-matsui in #1703
  • fix(index): escape terminal control characters in registry-supplied error text by @ken-matsui in #1704
  • fix(ci): restore required checks by @ken-matsui in #1762
  • fix(registry-file): replace the lock file with an os advisory lock by @ken-matsui in #1815
  • fix(source-discovery): prune excluded directories before descending by @ken-matsui in #1816
  • fix(build): resolve the clean guard home dir through std::env::home_dir by @ken-matsui in #1818
  • fix(publish): resolve the registry per manifest and require batch agreement by @ken-matsui in #1820
  • fix(registry-file): tolerate the transient flock extension from concurrent process spawns by @ken-matsui in #1839
  • fix(registry): mint the verify scope only for the operator's login sessions by @ken-matsui in #1847
  • fix(registry): drain a refused streaming body so the connection carrying it stays usable by @ken-matsui in #1849
  • fix(registry): gate the login-session mint behind the per-ip admission budget by @ken-matsui in #1850
  • fix(registry): key the publish token bucket on the user instead of the token by @ken-matsui in #1852
  • fix(smoke): dump the dev-server log tails when a leg fails by @ken-matsui in #1853
  • fix(ports): define _LARGEFILE64_SOURCE so miniz 3.1.2 builds under strict c11 on gcc 14+ by @ken-matsui in #1897
  • fix(cli): validate locked patch state and enable update recovery by @ken-matsui in #1896
  • fix(registry-api): drop a publish revision that is not a packaging revision by @ken-matsui in #1898
  • fix(cli): keep unselected members' lockfile entries on member-scoped runs by @ken-matsui in #1900
  • fix(credentials): withhold stored sessions keyed to plain-http non-loopback origins by @ken-matsui in #1899
  • fix(xtask): refuse release tag names that could escape the windows packaging command by @ken-matsui in #1901
  • fix(xtask): give port-publish an exclusive random scratch directory by default by @ken-matsui in #1902
  • fix(xtask): make the deploy wait treat a missing registry run as pending, not as current by @ken-matsui in #1904
  • fix(registry): guard scope claims against confusable names inside the batch by @ken-matsui in #1903
  • fix(deps): bump rustls, webpki-roots and chacha20 past the open RUSTSEC advisories by @ken-matsui in #1915
  • fix(login): open the device page without a shell and only on the GitHub OAuth origin by @ken-matsui in #1916
  • fix(registry): cap the publish metadata frame at 1 MiB before hashing or parsing it by @ken-matsui in #1918
  • fix(artifact): escape archive entry names in extraction error messages by @ken-matsui in #1921
  • fix(explain): cap shortest-path reconstruction per root and flag truncated explanations by @ken-matsui in #1919
  • fix(workspace): honor a discovered root above a package only when it claims that package by @ken-matsui in #1922
  • fix(artifact): stage each download in an exclusively owned file before promotion by @ken-matsui in #1917
  • fix(registry): guard the verdict updates on the listing's checksum and published_at by @ken-matsui in #1934
  • fix(registry): refuse a revival whose published_at does not advance the rejected row's by @ken-matsui in #1936
  • fix(build): unwrap msvc .exe and .lib outputs in the link-failure hint by @ken-matsui in #1943
  • fix(deps): update registry crypto crates, tokio, and yaml past their advisories by @ken-matsui in #1951
  • fix(website): stop rendering placeholders for metadata ports never carry by @ken-matsui in #1958
  • fix(artifact): reject signed numbers in patch hunk ranges by @ken-matsui in #1946
  • fix(cli): stop claiming --exclude works with the no-flag default selection by @ken-matsui in #1966
  • fix(cabin-toolchain): stop calling MSVC unsupported when a compiler slot names link or lib by @ken-matsui in #1968
  • fix(resolver): explain a conflict without expanding its shared derivations by @ken-matsui in #1978
  • fix(registry): redirect browser flows to the website's trailing-slash pages by @ken-matsui in #1985
  • fix(website): let search paginate client-side when the static page has one page by @ken-matsui in #2008
  • fix(xtask): list both sides of renames when scoping the local gate by @ken-matsui in #1949
  • fix(xtask): run the binaries the registry xtasks just built, wherever the target dir is by @ken-matsui in #1947
  • fix(package): refuse to stage a package whose archive would leave out a declared source by @ken-matsui in #2024
  • fix(xtask): read an R2 listing's metadata-free last page as complete in the backup audit by @ken-matsui in #2027
  • fix(xtask): fail the freshness guard closed on git, sha, and filter-list errors by @ken-matsui in #2030
  • fix(xtask): fail the backup audit when the ledger understates an object count by @ken-matsui in #2031
  • fix(xtask): fail a migration-blocked registry deploy instead of skipping it green by @ken-matsui in #2032
  • fix(registry): fail the deploy job unless the tagged worker version serves all traffic by @ken-matsui in #2034
