Skip to content

chore: ship v0.5.103 (version bump + supply-chain vet) #318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
githubrobbi merged 2 commits into from
May 29, 2026
Merged

chore: ship v0.5.103 (version bump + supply-chain vet) #318

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3bee358
chore: development v0.5.103 - comprehensive testing complete [auto-co…
githubrobbi May 29, 2026
2e218c3
chore(supply-chain): vet 6 deps bumped by the v0.5.103 ship cargo-update
githubrobbi May 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -735,15 +735,15 @@ hunting for the wrong things.

Plan §1 goal-4 ("no regression on CLI hot path vs the v0.5.35
baseline") verified end-to-end on the Windows 7-drive reference
box. Current v0.5.102 (post-Phase-8 tiered architecture) is
box. Current v0.5.103 (post-Phase-8 tiered architecture) is
**universally faster** than v0.5.35 across every benchmarked
pattern, with the largest result set (`*.dll`, 44 529 rows)
showing a **2.7× speedup**:

```
Drive D, 7.07 M records, 30 rounds, HOT phase, p50 / p95 wall_ms:

v0.5.35 v0.5.102 Δ p50
v0.5.35 v0.5.103 Δ p50
exact (3 rows) 20 / 23 → 18 / 19 −10 %
prefix (8 732) 46 / 50 → 40 / 46 −13 %
ext_rare (11) 18 / 20 → 17 / 18 −6 %
Expand Down Expand Up @@ -919,7 +919,7 @@ log-message renames fail CI before reaching another 24-h soak.
2026-05-13. No new operator-surface features land on `main`
until v0.6.0 ships.

## [0.5.102] - 2026-05-08
## [0.5.103] - 2026-05-08

> **Note on the v0.5.91 gap.** v0.5.91 was prepared and tagged but never
> reached a published GitHub Release: the `release.yml` finalize step hit
Expand All @@ -928,7 +928,7 @@ log-message renames fail CI before reaching another 24-h soak.
> partial release was deleted, the tag name became permanently locked by
> GitHub's *immutable releases* feature (the pre-receive hook refuses any
> future ref creation under that name even after a clean delete). The
> public release sequence therefore jumps `v0.5.90 → v0.5.102`; all
> public release sequence therefore jumps `v0.5.90 → v0.5.103`; all
> intended v0.5.91 changes are rolled forward into this release.

### Fixed
Expand Down
4 changes: 2 additions & 2 deletions CITATION.cff
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,8 @@ license-url: "https://github.com/skyllc-ai/UltraFastFileSearch/blob/main/LICENSE
# Keep this in sync with [workspace.package].version in Cargo.toml.
# The release pipeline (release-plz / just ship) should bump this automatically
# once Pattern 5 in build/update_all_versions.rs is extended to cover CITATION.cff.
version: "0.5.102"
date-released: "2026-05-20"
version: "0.5.103"
date-released: "2026-05-29"

# ── Classification ───────────────────────────────────────────────────────────
type: software
Expand Down
62 changes: 31 additions & 31 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 10 additions & 10 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ members = [
# Workspace Package Metadata (inherited by all crates)
# ─────────────────────────────────────────────────────────────────────────────
[workspace.package]
version = "0.5.102"
version = "0.5.103"
edition = "2024"
