release: v0.2.0 - #39
Open
krishnamallam wants to merge 1 commit into
Open
Conversation
Dates the CHANGELOG heading and marks v0.2 shipped in ROADMAP.md, which the release checklist requires before the tag goes up. Also fills two gaps in the v0.2.0 entry. It was written before the adversarial review, so it did not mention two user-facing security outcomes that shipped: - Credentials in the URL query string are no longer stored. `path` is recorded with the query attached and Google accepts an API key there, so `?key=...` was written verbatim. This is the same defect as the header leak and less recoverable, since `path` is chained directly rather than via a digest and retention could never clear it. The rotate-and-delete advice covers it. - The dashboard no longer writes to or migrates the database. Both belong under Security in a release whose headline fix is a credential leak. Removed a duplicated read-only note from Changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release prep for v0.2.0. Version was already bumped in #38; this covers what the release checklist requires before the tag.
Changes
CHANGELOG.md:## v0.2.0 (unreleased)→## v0.2.0 (2026-08-03)ROADMAP.md: v0.2 marked shippedpathis stored with the query attached and Google accepts an API key there, so?key=...was written verbatim. Same defect as the header leak and less recoverable, sincepathis chained directly rather than via a digest, so retention could never clear it afterwards.Both belong under Security in a release whose headline fix is a credential leak.
Pre-flight
main(dashboard: format NDJSON / SSE / form-encoded bodies in the Body tab #37, v0.2: tamper-evident audit log, retention, at-rest hardening (and the AI Act date correction) #38)main(f7e4ea7)uv run upbox --helpworks on a clean checkout, all six new commands registeredpyproject.tomlandupbox/__init__.pyboth at0.2.0After merging
Pushing the
v0.2.0tag triggersrelease.yml, which verifies the tag matches the pyproject version, builds the sdist and wheel, publishes to PyPI asupbox-sh, and creates the GitHub release with generated notes.PyPI versions cannot be reused, so the tag is the point of no return for
0.2.0.