  • fix(driver): name the console subsystem in msvc links so an archive can provide main by @ken-matsui in #2048
  • fix(deps): update block-buffer to 0.12.1 past its advisory by @ken-matsui in #2066
  • fix(bench): judge a comparison by its candidate, not a baseline that cannot run a scenario by @ken-matsui in #2076
  • fix(build): drop stale members when rebuilding a static library by @ken-matsui in #2078
  • fix(build): resolve .. in the build directory the way the OS does by @ken-matsui in #2086
  • fix(ninja): track dependencies through paths Ninja cannot spell by @ken-matsui in #2089
  • fix(ninja): pass long archive and link commands through response files by @ken-matsui in #2093
  • fix(ninja): translate the depfile of a compile under a sysroot Ninja cannot spell by @ken-matsui in #2097
  • fix(trace): keep a build's Ninja actions when Ninja compacts its log by @ken-matsui in #2098
  • fix(profile): reject profile names that would share a build directory by @ken-matsui in #2099
  • fix(bench): verify check-run actions only from a log that kept its earlier entries by @ken-matsui in #2101
  • fix(ninja): keep each line of an msvc response file under the tools' line limit by @ken-matsui in #2106
  • fix(cli): resolve the build directory the same way in every command by @ken-matsui in #2107
  • fix(bench): tell real changes from noise and policy, calibrated on runs of one binary by @ken-matsui in #2108
  • fix(ninja): quote llvm-ar response files on windows the way it reads them by @ken-matsui in #2111
  • fix(ninja): read every path a depfile names as the compiler wrote it by @ken-matsui in #2112
  • fix(build): quote build-dependency archive response files for the build machine's archiver by @ken-matsui in #2115
  • fix(config): reject terminal settings in workspace and package config by @ken-matsui in #2119
  • fix(target): prevent non-portable names and artifact collisions by @ken-matsui in #2121
  • fix(bench): interleave the binaries run by run so load drift reaches both alike by @ken-matsui in #2128
  • fix(ports): retry the boost-process probe read a sigchld interrupts by @ken-matsui in #2131
  • fix(ninja): pass llvm-ar its response-file quoting so an old unknown version fails loudly by @ken-matsui in #2136
  • fix(build): isolate target-triple output namespaces by @ken-matsui in #2118
  • fix(bench): call a comparison of too few runs inconclusive, not unchanged by @ken-matsui in #2153
  • fix(xtask): escalate a teardown to sigkill after a grace period by @ken-matsui in #2173
  • fix(bench): fail a regression gate that could not tell either way by @ken-matsui in #2179
  • fix(run): give nested cabin the build root and refuse a nested clean of outputs in use by @ken-matsui in #2184
  • fix(xtask): name why the launch guard refused instead of a misleading cause by @ken-matsui in #2187
  • fix(build): name the profile directory compile commands run in by @ken-matsui in #2190
  • fix(toolchain): give version probes the deadline a cold xcrun lookup needs by @ken-matsui in #2191
  • fix(build): rebuild when INCLUDE or LIB changes by @ken-matsui in #2189
  • fix(build): compare output paths as the build directory's file system does by @ken-matsui in #2194
  • fix(driver): track clang-cl headers through its own depfile by @ken-matsui in #2192
  • fix(bench): age planted gc outputs past the kernel's fresh-file state by @ken-matsui in #2196
  • fix(bench): judge a comparison by its blocks, pairing the rounds both sides ran by @ken-matsui in #2198
  • fix(build): give each build directory one owning workspace by @ken-matsui in #2197
  • fix(ninja): write compile_commands.json argument arrays clang parses on every host by @ken-matsui in #2212
  • fix(build): refuse to clean through a symlinked directory below the build directory by @ken-matsui in #2206
  • fix(bench): size timed runs from a run made as they are, not from the check by @ken-matsui in #2204
  • fix(build): let a macro's highest-precedence definition win across profiles and targets by @ken-matsui in #2216
  • fix(build): never clean an unrecorded build directory or a file directly in one by @ken-matsui in #2215
  • fix(registry-api): store and print a session expiry in cabin's own utc rendering by @ken-matsui in #2207
  • fix(toolchain): resolve a relative compiler path before ninja changes directory by @ken-matsui in #2217
  • fix(explain): label a path with an edge that passes the filters by @ken-matsui in #2220
  • fix(resolve): fail instead of re-pinning a lock entry the index no longer lists by @ken-matsui in #2225
  • fix(index-http): refuse a plain-http index beyond loopback by @ken-matsui in #2226
  • fix(system-deps): give pkg-config the SemVer series a version requirement names by @ken-matsui in #2213
  • fix(build): let builds of one profile tree take turns running Ninja by @ken-matsui in #2223
  • fix(registry-file): propagate index read errors and stop labeling writes as reads by @ken-matsui in #2208
  • fix(build): choose the link driver from every linked object, through header-only targets by @ken-matsui in #2209
