chore: release 1.3.1, bump rand to 0.8.6 - #37
Merged
Conversation
Dependabot fired its first alert the moment the security fix landed on `dev` (GHSA-cq8v-f236-94qc, low): rand < 0.8.6 is unsound with a custom logger using `rand::rng()`. gitveil calls `OsRng.fill_bytes` directly and never installs a custom logger, so it was not affected — but the bump is free and clears the alert. `cargo audit` is now down to one warning, RUSTSEC-2026-0190 in anyhow. `cargo tree -i anyhow --target all` prints nothing: it is a Cargo.lock entry that is not reachable in the resolved graph, so it is not compiled into the binary. Version bumped for the release carrying the key-name injection fix (#28) and the GPG hardening (#29). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TYMP8eH52L6rNdjbukfuyZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release prep for the security fixes in #28 and #29.
rand0.8.5 → 0.8.6Dependabot fired its first ever alert the moment #28 landed on
dev— GHSA-cq8v-f236-94qc (low),rand < 0.8.6is unsound with a custom logger usingrand::rng(). The advisory was published 2026-04-14; the alert was created at 10:34:41Z today, seconds after the merge. It had simply never scanned the default branch before.gitveil is not affected — it calls
OsRng.fill_bytesdirectly and never installs a custom logger — but the bump is free and clears the alert. Lockfile only;Cargo.tomlalready saysrand = "0.8".Remaining audit warning
cargo auditis down to one: RUSTSEC-2026-0190 inanyhow.cargo tree -i anyhow --target allprints nothing, so it's aCargo.lockentry that isn't reachable in the resolved dependency graph and isn't compiled into the binary. Left alone rather than regenerating the whole lockfile immediately before a release.Version
1.3.0 → 1.3.1.
Verification
cargo fmt --check,cargo clippy --all-targets -- -D warnings, 131/131 tests,cargo audit— clean locally.🤖 Generated with Claude Code
https://claude.ai/code/session_01TYMP8eH52L6rNdjbukfuyZ