Prepare 1.1.1 maintenance release

Author: eldryoth

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
           cache-on-failure: true
 
       - name: Install security tools
-        uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2.82.7
+        uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8
         with:
           tool: cargo-deny,cargo-audit
 

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.1.1
+
+- Bumped the crate to `1.1.1`.
+- Updated `rand` to `0.10.2` and `xxhash-rust` to `0.8.16`.
+- Refreshed compatible transitive dependencies in the root and fuzz lockfiles,
+  including `arrayvec`, `chacha20`, and `hybrid-array`.
+- Updated the pinned GitHub CI `taiki-e/install-action` commit to `v2.82.8`.
+- Confirmed `actions/checkout` remains current at `v7.0.0` and
+  `Swatinem/rust-cache` remains current at `v2.9.1`.
+- Updated README installation snippets, latest-stable Rust wording, and release
+  metadata for `1.1.1`.
+- Added local compatibility evidence for Rust `1.96.1`.
+
 ## 1.1.0
 
 - Bumped the crate to `1.1.0`.

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar"
-version = "1.1.0"
+version = "1.1.1"
 edition = "2024"
 rust-version = "1.90"
 description = "Stable deterministic procedural avatars in Rust with configurable identity hashing, WebP, optional PNG/JPEG/GIF, and SVG export"
@@ -20,12 +20,12 @@ unexpected_cfgs = { level = "warn", check-cfg = ["cfg(fuzzing)"] }
 blake3 = { version = "1.8.5", default-features = true, optional = true }
 image = { version = "0.25.10", default-features = false, features = ["webp"] }
 palette = { version = "0.7.6", default-features = false, features = ["std"] }
-rand = { version = "0.10.1", default-features = false, features = ["std", "std_rng"] }
+rand = { version = "0.10.2", default-features = false, features = ["std", "std_rng"] }
 sanitization = { version = "1.2.2", default-features = false, features = ["alloc"] }
 sanitization-crypto-interop = { version = "1.2.2", default-features = false, features = ["sha2"] }
 serde = { version = "1.0.228", default-features = false, optional = true }
 subtle = { version = "2.6.1", default-features = false }
-xxhash-rust = { version = "0.8.15", default-features = false, features = ["xxh3"], optional = true }
+xxhash-rust = { version = "0.8.16", default-features = false, features = ["xxh3"], optional = true }
 
 [dev-dependencies]
 roxmltree = "0.21.1"

Cargo.toml

@@ -29,7 +29,7 @@ The crate starts conservative: validated avatar dimensions, bounded identity inp
 
 ## Current Status
 
-The current crate version is `1.1.0`.
+The current crate version is `1.1.1`.
 
 Implemented now:
 
@@ -104,9 +104,9 @@ to split it.
 ## Rust Version Support
 
 The minimum supported Rust version is Rust `1.90.0`. New deployments should
-prefer the latest stable Rust; as of May 29, 2026, that is Rust `1.96.0`.
+prefer the latest stable Rust; as of June 30, 2026, that is Rust `1.96.1`.
 
-Compatibility evidence for `1.1.0`:
+Compatibility evidence for `1.1.1`:
 
 | Rust | Local Evidence |
 | --- | --- |
@@ -117,6 +117,7 @@ Compatibility evidence for `1.1.0`:
 | `1.94.0` | ✓ `cargo check --features all-formats` |
 | `1.95.0` | ✓ `cargo check --features all-formats` |
 | `1.96.0` | ✓ `cargo check --features all-formats` |
+| `1.96.1` | ✓ `cargo check --features all-formats` |
 
 Optional hash modes are mutually exclusive, so `hashavatar` cannot use a single
 `--all-features` evidence run. The `1.90.0` MSRV was also checked with
@@ -127,36 +128,36 @@ Optional hash modes are mutually exclusive, so `hashavatar` cannot use a single
 
 ```toml
 [dependencies]
-hashavatar = "1.1.0"
+hashavatar = "1.1.1"
 ```
 
