chore: prepare 0.6.7 release

CHANGELOG.md

@@ -4,9 +4,16 @@ Notable changes between releases. Detailed migration notes for storage transitio
 
 ## [Unreleased]
 
+## [0.6.7] — 2026-08-31
+
+Patch release: CLI help credential redaction and dependency security updates. No migrations, schema changes, or public API changes.
+
 ### Fixed
 
 - **CLI help no longer prints credential-bearing environment values.** `awa --help` hides the resolved `DATABASE_URL`, while `awa serve --help` and `awa callbacks serve --help` hide `AWA_CALLBACK_HMAC_SECRET`. The CLI still accepts those environment variables and help still identifies their names, but their current values are never rendered.
+  - If help output containing either value was captured in CI logs, support bundles, or another shared location, remove that output where possible and rotate the exposed credential.
+- **The bundled admin UI no longer resolves the vulnerable `seroval` 1.5.1 transitive dependency.** The lockfile now selects 1.5.6, which contains the fix for [GHSA-mv8w-475r-vwqw](https://github.com/advisories/GHSA-mv8w-475r-vwqw).
+- **Rust transitive dependencies with published advisories are updated.** Both Rust lockfiles now select `h2` 0.4.16, fixing [RUSTSEC-2026-0258](https://rustsec.org/advisories/RUSTSEC-2026-0258), and the main workspace selects `crossbeam-epoch` 0.9.20, fixing [RUSTSEC-2026-0204](https://rustsec.org/advisories/RUSTSEC-2026-0204).
 
 ## [0.6.6] — 2026-08-14
 

Cargo.toml

@@ -14,7 +14,7 @@ members = [
 exclude = ["awa-python", "spike"]
 
 [workspace.package]
-version = "0.6.6"
+version = "0.6.7"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "Postgres-native background job queue — transactional enqueue, heartbeat crash recovery, SKIP LOCKED dispatch"
@@ -25,11 +25,11 @@ categories = ["database", "asynchronous", "web-programming"]
 
 [workspace.dependencies]
 # Internal crates
-awa-model = { path = "awa-model", version = "0.6.6" }
-awa-macros = { path = "awa-macros", version = "0.6.6" }
-awa-metrics = { path = "awa-metrics", version = "0.6.6" }
-awa-worker = { path = "awa-worker", version = "0.6.6" }
-awa = { path = "awa", version = "0.6.6" }
+awa-model = { path = "awa-model", version = "0.6.7" }
+awa-macros = { path = "awa-macros", version = "0.6.7" }
+awa-metrics = { path = "awa-metrics", version = "0.6.7" }
+awa-worker = { path = "awa-worker", version = "0.6.7" }
+awa = { path = "awa", version = "0.6.7" }
 
 # Database
 sea-orm = { version = "=2.0.0-rc.38", default-features = false, features = ["sqlx-postgres", "runtime-tokio-rustls", "with-chrono", "with-json"] }

awa-cli/Cargo.toml

@@ -14,7 +14,7 @@ path = "src/main.rs"
 [dependencies]
 awa-model.workspace = true
 awa-worker.workspace = true
-awa-ui = { path = "../awa-ui", version = "0.6.6" }
+awa-ui = { path = "../awa-ui", version = "0.6.7" }
 axum.workspace = true
 sqlx.workspace = true
 tokio.workspace = true
@@ -28,5 +28,5 @@ hex.workspace = true
 uuid.workspace = true
 
 [dev-dependencies]
-awa-testing = { path = "../awa-testing", version = "0.6.6" }
+awa-testing = { path = "../awa-testing", version = "0.6.7" }
 assert_cmd = "2"

awa-cli/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "awa-cli"
-version = "0.6.6"
+version = "0.6.7"
 description = "CLI for the Awa Postgres-native job queue (migrations, admin, serve)"
 readme = "README.md"
 requires-python = ">=3.10"

awa-python/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "awa-python"
-version = "0.6.6"
+version = "0.6.7"
 edition = "2021"
 
 [lib]
@@ -12,8 +12,8 @@ default = ["cel"]
 cel = ["awa-model/cel"]
 
 [dependencies]
-awa-model = { path = "../awa-model", version = "0.6.6" }
-awa-worker = { path = "../awa-worker", version = "0.6.6", features = ["__python-bridge"] }
+awa-model = { path = "../awa-model", version = "0.6.7" }
+awa-worker = { path = "../awa-worker", version = "0.6.7", features = ["__python-bridge"] }
 pyo3 = { version = "0.29", features = ["macros", "abi3-py310", "chrono"] }
 pyo3-async-runtimes = { version = "0.29", features = ["tokio-runtime"] }
 sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "chrono", "json"] }

awa-python/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "maturin"
 [project]
 name = "awa-pg"
 requires-python = ">=3.10"
-version = "0.6.6"
+version = "0.6.7"
 description = "Postgres-native background job queue — Python SDK with async/sync workers, transactional enqueue, and progress tracking. Install awa-pg[ui] to add the bundled web dashboard."
 readme = "README.md"
 license = {text = "MIT OR Apache-2.0"}
@@ -32,7 +32,7 @@ classifiers = [
 #
 # Kept opt-in so the default `awa-pg` install stays small — workers and
 # producers don't need the ~10 MB UI bundle.
-ui = ["awa-cli==0.6.6"]
+ui = ["awa-cli==0.6.7"]
 
 [project.urls]
 Homepage = "https://github.com/hardbyte/awa"

awa-seaorm/Cargo.toml

@@ -14,6 +14,6 @@ serde_json.workspace = true
 sqlx.workspace = true
 
 [dev-dependencies]
-awa-testing = { path = "../awa-testing", version = "0.6.6" }
+awa-testing = { path = "../awa-testing", version = "0.6.7" }
 serde = { workspace = true, features = ["derive"] }
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

awa/Cargo.toml

@@ -20,7 +20,7 @@ awa-macros.workspace = true
 awa-worker.workspace = true
 
 [dev-dependencies]
-awa-testing = { path = "../awa-testing", version = "0.6.6" }
+awa-testing = { path = "../awa-testing", version = "0.6.7" }
 sqlx.workspace = true
 serde.workspace = true
 serde_json.workspace = true