New Release

[valoq]

@marcospb19 I think we should get the rest of the current open dependency version bumps and fixes merged before a new release and continue with version number 0.8.0 for now. #968 also seems like a requirement since it closes a vulnerability in the old unmaintained unrar which is actively exploited

[marcospb19]

1. I was thinking of going to 1.0 so that we can adhere to semver, not because it'd be a relevant release, other than fixing most notable usability issue with Ouch deleting people's folders (which was the biggest ouch problem ever, I think), I also thought about communicating that in the release.

I was following "cargo semver" which is different from real Semver, this is the difference summary:

This compatibility convention is different from SemVer in the way it treats versions before 1.0.0. While SemVer says there is no compatibility before 1.0.0, Cargo considers 0.x.y to be compatible with 0.x.z, where y ≥ z and x > 0.

By having major, minor and patch we can tell users when there is a breaking change, wdyt.

2. Was the old unrar exploited? I didn't find anything in their issues.

3. About the version bumps, sure I can do these before a new release.

[valoq]

Regarding the version, Im fine with the change, just prefer to avoid the version 1 for now since that kindof implies no breaking changes in the future (until next major release), and I already found a bug in the current extraction that would need that change. (PR follows tomorrow)

I think the CVE I had in mind was https://nvd.nist.gov/vuln/detail/CVE-2025-6218
https://cybersecuritynews.com/winrar-0-day-rce-vulnerability-exploited/
its in the c unrar lib backend which is used by both unrar and unrar-ng but only unrar-ng has the updated library version with the fix.

[marcospb19]

since that kindof implies no breaking changes in the future (until next major release), and I already found a bug in the current extraction that would need that change.

I'm kinda OK with going 2.0 a week after 1.0, if we commit to that. But I see your point it's kinda weird for what some people might major versions to represent (like we're dealing with a product release, not real SEMVER).

[valoq]

I'm kinda OK with going 2.0 a week after 1.0

Lets try to avoid that :)

I think it is ok though to go with 1.0.0 for the next release. #996 implements the last behavior changes for extraction (or rather fixes them)
The currently planned feature changes like sandbox support will fit well into version 1.1.0 I think.