Skip to content

release/v0.1.1 - Update CHANGELOG.md for release v0.1.1 #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
garotm merged 1 commit into from
Apr 28, 2026
Merged

release/v0.1.1 - Update CHANGELOG.md for release v0.1.1 #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,24 @@ _Changes staged for the next release go here during development._

---

## [0.1.1] — 2026-04-28

### Security

- **vite** upgraded `6.4.1` → `6.4.2`, resolving two CVEs in the Vite dev server (arbitrary file read via WebSocket — GHSA-p9ff-h696-f583, High; path traversal in optimised deps `.map` handling — GHSA-4w7w-66w2-5vf9, Moderate)
- **postcss** minimum bumped to `^8.5.10`, resolving a moderate XSS via unescaped `</style>` in CSS stringify output (GHSA-qx2v-qp2m-jg93)
- **rustls-webpki** `0.103.10` → `0.103.13`, resolving three CVEs: DoS via panic on malformed CRL BIT STRING (High); name constraints accepted for wildcard certificates (Low); name constraints for URI names incorrectly accepted (Low)
- **rand** `0.8.5` → `0.8.6` (transitive Tauri dependency; latest compatible patch)
- Replaced abandoned `pkg` (`vercel/pkg`, GHSA-22r3-9w55-cj54 — Local Privilege Escalation) with `@yao-pkg/pkg`, the actively maintained community fork; no API changes required

### Added

- `deny.toml` — cargo-deny configuration documenting two advisories that cannot be resolved at the project level due to upstream tauri ecosystem constraints (glib `RUSTSEC-2024-0403`, rand 0.7.x `RUSTSEC-2025-0009`); suppressed with full justification
- `backend/package.json` — `package:mac-arm` and `package:mac-x64` scripts for building the backend sidecar on macOS (Apple Silicon and Intel)
- `sift.mjs package` — now auto-detects host platform and selects the correct packaging target (Windows, macOS ARM, macOS Intel)

---

## [0.1.0] — 2026-04-08

### Added
Expand Down Expand Up @@ -47,5 +65,6 @@ _Changes staged for the next release go here during development._

---

[Unreleased]: https://github.com/fleXRPL/sift/compare/v0.1.0...HEAD
[Unreleased]: https://github.com/fleXRPL/sift/compare/v0.1.1...HEAD
[0.1.1]: https://github.com/fleXRPL/sift/compare/v0.1.0...v0.1.1
[0.1.0]: https://github.com/fleXRPL/sift/releases/tag/v0.1.0
Loading