0.8.0

First release on the new safe foundation: #![forbid(unsafe_code)], builders, explicit lifecycle control (keep / persist / close / drop_async), unpredictable names, and path-separator-safe affixes.

Added

• Builders TempFile::builder() / TempDir::builder() for configuring name prefix, suffix and target directory before creation. (#11)
• keep to disable automatic deletion and persist to move a temporary file or directory to a permanent location. On failure persist leaves the temporary intact and reports its path via PersistError. (#12)
• close(self) -> io::Result<()> — synchronous, error-observable deletion; the sibling of drop_async. On a deletion error it disarms and leaves the file/directory in place for the caller to handle. (#15)
• drop_async now removes the file or directory via tokio::fs directly when it is the sole owner, instead of offloading a synchronous drop to a blocking thread. The synchronous Drop remains an always-armed backstop. (#1)

Changed

• The crate now declares #![forbid(unsafe_code)]. The previous ManuallyDrop / unsafe drop machinery was replaced by safe code that relies on struct field drop order to close the file handle before the file is deleted.
• persist returns a PersistError on failure that carries the path of the still-intact temporary, so a failed move (for example cross-device) no longer deletes the data. The local handle is closed before the rename, so the move also succeeds on Windows.
• Unpredictable names: automatically generated temporary names are now seeded from the OS RNG (via RandomState, with a per-process counter for guaranteed local uniqueness) and created with an exclusive (O_EXCL) create, closing a predictable-name / preexisting-file race. User-supplied names keep their previous create-or-open behavior.
• Path-separator-safe affixes: a prefix/suffix containing a path separator is now rejected with the new Error::InvalidAffix, so a composed name can no longer escape the target directory (../ traversal or an absolute-path replacement). (#14)
• Bumped the crate to Rust edition 2024 with a declared MSRV of 1.85.

Internal

• Test coverage raised from ~67% to ~94%. (#16)

Note for 0.x consumers

Error::InvalidAffix is a new variant on the public Error enum (not #[non_exhaustive]), so exhaustive matches over Error need a new arm. Acceptable under pre-1.0 semver, called out here for clarity.

Full changelog: v0.7.0...v0.8.0