From 2cd11449bd51773da8f8f99c654bc0e22b55647b Mon Sep 17 00:00:00 2001 From: Brian Thorne Date: Mon, 31 Aug 2026 08:40:05 +1200 Subject: [PATCH] chore: prepare 0.6.7 release --- CHANGELOG.md | 7 +++++++ Cargo.lock | 26 +++++++++++++------------- Cargo.toml | 12 ++++++------ awa-cli/Cargo.toml | 4 ++-- awa-cli/pyproject.toml | 2 +- awa-python/Cargo.lock | 14 +++++++------- awa-python/Cargo.toml | 6 +++--- awa-python/pyproject.toml | 4 ++-- awa-python/uv.lock | 4 ++-- awa-seaorm/Cargo.toml | 2 +- awa-ui/frontend/package-lock.json | 6 +++--- awa/Cargo.toml | 2 +- 12 files changed, 48 insertions(+), 41 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eaac4693..8db18808 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,16 @@ Notable changes between releases. Detailed migration notes for storage transitio ## [Unreleased] +## [0.6.7] — 2026-08-31 + +Patch release: CLI help credential redaction and dependency security updates. No migrations, schema changes, or public API changes. + ### Fixed - **CLI help no longer prints credential-bearing environment values.** `awa --help` hides the resolved `DATABASE_URL`, while `awa serve --help` and `awa callbacks serve --help` hide `AWA_CALLBACK_HMAC_SECRET`. The CLI still accepts those environment variables and help still identifies their names, but their current values are never rendered. + - If help output containing either value was captured in CI logs, support bundles, or another shared location, remove that output where possible and rotate the exposed credential. +- **The bundled admin UI no longer resolves the vulnerable `seroval` 1.5.1 transitive dependency.** The lockfile now selects 1.5.6, which contains the fix for [GHSA-mv8w-475r-vwqw](https://github.com/advisories/GHSA-mv8w-475r-vwqw). +- **Rust transitive dependencies with published advisories are updated.** Both Rust lockfiles now select `h2` 0.4.16, fixing [RUSTSEC-2026-0258](https://rustsec.org/advisories/RUSTSEC-2026-0258), and the main workspace selects `crossbeam-epoch` 0.9.20, fixing [RUSTSEC-2026-0204](https://rustsec.org/advisories/RUSTSEC-2026-0204). ## [0.6.6] — 2026-08-14 diff --git a/Cargo.lock b/Cargo.lock index c5f88d3a..e351e804 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -383,7 +383,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "awa" -version = "0.6.6" +version = "0.6.7" dependencies = [ "async-trait", "awa-macros", @@ -408,7 +408,7 @@ dependencies = [ [[package]] name = "awa-cli" -version = "0.6.6" +version = "0.6.7" dependencies = [ "assert_cmd", "awa-model", @@ -430,7 +430,7 @@ dependencies = [ [[package]] name = "awa-macros" -version = "0.6.6" +version = "0.6.7" dependencies = [ "proc-macro-crate", "proc-macro2", @@ -440,7 +440,7 @@ dependencies = [ [[package]] name = "awa-metrics" -version = "0.6.6" +version = "0.6.7" dependencies = [ "awa-model", "opentelemetry", @@ -448,7 +448,7 @@ dependencies = [ [[package]] name = "awa-model" -version = "0.6.6" +version = "0.6.7" dependencies = [ "awa-macros", "blake3", @@ -469,7 +469,7 @@ dependencies = [ [[package]] name = "awa-seaorm" -version = "0.6.6" +version = "0.6.7" dependencies = [ "awa", "awa-testing", @@ -482,7 +482,7 @@ dependencies = [ [[package]] name = "awa-testing" -version = "0.6.6" +version = "0.6.7" dependencies = [ "async-trait", "awa-model", @@ -497,7 +497,7 @@ dependencies = [ [[package]] name = "awa-ui" -version = "0.6.6" +version = "0.6.7" dependencies = [ "awa-metrics", "awa-model", @@ -520,7 +520,7 @@ dependencies = [ [[package]] name = "awa-worker" -version = "0.6.6" +version = "0.6.7" dependencies = [ "anyhow", "async-trait", @@ -1023,9 +1023,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] @@ -1494,9 +1494,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.13" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", diff --git a/Cargo.toml b/Cargo.toml index 2306117c..329ace33 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -14,7 +14,7 @@ members = [ exclude = ["awa-python", "spike"] [workspace.package] -version = "0.6.6" +version = "0.6.7" edition = "2021" license = "MIT OR Apache-2.0" description = "Postgres-native background job queue — transactional enqueue, heartbeat crash recovery, SKIP LOCKED dispatch" @@ -25,11 +25,11 @@ categories = ["database", "asynchronous", "web-programming"] [workspace.dependencies] # Internal crates -awa-model = { path = "awa-model", version = "0.6.6" } -awa-macros = { path = "awa-macros", version = "0.6.6" } -awa-metrics = { path = "awa-metrics", version = "0.6.6" } -awa-worker = { path = "awa-worker", version = "0.6.6" } -awa = { path = "awa", version = "0.6.6" } +awa-model = { path = "awa-model", version = "0.6.7" } +awa-macros = { path = "awa-macros", version = "0.6.7" } +awa-metrics = { path = "awa-metrics", version = "0.6.7" } +awa-worker = { path = "awa-worker", version = "0.6.7" } +awa = { path = "awa", version = "0.6.7" } # Database sea-orm = { version = "=2.0.0-rc.38", default-features = false, features = ["sqlx-postgres", "runtime-tokio-rustls", "with-chrono", "with-json"] } diff --git a/awa-cli/Cargo.toml b/awa-cli/Cargo.toml index 36048f10..2e012de7 100644 --- a/awa-cli/Cargo.toml +++ b/awa-cli/Cargo.toml @@ -14,7 +14,7 @@ path = "src/main.rs" [dependencies] awa-model.workspace = true awa-worker.workspace = true -awa-ui = { path = "../awa-ui", version = "0.6.6" } +awa-ui = { path = "../awa-ui", version = "0.6.7" } axum.workspace = true sqlx.workspace = true tokio.workspace = true @@ -28,5 +28,5 @@ hex.workspace = true uuid.workspace = true [dev-dependencies] -awa-testing = { path = "../awa-testing", version = "0.6.6" } +awa-testing = { path = "../awa-testing", version = "0.6.7" } assert_cmd = "2" diff --git a/awa-cli/pyproject.toml b/awa-cli/pyproject.toml index 5ae36f81..031d680d 100644 --- a/awa-cli/pyproject.toml +++ b/awa-cli/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "maturin" [project] name = "awa-cli" -version = "0.6.6" +version = "0.6.7" description = "CLI for the Awa Postgres-native job queue (migrations, admin, serve)" readme = "README.md" requires-python = ">=3.10" diff --git a/awa-python/Cargo.lock b/awa-python/Cargo.lock index 74081b8f..c3988130 100644 --- a/awa-python/Cargo.lock +++ b/awa-python/Cargo.lock @@ -95,7 +95,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "awa-macros" -version = "0.6.6" +version = "0.6.7" dependencies = [ "proc-macro-crate", "proc-macro2", @@ -105,7 +105,7 @@ dependencies = [ [[package]] name = "awa-metrics" -version = "0.6.6" +version = "0.6.7" dependencies = [ "awa-model", "opentelemetry", @@ -113,7 +113,7 @@ dependencies = [ [[package]] name = "awa-model" -version = "0.6.6" +version = "0.6.7" dependencies = [ "awa-macros", "blake3", @@ -133,7 +133,7 @@ dependencies = [ [[package]] name = "awa-python" -version = "0.6.6" +version = "0.6.7" dependencies = [ "async-trait", "awa-model", @@ -156,7 +156,7 @@ dependencies = [ [[package]] name = "awa-worker" -version = "0.6.6" +version = "0.6.7" dependencies = [ "async-trait", "awa-macros", @@ -667,9 +667,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.13" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", diff --git a/awa-python/Cargo.toml b/awa-python/Cargo.toml index