-
-
Notifications
You must be signed in to change notification settings - Fork 313
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Release gix v0.65.0, gix-fsck v0.5.0, gitoxide-core v0.40.0, gitoxide…
… v0.38.0
- Loading branch information
Showing
3 changed files
with
6 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not clear on what caused the win-msvc installation test job to have failed here while passing in my fork. But I see you're rerunning it here so maybe that will be enough.
f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A botched release, and CI told me about it fortunately.
Very annoying:/
f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Will the latest version numbers for the
gitoxideandgitoxide-corecrates still begitoxide0.38.0 andgitoxide-core0.40.0?Because these releases do not contain a fix for CVE-2024-43785 (GHSA-88g2-r9rw-g55h, #1534), I'm going to change the versions the local and global GHSA advisories lists as affected from
<= 0.37.0and<= 0.39.1to instead be<= 0.38.0and<= 0.40.0, unless the upper bound is immediately about to change again.f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it will be
gitoxide-core0.41, andgitoxidestays at 0.38. And this is assuming it works now.The issue was that apparently,
gix-actorwasn't marked as breaking release even thoughgix-datewhich it dependent on was breaking.This caused a broken patch release of
gix-actor, which broke the current release and rendered all the newly released crates unusable after I yanked it.f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
But it looks like I can't release
gitoxideitself due to a verification failure (it doesn't compile with dependencies fromcrates.io) - will see what this is about. It's good thatgixis now released and probably not broken though.f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll wait a bit before editing the local advisory and opening a PR for the global advisory, in case they can be updated together, or in case the fix for the current situation ends up with other version numbers. But I'll bump the affected
gitoxide-coreversion without changing thegitoxideversion if it turns out that there will be a longer delay.f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see everything is green in b3ff033, which I'm guessing may mean the
gitoxiderelease can go ahead.Edit: Sorry, I didn't see #1536, which I am guessing is needed due to somehow not everything working out just yet.
f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
gitoxidecan't be released unfortunately, unless I re-release everything again which I would just postpone to next month.It turns out that workspace dependencies definitely were a contributing factor to having weird breakage, as this makes it possible to hide possibly breaking dependency updates.
f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That sounds very frustrating, and I also hope to learn more about it, since the effect of workspace dependencies is not something I fully grasp. However, it is no problem from my perspective, as far as updating the advisories is concerned:
gitoxide-core0.41 is released while no new version ofgitoxideis released, and no new version of either is planned to be released immediately, so I'll go ahead and update the crate version upper bound forgitoxide-corein the advisories, while leaving it as it was forgitoxide.f218578There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Per f218578#commitcomment-145670288 and f218578#commitcomment-145671469, I've edited just the
gitoxide-coreversion range. See #1534 (comment) and github/advisory-database#4715 for details.