Prepare hashavatar-api 0.9.0

Author: eldryoth

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2024"
 rust-version = "1.95"
 description = "Public avatar API and landing page for hashavatar"
@@ -12,7 +12,7 @@ documentation = "https://github.com/valkyoth/hashavatar-api"
 [dependencies]
 aws-config = { version = "1.8.16", default-features = false, features = ["rt-tokio"] }
 aws-sdk-s3 = { version = "1.131.0", default-features = false, features = ["rt-tokio", "sigv4a"] }
-hashavatar = { version = "0.8.0", features = ["blake3", "xxh3"] }
+hashavatar = { version = "0.9.0", features = ["blake3", "xxh3"] }
 image = { version = "0.25.10", default-features = false, features = ["png"] }
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "query", "json"] }
 getrandom = { version = "0.4.2", default-features = false }

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2024"
 rust-version = "1.95"
 description = "Public avatar API and landing page for hashavatar"
@@ -10,7 +10,7 @@ homepage = "https://github.com/valkyoth/hashavatar-api"
 documentation = "https://github.com/valkyoth/hashavatar-api"
 
 [dependencies]
-hashavatar = { version = "0.8.0", features = ["blake3", "xxh3"] }
+hashavatar = { version = "0.9.0", features = ["blake3", "xxh3"] }
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "query", "json"] }
 getrandom = { version = "0.4.2", default-features = false }
 ipnet = { version = "2.12.0", default-features = false }

Cargo.toml.split-template

@@ -11,7 +11,7 @@ audit, SBOM, reproducibility, smoke, and GitHub CodeQL default setup checks.
 
 ## Current Status
 
-The current service version is `0.8.0`.
+The current service version is `0.9.0`.
 
 Implemented now:
 
@@ -25,7 +25,7 @@ Implemented now:
 - Namespace-aware tenant and style-version parameters.
 - Selectable identity hash algorithms: `SHA-512`, `BLAKE3`, and `XXH3`.
 - `WebP`, `PNG`, `JPEG`, `GIF`, and `SVG` responses.
-- Avatar families from `hashavatar 0.8.0`: `cat`, `dog`, `robot`, `fox`,
+- Avatar families from `hashavatar 0.9.0`: `cat`, `dog`, `robot`, `fox`,
   `alien`, `monster`, `ghost`, `slime`, `bird`, `wizard`, `skull`, `paws`,
   `planet`, `rocket`, `mushroom`, `cactus`, `frog`, `panda`, `cupcake`,
   `pizza`, `icecream`, `octopus`, and `knight`.
@@ -55,7 +55,7 @@ Intentionally external:
 | Area | Status |
 | --- | --- |
 | Service license | `EUPL-1.2` |
-| Renderer crate | `hashavatar 0.8.0` |
+| Renderer crate | `hashavatar 0.9.0` |
 | MSRV | Rust `1.95.0` |
 | Runtime container | Wolfi |
 | HTTP framework | `axum` |

README.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Security fixes are expected for the latest published `0.8.x` release.
+Security fixes are expected for the latest published `0.9.x` release.
 
 ## Reporting a Vulnerability
 

SECURITY.md

@@ -24,6 +24,12 @@ grep -q 'INTERNAL_ERROR_MESSAGE' src/main.rs \
     || fail "generic internal error message constant is missing"
 grep -q 'fn add_security_headers' src/main.rs \
     || fail "security header middleware is missing"
+grep -q 'fn secure_rng_failure' src/main.rs \
+    || fail "CSP nonce RNG failure must fail closed"
+if grep -q 'CSP_NONCE_FALLBACK_COUNTER' src/main.rs \
+    || grep -q 'falling back to deterministic CSP nonce entropy' src/main.rs; then
+    fail "CSP nonce generation must not use deterministic fallback entropy"
+fi
 grep -q 'MAX_ID_BYTES' src/main.rs \
     || fail "identity byte limit is missing"
 grep -q 'MAX_NAMESPACE_COMPONENT_BYTES' src/main.rs \
@@ -49,6 +55,8 @@ fi
 
 grep -q 'rate_limiter_bounds_unique_attacker_keys' src/main.rs \
     || fail "rate limiter memory bound regression test is missing"
+grep -q 'rate_limit_key_is_route_and_ip_scoped' src/main.rs \
+    || fail "rate limiter route/IP scoping regression test is missing"
 grep -q 'client_ip_ignores_forwarded_headers_from_untrusted_peers' src/main.rs \
     || fail "forwarded-header spoofing regression test is missing"
 grep -q 'internal_error_does_not_expose_details' src/main.rs \
@@ -65,6 +73,8 @@ grep -q 'escape_html_attribute_handles_single_quotes' src/main.rs \
     || fail "attribute escaping regression test is missing"
 grep -q 'etag_uses_full_sha256_digest' src/main.rs \
     || fail "full ETag digest regression test is missing"
+grep -q 'metrics_generation_duration_saturates_at_u64_max' src/main.rs \
+    || fail "metrics duration saturation regression test is missing"
 
 if [ -e .github/workflows/codeql.yml ] || [ -e .github/codeql/codeql-config.yml ]; then
     fail "CodeQL default setup is enabled in GitHub; remove repo-level advanced CodeQL configuration"