c3f3a992..cc200e29 100644 --- a/awa-python/Cargo.toml +++ b/awa-python/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "awa-python" -version = "0.6.6" +version = "0.6.7" edition = "2021" [lib] @@ -12,8 +12,8 @@ default = ["cel"] cel = ["awa-model/cel"] [dependencies] -awa-model = { path = "../awa-model", version = "0.6.6" } -awa-worker = { path = "../awa-worker", version = "0.6.6", features = ["__python-bridge"] } +awa-model = { path = "../awa-model", version = "0.6.7" } +awa-worker = { path = "../awa-worker", version = "0.6.7", features = ["__python-bridge"] } pyo3 = { version = "0.29", features = ["macros", "abi3-py310", "chrono"] } pyo3-async-runtimes = { version = "0.29", features = ["tokio-runtime"] } sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "chrono", "json"] } diff --git a/awa-python/pyproject.toml b/awa-python/pyproject.toml index f997af34..6c6605be 100644 --- a/awa-python/pyproject.toml +++ b/awa-python/pyproject.toml @@ -5,7 +5,7 @@ build-backend = "maturin" [project] name = "awa-pg" requires-python = ">=3.10" -version = "0.6.6" +version = "0.6.7" description = "Postgres-native background job queue — Python SDK with async/sync workers, transactional enqueue, and progress tracking. Install awa-pg[ui] to add the bundled web dashboard." readme = "README.md" license = {text = "MIT OR Apache-2.0"} @@ -32,7 +32,7 @@ classifiers = [ # # Kept opt-in so the default `awa-pg` install stays small — workers and # producers don't need the ~10 MB UI bundle. -ui = ["awa-cli==0.6.6"] +ui = ["awa-cli==0.6.7"] [project.urls] Homepage = "https://github.com/hardbyte/awa" diff --git a/awa-python/uv.lock b/awa-python/uv.lock index 4abcc705..d10b655a 100644 --- a/awa-python/uv.lock +++ b/awa-python/uv.lock @@ -88,12 +88,12 @@ wheels = [ [[package]] name = "awa-cli" -version = "0.6.6" +version = "0.6.7" source = { directory = "../awa-cli" } [[package]] name = "awa-pg" -version = "0.6.6" +version = "0.6.7" source = { editable = "." } [package.optional-dependencies] diff --git a/awa-seaorm/Cargo.toml b/awa-seaorm/Cargo.toml index 087325e1..17fed30f 100644 --- a/awa-seaorm/Cargo.toml +++ b/awa-seaorm/Cargo.toml @@ -14,6 +14,6 @@ serde_json.workspace = true sqlx.workspace = true [dev-dependencies] -awa-testing = { path = "../awa-testing", version = "0.6.6" } +awa-testing = { path = "../awa-testing", version = "0.6.7" } serde = { workspace = true, features = ["derive"] } tokio = { workspace = true, features = ["macros", "rt-multi-thread"] } diff --git a/awa-ui/frontend/package-lock.json b/awa-ui/frontend/package-lock.json index 2b1a5fd7..e9b56e12 100644 --- a/awa-ui/frontend/package-lock.json +++ b/awa-ui/frontend/package-lock.json @@ -4860,9 +4860,9 @@ } }, "node_modules/seroval": { - "version": "1.5.1", - "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.1.tgz", - "integrity": "sha512-OwrZRZAfhHww0WEnKHDY8OM0U/Qs8OTfIDWhUD4BLpNJUfXK4cGmjiagGze086m+mhI+V2nD0gfbHEnJjb9STA==", + "version": "1.5.6", + "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.6.tgz", + "integrity": "sha512-rVQVWjjSvlINzaQPZH5JFqsqEsIWdTxY3iJZCnTL/5gQbXIRooVZKI60tVCkOVfzcRPejboxO2t0P89dg5mQaA==", "license": "MIT", "engines": { "node": ">=10" diff --git a/awa/Cargo.toml b/awa/Cargo.toml index e0f909d8..933b9416 100644 --- a/awa/Cargo.toml +++ b/awa/Cargo.toml @@ -20,7 +20,7 @@ awa-macros.workspace = true awa-worker.workspace = true [dev-dependencies] -awa-testing = { path = "../awa-testing", version = "0.6.6" } +awa-testing = { path = "../awa-testing", version = "0.6.7" } sqlx.workspace = true serde.workspace = true serde_json.workspace = true