  • fix(core): encode the config fingerprint unambiguously by @ken-matsui in #2210
  • fix(config): resolve a source replacement's index path against its config file by @ken-matsui in #2211
  • fix(website): refuse unpublishable build dependencies and keep security.txt under a year by @ken-matsui in #2240
  • fix(cli): name both variables when verbosity settings conflict by @ken-matsui in #2233
  • fix(resolver): require every requirement to admit a selected pre-release by @ken-matsui in #2237
  • fix(registry): count pending revisions in the stuck-verifier alert and fix doc mismatches by @ken-matsui in #2248
  • fix(port-publish): report no probe run time in publish mode and correct the cli docs by @ken-matsui in #2241
  • fix(registry): read only the requested package for its document and edge-cache it by @ken-matsui in #2236
  • fix(tidy): match each source file literally in run-clang-tidy by @ken-matsui in #2229
  • fix(build): cut gc output paths at the package's obj dir and build unlocked on enotsup by @ken-matsui in #2228
  • fix(xtask): read the smoke token via cabin-env and bind the oversized verdict checksum by @ken-matsui in #2244
  • fix(registry-verify): ground the ratio-floor rationale and make its test exercise the floor by @ken-matsui in #2222
  • fix(registry): enforce publish quotas inside the publish batch by @ken-matsui in #2260
  • fix(registry): revoke the browser session server-side on logout by @ken-matsui in #2256
  • fix(cli): attribute compiling banners against each build context's own planned packages by @ken-matsui in #2246
  • fix(cli): name the dependency table a missing link symbol's owner is declared in by @ken-matsui in #2234
  • fix(fmt): report a clang-format error in check mode instead of unformatted files by @ken-matsui in #2232
  • fix(toolchain): bound the unknown compiler banner line and correct capability comments by @ken-matsui in #2227
  • fix(ports): respin libpng 1.6.50 so its zlib comment matches the private edge by @ken-matsui in #2252
  • fix(cli): honor --color in help and keep automatic color off for pipes by @ken-matsui in #2250
  • fix(manifest): reject package tables on a root without [package] and span inline tables by @ken-matsui in #2255
  • fix(ports): keep the sqlite3 version file out of its include root by @ken-matsui in #2259
  • fix(workspace): accurate source and requirement errors and safer scaffold namespaces by @ken-matsui in #2262
  • fix(build): stop an executable's own c default from hiding its public deps' requirements by @ken-matsui in #2247
  • fix(toolchain): run a tool a project names by path only for a project the user trusts by @ken-matsui in #2254
  • fix(tidy): let --fix run clang-tidy in parallel by @ken-matsui in #2230
  • fix(system-deps): translate partial semver comparators to equivalent pkg-config bounds by @ken-matsui in #2221
  • fix(cli): print curated help for bare cabin and correct command help text by @ken-matsui in #2264
  • fix(artifact): read a local index archive only from inside the index root by @ken-matsui in #2253
  • fix(config): use a registry a project config names only for a project the user trusts by @ken-matsui in #2266
  • fix(build): refuse registry include dirs that shadow standard headers by @ken-matsui in #2272
  • fix(vendor): apply source replacement before requiring a local index by @ken-matsui in #2285
  • fix(mangen): list the global options on subcommand man pages by @ken-matsui in #2286
  • fix(publish): refuse remote publish and yank under offline mode by @ken-matsui in #2289
  • fix(bench): give gc/clean-10k a recorded build directory to clean by @ken-matsui in #2291
  • fix(system-deps): refuse option-shaped pkg-config version operands by @ken-matsui in #2293
  • fix(registry): disable version urls for the registry worker by @ken-matsui in #2294
  • fix(workflow-guard): list only push runs in the registry-deploy wait by @ken-matsui in #2295
  • fix(vendor): read package metadata from the index's configured directory by @ken-matsui in #2296
  • fix(vendor): stage archives exclusively and refuse symlinks in vendor/ by @ken-matsui in #2301
  • fix(ports): add libpng 1.6.59 to replace the vulnerable 1.6.50 by @ken-matsui in #2300
  • fix(workspace): check the root owner SID before adopting a root on Windows by @ken-matsui in #2299
  • fix(toolchain): reject batch-file tools on Windows by @ken-matsui in #2302
  • fix(diagnostics): escape control characters in rendered error reports by @ken-matsui in #2303
  • fix(ports): drop the vulnerable libpng 1.6.50 port by @ken-matsui in #2305
  • fix(cli): escape control characters in json, argument errors, and printed paths by @ken-matsui in #2308
  • fix(registry): build the worker in a job that never holds the deploy token by @ken-matsui in #2307
  • fix(package): select a flate2 backend so cabin-package builds standalone by @ken-matsui in #2310

Other Changes

Full Changelog: 0.17.0...0.18.0

Contributors

ken-matsui and dependabot
Assets 9
Loading