Skip to content

docs(changelog): record audit workflow fix and cleared advisories #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aaronkwhite merged 1 commit into from
Sep 5, 2026
Merged

docs(changelog): record audit workflow fix and cleared advisories #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,20 @@ All notable changes to linear-cli will be documented in this file.

Versioning follows [CalVer](https://calver.org/) with format `YYYY.MM.PATCH`.

## [Unreleased]

The weekly Security Audit workflow had been failing since 2026-07-19 without running its audit, so five advisories accumulated undetected. The workflow is fixed and all five are cleared. Severity: LOW — one advisory was reachable in principle and rated low by upstream; the rest were unreachable, dev-only, or lockfile-only.

### Fixed
- Security Audit workflow now builds `cargo-audit` with the latest stable toolchain. `rustsec/audit-check` installs the tool unlocked, so it resolved `kstring 2.0.4`, which requires rustc 1.96 — the job's pinned 1.94 channel could not compile it, and the audit had not actually run for seven consecutive weeks. `RUSTUP_TOOLCHAIN` now overrides `rust-toolchain.toml` for that job only; the crate's pinned channel is unchanged everywhere else.

### Security
- Bumped `crossbeam-epoch` to 0.9.20 to patch RUSTSEC-2026-0204 (invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared`). Transitive via `termimad` — `lin` never formats those types.
- Bumped `h2` to 0.4.19 to patch RUSTSEC-2026-0258 (unbounded queueing of empty DATA frames). Transitive via `reqwest`/`hyper` and on the live HTTP path; rated low severity upstream.
- Bumped `quinn-proto` to 0.11.17 to patch RUSTSEC-2026-0185 (remote memory exhaustion in out-of-order stream reassembly). Present in `Cargo.lock` only — `reqwest` is built with `default-features = false`, so no QUIC/HTTP-3 code is in the build graph on any target.
- Bumped `anyhow` to 1.0.104 to clear RUSTSEC-2026-0190 (unsoundness in `Error::downcast_mut()`). `lin` does not call `downcast_mut`.
- Moved the `serial_test` dev-dependency from 3 to 4, dropping `scc` from the tree entirely and clearing RUSTSEC-2026-0205 (exception-safety flaw in `Array::insert`). Dev-only — `scc` never shipped in the binary.

## [2026.5.5] — 2026-05-10

Peer CLIs (`bosshogg`, etc.) write `command_executed` events to the same PostHog project, so dashboards filtering only on the event name commingle data across tools. This release tags every lin event with a literal `app: "lin"` property so dashboards can partition cleanly. Severity: LOW — additive only, no existing properties changed, no event renamed, no identifier scheme touched.
Expand Down
Loading