github-actions released this 07 Aug 10:43

release-70c9b595

70c9b59

release-70c9b595

feat: remove profiles support everywhere

github-actions released this 08 Aug 10:35

release-50e2a1a0

50e2a1a

This commit was created on GitHub.com and signed with GitHub’s verified signature.

GPG key ID: B5690EEEBB952194

Verified

Learn about vigilant mode.

chore(remote-proto): ignore false-positive machete build-deps (#1169)

prost-build and tonic-prost-build are build-time codegen deps invoked
from build.rs; cargo-machete's source scan flags them as unused even
though they are required. Add them to the [package.metadata.cargo-machete]
ignored list alongside the runtime deps.

Co-authored-by: gominimal-aw-bot[bot] <281738952+gominimal-aw-bot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Tom <twitchyliquid64@users.noreply.github.com>

github-actions released this 06 Aug 11:13

release-f5a9a980

f5a9a98

fix(sandbox2): make rootfs a BTreeSet so assembly order is deterministic

Sandbox::new hardlinks Config::rootfs entries first-writer-wins by
iterating the collection directly, so a HashSet let a per-process
RandomState seed decide which entry provided a contended path. