chore: release v0.6.39 — ship pipeline auto-commit - #618
Merged
Conversation
…ockfile Manifest bumps (cargo upgrade --incompatible): rmcp 3.1.2 -> 3.1.4, which 8.0.5 -> 8.0.6, uuid 1.24.0 -> 1.26.0, aes-gcm 0.11.0 -> 0.11.1, libmimalloc-sys 0.1.44 -> 0.1.49, cc 1.2.63 -> 1.4.4. Lockfile refresh (cargo update): aes, chacha20, cpufeatures, crc32fast, flate2, h2, hyper, indexmap, libredox, log, miniz_oxide, syn. polars (0.55.2) and zerocopy (0.8.56) are already the latest releases. reqwest stays on 0.12 on purpose — the manifest comment records why (polars-io is still on the 0.12 line, and 0.13's platform verifier drags the Android JNI stack into the audit surface for a target we never ship). Supply chain, no blanket exemptions: publisher trust for cpufeatures (github:RustCrypto/utils), flate2 (Byron — trusted by mozilla), indexmap (cuviper — trusted by isrg, mozilla, bytecode-alliance) and syn (dtolnay), which also retired the flate2 and syn exemptions; chacha20, crc32fast, log and uuid deltas mirror the audits already recorded in the docenta / uffs-products repos by the same auditor; cpufeatures 0.3.0 -> 0.3.1, libredox 0.1.20 -> 0.1.21, miniz_oxide 0.8.9 -> 0.9.1 and which 8.0.5 -> 8.0.6 were reviewed here as full source diffs (notes in audits.toml). Unnecessary exemptions pruned. Vet-Reviewed-Diff: cpufeatures@0.3.0->0.3.1 Vet-Reviewed-Diff: libredox@0.1.20->0.1.21 Vet-Reviewed-Diff: miniz_oxide@0.8.9->0.9.1 Vet-Reviewed-Diff: which@8.0.5->8.0.6
nightly-2026-08-25+ trips clippy::empty_enums at every FromBytes derive site (never_type stabilized in rust#155499; zerocopy-derive's generated per-field enums lack the allow — google/zerocopy#3414, tracked in #617). Policy: no lint allow, no patch of a crate we do not own; wait for the upstream release and resolve by a dependency bump. 08-22..24 also failed toolchain-sync (clippy-driver exit 101 on the uffs-ci-pipeline test target) — noted, not root-caused while the 08-25+ block stands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
just shipPhase 2 auto-commit for v0.6.39 — the[workspace.package].versionbump inCargo.toml. This PR routes that commit through branch-protection rules. Once it merges tomain, runjust release-tagto cut the signedv0.6.39tag, which firesrelease.ymland builds the cross-platform binaries + GitHub Release v0.6.39. (No auto-tag on merge — the tag step is manual on-demand, Path B.)Auto-merge
--auto --squashis queued — GitHub will merge as soon as the required status checks pass. Squash is required becausemain-protectionmandates signed commits, and GitHub's rebase-auto-merge cannot sign the rebased commit; the squash-merge commit is signed by GitHub's own key, which satisfiesrequired_signatures: true. The original author's signed commit remains verifiable in the PR branch history.After merge
The auto-commit lived only on
release/v0.6.39, so localmainnever drifted — sync it with a plaingit pull --ff-only origin main(noreset --hardneeded).