# No `rust-version` claim: the workspace is structurally nightly-only.
# `crates/uffs-polars` enables `polars/nightly` unconditionally, which
Expand Down Expand Up @@ -118,21 +118,21 @@ publish = false
# proposed-plan output for 12 days because `release-plz update`
# failed at `cargo package` with this very error. See
# `release-automation-baseline.md` §10 for the diagnostic trail.
uffs-polars = { path = "crates/uffs-polars", version = "0.5.102" }
uffs-security = { path = "crates/uffs-security", version = "0.5.102" }
uffs-text = { path = "crates/uffs-text", version = "0.5.102" }
uffs-time = { path = "crates/uffs-time", version = "0.5.102" }
uffs-mft = { path = "crates/uffs-mft", version = "0.5.102" }
uffs-format = { path = "crates/uffs-format", version = "0.5.102" }
uffs-core = { path = "crates/uffs-core", version = "0.5.102" }
uffs-client = { path = "crates/uffs-client", version = "0.5.102" }
uffs-polars = { path = "crates/uffs-polars", version = "0.5.103" }
uffs-security = { path = "crates/uffs-security", version = "0.5.103" }
uffs-text = { path = "crates/uffs-text", version = "0.5.103" }
uffs-time = { path = "crates/uffs-time", version = "0.5.103" }
uffs-mft = { path = "crates/uffs-mft", version = "0.5.103" }
uffs-format = { path = "crates/uffs-format", version = "0.5.103" }
uffs-core = { path = "crates/uffs-core", version = "0.5.103" }
uffs-client = { path = "crates/uffs-client", version = "0.5.103" }
# `uffs-broker-protocol` carries the wire-protocol types shared between
# `uffs-broker` (the elevated handle vendor, Windows-only binary) and
# `uffs-daemon::broker_client` (the handle consumer). Pure-logic
# Layer-0 lib — cross-platform tests run on every CI lane. Added in
# F5 (issue #205) so neither side duplicates `BROKER_PIPE_NAME` /
# wire-format byte literals.
uffs-broker-protocol = { path = "crates/uffs-broker-protocol", version = "0.5.102" }
uffs-broker-protocol = { path = "crates/uffs-broker-protocol", version = "0.5.103" }
# NOTE: no `uffs-broker` workspace dependency alias on purpose —
# `uffs-broker` is a binary-only crate (the only `[lib]` it carries is
# this protocol module's now-extracted sibling); no other workspace
Expand Down
2 changes: 1 addition & 1 deletion rust-toolchain.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
# Run `just toolchain-sync` to re-attempt a channel bump; the CI
# pipeline auto-refreshes on `ship --fresh` unless `--skip-toolchain-sync`
# is passed.
channel = "nightly-2026-05-20"
channel = "nightly-2026-05-29"

# Specify components that should always be available
components = [
Expand Down
36 changes: 36 additions & 0 deletions supply-chain/audits.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,18 @@ criteria = "safe-to-deploy"
version = "3.1.1"
notes = "Reviewed v3.1.1 source. Scope: ANSI terminal coloring. One unsafe block in control.rs (Windows Console FFI via windows-sys: GetStdHandle / GetConsoleMode / SetConsoleMode) — standard Win32 terminal setup, properly cfg(windows)-gated. No network I/O, no filesystem writes, no process spawning. Only std types plus windows-sys on Windows. Dev-deps (rspec, insta, ansiterm) are standard testing crates. MPL-2.0 licensed, same as our workspace."

[[audits.crypto-common]]
who = "Robert Nio <robert_nio@intuit.com>"
criteria = "safe-to-deploy"
delta = "0.1.6 -> 0.2.2"
notes = "Delta audit (cargo vet diff 0.1.6 -> 0.2.2). Files: Cargo.toml/Cargo.toml.orig (version + metadata: autolib/autobins/resolver=2, switch generic-array -> hybrid_array dep), CHANGELOG/README/LICENSE-MIT (text), src/lib.rs, src/hazmat.rs, new src/generate.rs. Net unsafe blocks added: 0 (grep confirms the only 'unsafe' token added is a Clippy lint declaration 'undocumented_unsafe_blocks = warn'). New generate.rs is pure-safe key/IV generation over rand_core CryptoRng/TryCryptoRng traits (hybrid_array Array<ArraySize>), no FFI / I/O / process / network / ambient capability. The 0.2 line is the known RustCrypto API restructuring (generic-array -> hybrid_array); behavior of the trait surface is otherwise preserved. Same publisher (github:RustCrypto/traits) the repo already trusts for 'digest'."

