release: v0.8.1 — audit-driven hardening#101
Merged
Merged
Conversation
4 tasks
Bumps Cargo.toml, MODULE.bazel, src/cli/BUILD.bazel, and Cargo.lock to 0.8.1. Adds CHANGELOG.md (new file, repo did not have one) with the full release notes. This release closes 26 of 33 findings from the 2026-04-30 14-perspective audit. Specific fix-PRs are #96 (STPA-Sec / docs), #97 (hygiene), #98 (parser hardness), #99 (formal-verif honesty + CI), #100 (keyless / OIDC hardening). Two findings (cert-pinning enforcement, no_std verifier) are deferred to issue #95 and issue #79 respectively. Note on H-8 (version drift): MODULE.bazel and src/cli/BUILD.bazel were at 0.2.7 on main; this commit takes them straight to 0.8.1. PR #97 also bumps these to 0.8.0 as part of its H-8 fix; whichever PR merges last has a trivial conflict that resolves to 0.8.1. Trace: skip Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced May 1, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge LAST, after #96, #97, #98, #99, #100.
Bumps version to 0.8.1 and adds the project's first
CHANGELOG.mdwith the full release notes. Closes 26 of 33 findings from the 2026-04-30 14-perspective audit (audit/2026-04-30/).What's in the release
This PR is the version-bump capstone. The actual fixes live in five fix-PRs:
See CHANGELOG.md for the per-finding release notes (Security / Hardening / Honesty / CI / DX / Deferred sections).
Deferred findings (filed as separate issues)
Merge ordering
This PR conflicts with #97 on `MODULE.bazel` and `src/cli/BUILD.bazel` (audit H-8 — version drift fix). Both branches end at the same value (`0.8.1` here, `0.8.0` in #97), so the conflict is trivial:
Recommended order: #96, #98, #100 in any order (no overlap), then #99 and #97 together (both touch `.github/workflows/rust.yml` — small overlap on `paths:` / `bazel test` blocks), then this PR.
Test plan
After merge: tag `v0.8.1` and let the release workflow run.