SDK v0.2.3

Superseded by v0.2.4. This release's LICENSE files are an altered Apache License 2.0 text (the Trademarks clause, section 6, is missing; later sections are renumbered and reworded), and its lockfile has rustls-webpki 0.103.15 and webpki-root-certs 1.0.9 (RUSTSEC-2026-0382, RUSTSEC-2026-0383). v0.2.4 ships the verbatim license text and the patched versions; the packages' Apache-2.0 licensing is unchanged. This release's tag, assets and checksums are kept unchanged.

SDK 0.2.3

Packages: packdb-client 0.2.3 and packdb-otel 0.2.3.

• Redact API keys, bearer tokens and basic-auth credentials from diagnostic Debug output, including nested credential providers. Authentication headers and precedence are unchanged.
• Use Rustls 0.23.46, addressing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349.
• Document single-maintainer public operation and repair candidate runner compatibility.

This release supersedes SDK 0.2.0–0.2.2, whose committed lockfiles contain Rustls 0.23.45 and whose credential types can expose secrets if explicitly logged with Debug. No actual credential exposure was found in the reviewed repository history or Actions logs.

Downstream applications keep their own Cargo.lock. Update Rustls to at least 0.23.46 and audit that application lockfile; the SDK repository lockfile does not replace a consumer lockfile.

Packages retain publish = false. This source release does not publish crates to crates.io.

Qualified source: 9a720a7347b5a6d6bfcab685ed90024efdb8d3ba.

Full qualification: https://github.com/packdb-oss/packdb-sdk/actions/runs/39336855064 (attempt 1). The downloaded source archive matches this Git tree byte for byte; package/dependency inventories, checksums and provenance were verified.

GitHub attaches package inventories by filename. Put the package inventory files in package-inventories/ before checking the original SHA256SUMS.