chore: prepare 0.6.7 release

[hardbyte]

Summary

Prepare the 0.6 maintenance line for v0.6.7.

• bump all Rust and Python package versions, internal pins, and generated locks to 0.6.7
• publish the credential-redaction fix already merged in fix(cli): hide DATABASE_URL value from help #477
• update the bundled UI lockfile from vulnerable seroval 1.5.1 to patched 1.5.6 (the same scoped update as build(deps): bump seroval from 1.5.1 to 1.5.6 in /awa-ui/frontend #453)
• update h2 to 0.4.16 in both Rust lockfiles and crossbeam-epoch to 0.9.20 in the main lockfile, resolving the current RustSec advisories
• add focused release notes, including credential-rotation guidance when old help output was captured or shared

This patch has no migrations, schema changes, or public API changes.

Validation

• cargo fmt --all -- --check
• SQLX_OFFLINE=true cargo clippy --all-targets --all-features -- -D warnings
• SQLX_OFFLINE=true cargo build --workspace
• cargo test -p awa-cli --test help_cli_test (3 passed)
• cd awa-python && SQLX_OFFLINE=true cargo check --all-targets --all-features
• cd awa-python && uv lock --check
• release version-consistency check reproduced locally: all 32 checked surfaces match 0.6.7
• cargo deny check advisories in both Rust workspaces (clean)
• cd awa-ui/frontend && npm ci && npm run lint && npm run build
• cd awa-ui/frontend && npm audit --omit=dev (0 vulnerabilities)
• rebuilt awa-cli after the production frontend build; awa --version reports 0.6.7

Release gate

After merge, wait for the automatically triggered full CI branch-push run on the exact release/0.6.6 merge commit. Tag that exact commit v0.6.7 only after it passes; the release workflow enforces this exact-SHA gate.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 455c95e7-6438-4953-8e32-3c0b9c26b78d

📥 Commits

Reviewing files that changed from the base of the PR and between fd560ee and 8057c32.

⛔ Files ignored due to path filters (4)

• Cargo.lock is excluded by !**/*.lock
• awa-python/Cargo.lock is excluded by !**/*.lock
• awa-python/uv.lock is excluded by !**/*.lock
• awa-ui/frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• CHANGELOG.md
• Cargo.toml
• awa-cli/Cargo.toml
• awa-cli/pyproject.toml
• awa-python/Cargo.toml
• awa-python/pyproject.toml
• awa-seaorm/Cargo.toml
• awa/Cargo.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release updates the workspace and package versions to 0.6.7, aligns internal dependency references, and documents CLI credential redaction and the bundled admin UI dependency update.

Changes

0.6.7 release alignment

Layer / File(s)	Summary
Release metadata and package versions Cargo.toml, awa-cli/pyproject.toml, awa-python/Cargo.toml, awa-python/pyproject.toml, CHANGELOG.md	Package and workspace versions change from 0.6.6 to 0.6.7. The changelog adds the 0.6.7 release entry.
Internal dependency alignment Cargo.toml, awa-cli/Cargo.toml, awa-python/Cargo.toml, awa-python/pyproject.toml, awa-seaorm/Cargo.toml, awa/Cargo.toml	Internal Rust dependencies, development dependencies, and the optional Python UI dependency reference version 0.6.7.
Patch release notes CHANGELOG.md	The changelog records CLI credential redaction and the seroval 1.5.6 update.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 8057c

This release preparation updates versions, lockfiles, and release notes without migrations or public API changes; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: claude

Poem

A rabbit checks the version line

“0.6.7” now shines so fine
Secrets hide from help’s display
Old bugs hop and bound away
Fresh pins rest in their burrowed hay

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: preparing the 0.6.7 release through version updates and release notes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T20:49:07.255874Z	2cd1144	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[hardbyte]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[hardbyte]

@coderabbitai review

[hardbyte]

@coderabbitai review

[hardbyte]

@codex review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 2cd11449bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".