Skip to content

v0.2.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 03:53
· 4 commits to main since this release
v0.2.6
7332498

Maintenance release. No behavioral changes to the library or CLI —
security fixes, an MSRV raise, dependency bumps, and CI housekeeping
only.

Security

  • deps: bumped rustls 0.23.43 → 0.23.46, clearing RUSTSEC-2026-0285
    (TLS 1.3 handshake messages were accepted at the wrong encryption
    level when they followed a key-changing message in the same record),
    and faster-hex (transitive, via gix-hash) 0.10.0 → 0.10.1,
    clearing RUSTSEC-2026-0306 (the AVX2 path of the safe
    hex_decode_unchecked read past the end of a short src).
  • deps: refreshed the lockfile, clearing RUSTSEC-2026-0258 (h2
    0.4.13 → 0.4.19; empty DATA frames were accepted and queued without
    limit, so a stream that is not actively drained could grow memory
    unboundedly or panic on length overflow) and RUSTSEC-2026-0253 (lru
    0.16.4 → 0.18.3; LruCache::pop() was not panic-safe, leaving
    dangling pointers in the intrusive list when a key's Drop panicked,
    which a later eviction would then dereference). lru is reachable
    only through aws-sdk-s3, which pinned lru ^0.16.3 until 1.144.0 —
    so the fix carries aws-sdk-s3 1.137.0 → 1.144.0 and aws-config
    1.8.18 → 1.11.0 with it. The same refresh moves chacha20 off the
    yanked 0.10.0.
  • deps: bumped event-listener (transitive, via azure_core →
    async-lock) from 5.4.1 to 5.4.2, clearing RUSTSEC-2026-0221
    (StackSlot<'_, T> unconditionally implements Send/Sync, letting
    a !Send tag set via Event::with_tag cross a thread boundary and
    race in safe code).

Changed

  • msrv: raised the minimum supported Rust version from 1.94 to 1.96.
    aws-sdk-s3 1.144.0 and aws-config 1.11.0 require 1.94.1, and
    kstring 2.0.3 (transitive, via gix-attributes) requires 1.96;
    taking 1.96 keeps the lockfile on the newest release of each rather
    than pinning dependencies back to hold an older floor.
  • build: .cargo/config.toml now sets resolver.incompatible-rust-versions = "fallback", so cargo update prefers dependency versions that still
    satisfy the workspace rust-version instead of silently selecting one
    that no longer builds on the declared floor.
  • deps: bumped direct dependencies within their existing requirements:
    async-trait 0.1.92, aws-config 1.12.0, aws-smithy-http-client
    1.4.0, azure_storage_blob 1.1.0, bytes 1.12.1, clap 4.6.7,
    flate2 1.1.10, futures 0.3.34, gix-validate 0.11.4, reqwest
    0.13.5, serde 1.0.229, serde_json 1.0.151, thiserror 2.0.20,
    time 0.3.55, tokio 1.53.1, and uuid 1.28.0.
  • ci: bumped pinned GitHub Actions in the actions Dependabot group,
    including actions-rust-lang/setup-rust-toolchain 1.17.0 → 2.0.0,
    which no longer sets RUSTFLAGS="-D warnings" by default. Clippy
    still runs with -D warnings, so lint enforcement is unchanged.

Documentation

  • release: corrected docs/development/cutting-a-release.md, which
    instructed a release: commit subject that CI's commitsar job always
    rejects (release is not a conventional-commit type) and a
    git-remote-object-store-cli publish dry-run that cannot succeed
    before the library is on crates.io. The pre-flight now also pins
    cargo-deny to CI's version, and the watch step covers the CI workflow
    alongside Release.
Assets 57
Loading