[[audits.either]]
who = "Robert Nio <robert_nio@intuit.com>"
criteria = "safe-to-deploy"
delta = "1.15.0 -> 1.16.0"
notes = "Delta audit (cargo vet diff 1.15.0 -> 1.16.0). Files: Cargo.toml(.orig) version bump, .github/workflows/ci.yml + README.rst (non-shipping), src/lib.rs, src/iterator.rs, src/serde_untagged.rs, src/serde_untagged_optional.rs. The only two 'unsafe' lines changed are NOT new: the existing Pin::new_unchecked projections in as_pin_ref/as_pin_mut, merely renamed from the internal map_either! macro to map_both!; the documented SAFETY invariant and runtime behavior are unchanged. Remainder is added safe iterator/serde trait impls. No new FFI / I/O / process / network / ambient capability. Publisher cuviper (rayon/itertools maintainer)."

[[audits.hashbrown]]
who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>"
criteria = "safe-to-deploy"
Expand All @@ -25,6 +37,18 @@ criteria = "safe-to-deploy"
version = "0.5.2"
notes = "Reviewed v0.5.2 source. Transitive dep of num_cpus. Two files: errno.rs is pure i32 constants (EPERM, ENOENT, ...); lib.rs is #![no_std] FFI declarations for the Hermit unikernel syscall interface (sys_mmap, sys_getpagesize, sys_errno, thread scheduling primitives, ...) plus two unsafe wrapper fns for get/set_priority. No network I/O, no filesystem I/O, no std dependency. On non-Hermit targets the extern C symbols are never linked and the functions are inert — num_cpus only touches hermit-abi when target_os=hermit, which none of our shipping targets hit. Apache-2.0 OR MIT; author Stefan Lankes, Hermit OS project lead."

[[audits.libmimalloc-sys]]
who = "Robert Nio <robert_nio@intuit.com>"
criteria = "safe-to-deploy"
delta = "0.1.47 -> 0.1.48"
notes = "Delta audit (cargo vet diff 0.1.47 -> 0.1.48). build.rs: restructured MSVC path to compile the vendored mimalloc via a generated OUT_DIR C++17 wrapper (mimalloc-static.cc that #includes static.c) because mimalloc needs the C++ atomics path under MSVC/clang-cl; non-MSVC keeps the direct C build. All paths derive from CARGO_MANIFEST_DIR/OUT_DIR (no untrusted input); fs::write only emits the #include wrapper into OUT_DIR (standard build-script practice). Vendored C is an upstream point-release SYNC of official microsoft/mimalloc: v2 MI_MALLOC_VERSION 20301->20302 (2.3.1->2.3.2) and v3 30301->30302 (3.3.1->3.3.2). Reviewed the 3272-line C delta for injected logic: no network/socket, no system/exec/popen, no LD_/DYLD_ env hijack, no exfil/base64/eval introduced; changes are confined to the version-pinned v2/ and v3/ trees and match upstream patch releases. extended.rs: no functional code change. Audited at the level appropriate for a vendored-allocator upstream sync (verify provenance + capability surface), not a line-by-line review of allocator C internals."

[[audits.mimalloc]]
who = "Robert Nio <robert_nio@intuit.com>"
criteria = "safe-to-deploy"
delta = "0.1.50 -> 0.1.51"
notes = "Delta audit (cargo vet diff 0.1.50 -> 0.1.51). Only .gitignore, Cargo.toml, Cargo.toml.orig changed: version bump 0.1.50->0.1.51, libmimalloc-sys dep 0.1.47->0.1.48, and one new passthrough feature 'win_direct_tls = [libmimalloc-sys/win_direct_tls]'. ZERO .rs source changes. No new unsafe / FFI / I/O / capability in this wrapper crate."

[[audits.num-conv]]
who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -175,6 +199,12 @@ trusted-publisher = "github:wasm-bindgen/wasm-bindgen"
start = "2026-04-28"
end = "2027-05-20"

[[trusted.memchr]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
start = "2019-07-07"
end = "2027-05-29"

[[trusted.mime]]
criteria = "safe-to-deploy"
user-id = 359 # Sean McArthur (seanmonstar)
Expand All @@ -193,6 +223,12 @@ user-id = 359 # Sean McArthur (seanmonstar)
start = "2019-03-04"
end = "2027-04-23"

[[trusted.serde_json]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-02-28"
end = "2027-05-29"

[[trusted.tower-http]]
criteria = "safe-to-deploy"
user-id = 359 # Sean McArthur (seanmonstar)
Expand Down
Loading
Loading