From 56cec84624f0673bd2021fc6a794ae6baec5e2f8 Mon Sep 17 00:00:00 2001 From: "Aaron K. White" Date: Sun, 6 Sep 2026 08:58:42 -0400 Subject: [PATCH] =?UTF-8?q?release:=20v2026.9.0=20=E2=80=94=20audit=20work?= =?UTF-8?q?flow=20repair=20and=20RUSTSEC=20cleanup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Version bump and changelog date for the work already on main: the Security Audit toolchain fix and the five advisories it surfaced once it could run. Also fixes the second half of the workflow misconfiguration. The audit job is a required status check on main, but it only triggered on push and schedule, so it never reported on a pull request — and a required check that never reports blocks the PR forever. Both PRs in this series had to be merged with --admin. It now runs on every pull request with no path filter; the push trigger keeps its filter. The matching branch protection context is updated separately, from "Security Audit" (the workflow name, which nothing publishes) to "Dependency Audit" (the job name, which is what actually reports). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd --- .github/workflows/audit.yml | 5 +++++ CHANGELOG.md | 3 ++- Cargo.lock | 2 +- Cargo.toml | 2 +- 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index e7650f7..1354356 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -4,6 +4,11 @@ on: push: branches: [main] paths: [Cargo.lock, Cargo.toml] + # No paths filter here on purpose. This job is a required status check on + # main, and a required check that is skipped never reports — it leaves the + # PR permanently blocked. It must run on every pull request. + pull_request: + branches: [main] schedule: - cron: "0 0 * * 0" workflow_dispatch: diff --git a/CHANGELOG.md b/CHANGELOG.md index 35b9955..eefdece 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,13 @@ All notable changes to linear-cli will be documented in this file. Versioning follows [CalVer](https://calver.org/) with format `YYYY.MM.PATCH`. -## [Unreleased] +## [2026.9.0] — 2026-09-06 The weekly Security Audit workflow had been failing since 2026-07-19 without running its audit, so five advisories accumulated undetected. The workflow is fixed and all five are cleared. Severity: LOW — one advisory was reachable in principle and rated low by upstream; the rest were unreachable, dev-only, or lockfile-only. ### Fixed - Security Audit workflow now builds `cargo-audit` with the latest stable toolchain. `rustsec/audit-check` installs the tool unlocked, so it resolved `kstring 2.0.4`, which requires rustc 1.96 — the job's pinned 1.94 channel could not compile it, and the audit had not actually run for seven consecutive weeks. `RUSTUP_TOOLCHAIN` now overrides `rust-toolchain.toml` for that job only; the crate's pinned channel is unchanged everywhere else. +- Security Audit now runs on every pull request, with no path filter. It is a required status check on `main`, and a required check that is skipped never reports its status — so any PR that did not touch `Cargo.toml` or `Cargo.lock` was left permanently unmergeable. The `push` trigger keeps its path filter. ### Security - Bumped `crossbeam-epoch` to 0.9.20 to patch RUSTSEC-2026-0204 (invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared`). Transitive via `termimad` — `lin` never formats those types. diff --git a/Cargo.lock b/Cargo.lock index 98cc425..13cb67a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1184,7 +1184,7 @@ dependencies = [ [[package]] name = "lincli" -version = "2026.5.5" +version = "2026.9.0" dependencies = [ "anyhow", "assert_cmd", diff --git a/Cargo.toml b/Cargo.toml index af3ddec..ee5dd7a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "lincli" -version = "2026.5.5" +version = "2026.9.0" edition = "2024" description = "Fast, agent-friendly Linear CLI — manage issues, projects, cycles from the terminal" license = "MIT"