 Optional identity hash modes and extra raster encoders are disabled by default.
 Hash modes are mutually exclusive, so enable at most one of `blake3` or `xxh3`:
 
 ```toml
 [dependencies]
-hashavatar = { version = "1.1.0", features = ["blake3"] }
+hashavatar = { version = "1.1.1", features = ["blake3"] }
 ```
 
 Enable additional raster formats explicitly:
 
 ```toml
 [dependencies]
-hashavatar = { version = "1.1.0", features = ["png", "jpeg", "gif"] }
+hashavatar = { version = "1.1.1", features = ["png", "jpeg", "gif"] }
 ```
 
 Or enable every optional raster encoder at once:
 
 ```toml
 [dependencies]
-hashavatar = { version = "1.1.0", features = ["all-formats"] }
+hashavatar = { version = "1.1.1", features = ["all-formats"] }
 ```
 
 Enable string serialization/deserialization for public style enums:
 
 ```toml
 [dependencies]
-hashavatar = { version = "1.1.0", features = ["serde"] }
+hashavatar = { version = "1.1.1", features = ["serde"] }
 ```
 
 Combine these as needed, for example `features = ["blake3", "png", "serde"]`.
@@ -519,7 +520,7 @@ your namespace style version when intentionally migrating output.
 
 ```toml
 [dependencies]
-hashavatar = { version = "1.1.0", features = ["blake3"] }
+hashavatar = { version = "1.1.1", features = ["blake3"] }
 ```
 
 ```rust
@@ -547,7 +548,7 @@ assert!(svg.contains("alien avatar"));
 
 ```toml
 [dependencies]
-hashavatar = { version = "1.1.0", features = ["xxh3"] }
+hashavatar = { version = "1.1.1", features = ["xxh3"] }
 ```
 
 ```rust

README.md

@@ -0,0 +1,35 @@
+# hashavatar 1.1.1
+
+`1.1.1` is a maintenance release for `hashavatar` focused on dependency and CI
+pin freshness. It does not intentionally change avatar rendering behavior or
+the public API.
+
+## Dependency Updates
+
+- Updated `rand` from `0.10.1` to `0.10.2`.
+- Updated optional `xxhash-rust` from `0.8.15` to `0.8.16`.
+- Refreshed compatible transitive dependencies in the root lockfile:
+  - `arrayvec` `0.7.7` to `0.7.8`
+  - `chacha20` `0.10.0` to `0.10.1`
+  - `hybrid-array` `0.4.12` to `0.4.13`
+- Refreshed compatible transitive dependencies in the fuzz lockfile:
+  - `chacha20` `0.10.0` to `0.10.1`
+  - `hybrid-array` `0.4.12` to `0.4.13`
+
+## CI
+
+- Updated pinned `taiki-e/install-action` from `v2.82.7` to `v2.82.8`.
+- Confirmed `actions/checkout` remains current at `v7.0.0`.
+- Confirmed `Swatinem/rust-cache` remains current at `v2.9.1`.
+
+## Documentation
+
+- Updated README installation snippets and release metadata for `1.1.1`.
+- Updated latest-stable Rust wording to Rust `1.96.1`.
+- Added local `cargo check --features all-formats` compatibility evidence for
+  Rust `1.96.1`.
+
+## Compatibility
+
+- No intentional public API changes.
+- No intentional avatar visual fingerprint changes.

docs/release-notes/RELEASE_NOTES_1.1.1.md

@@ -8,7 +8,7 @@ publish = false
 cargo-fuzz = true
 
 [dependencies]
-hashavatar = { path = "..", version = "1.1.0", features = ["fuzzing"] }
+hashavatar = { path = "..", version = "1.1.1", features = ["fuzzing"] }
 libfuzzer-sys = "0.4.13"
 roxmltree = "0.21.1"