chore: release v0.12.4 - #553
Conversation
Security patch release - fixes minimatch ReDoS vulnerability (Dependabot #75) and updates yanked wasm-bindgen 0.2.109.
There was a problem hiding this comment.
Pull request overview
This PR bumps the workspace version from 0.12.2 to 0.12.4, skipping version 0.12.3. The release includes security fixes for a minimatch ReDoS vulnerability and a yanked wasm-bindgen version (0.2.109 → 0.2.110). The CHANGELOG.md entries for these security fixes are moved from the Unreleased section to a new [0.12.4] section dated 2026-02-21.
Changes:
- Workspace version updated from 0.12.2 to 0.12.4 in Cargo.toml
- Internal crate dependency versions (agnix-rules, agnix-core) bumped to 0.12.4
- New CHANGELOG section created for version 0.12.4 with security fix entries
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| Cargo.toml | Updates workspace version and internal crate dependencies from 0.12.2 to 0.12.4 |
| CHANGELOG.md | Adds [0.12.4] release section dated 2026-02-21 with security fixes for minimatch ReDoS and wasm-bindgen update |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - **Fix minimatch ReDoS vulnerability**: Added npm `overrides` in `website/package.json` to force `minimatch@^10.2.1`, resolving Dependabot alert #75 (ReDoS via repeated wildcards in `serve-handler`'s transitive `minimatch@3.1.2` dependency) | ||
| - **Update wasm-bindgen**: Bumped `wasm-bindgen` from 0.2.109 (yanked) to 0.2.110 along with related crates (`js-sys`, `web-sys`, `wasm-bindgen-test`, etc.) |
There was a problem hiding this comment.
The PR description mentions "Dependabot #75" for the minimatch ReDoS vulnerability fix, but the linked mentioned_issue #75 is about "Address empty fixtures" and has nothing to do with security vulnerabilities or minimatch. This appears to be a mismatch - either the PR description references the wrong issue number, or the wrong issue was linked in the metadata.
|
|
||
| [workspace.package] | ||
| version = "0.12.2" | ||
| version = "0.12.4" |
There was a problem hiding this comment.
This release also requires updating version references in other files that aren't included in this PR: plugin/.claude-plugin/plugin.json (line 3), plugin/skills/agnix/SKILL.md (line 4), AGENTS.md (line 192), CLAUDE.md (line 192), and website/versions.json (line 2) all still reference version 0.12.2 and should be updated to 0.12.4. Consider adding these files to this PR or creating a follow-up commit to ensure version consistency across the entire codebase.
There was a problem hiding this comment.
Good catch. Updated all version references to 0.12.4 in plugin.json, SKILL.md, CLAUDE.md, AGENTS.md, and website/versions.json in the latest commit.
Address review feedback - update version in plugin.json, SKILL.md, CLAUDE.md, AGENTS.md, and website/versions.json.
versions.json is managed by docusaurus docs:version and requires a corresponding versioned_docs directory.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
Security fixes in this release
Test plan
cargo checkpasses