chore: release 0.4.0 - #91
Merged
Merged
Conversation
Bump the workspace version for release. 0.4.0 rather than 0.3.1 because this cycle changes behaviour an operator can be broken by: policy validation now rejects rule names that collide with the guard's own synthetic ones, so a policy that started under 0.3.0 can fail at startup (#84). Pre-1.0, that is what the minor position is for. crates/bugwarden/Cargo.toml pins its bugwarden-core dependency by version as well as path, so that requirement moves in lockstep — the build fails loudly otherwise, which is how this was caught. The man page embeds the version, so regenerate the committed assets; the completions carry none and are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump for the 0.4.0 release. Per AGENTS.md the bump lands as a normal PR first; the annotated tag then goes on the merge commit and
release.ymldoes the rest.Why 0.4.0 and not 0.3.1
35 commits since
0.3.0(2026-08-03), and one of them changes behaviour an operator can be broken by: #84 makesPolicy::validatereject rule names colliding with the guard's synthetic ones, so a policy that started under 0.3.0 can now fail at startup. Pre-1.0, that belongs in the minor position.What's in the cycle
Features
--allowed-hostsfor inbound host validation on the HTTP transportbugzilla_products,bug_fields), gated behindglobal.allow_discovery(I16)bug_fieldsUser-Agentidentifying this build to Bugzilla, and the build named in the MCP handshakeFixes
suppressed_countis a total, not a maximum of two disjoint tallies (suppressed_count is a max() of two unrelated tallies, not a count #68)Docs — the
guard.ruleencoding (#67), the audit stream and MCP surface in the README, the TLS trust-store trade-off, the stateless-metadata decision for #34, and a fullStreamableHttpServerConfiginventory.Build/CI — rmcp 3.1, reqwest 0.13, sha2 0.11, dependency refreshes, and a scoped copyleft exemption for the
rust-cacheaction.What this PR touches
Cargo.toml[workspace.package] version→0.4.0crates/bugwarden/Cargo.tomlbugwarden-coredependency pinsversionas well aspath, so it moves in lockstepCargo.lockcrates/bugwarden/man/bugwarden.1The completions carry no version string and are unchanged, which
rust-assets-driftconfirms.The
bugwarden-coreversion requirement is worth noting: nothing single-sources it, so it has to be bumped by hand every release. It fails the build loudly rather than silently resolving a stale core, which is how it was caught here.Verification
cargo fmt --check, both clippy invocations,cargo test --workspace --all-targets --locked(431 passed, 0 failed), andcargo deny checkall pass. Assets regenerated from the clap CLI and re-diffed.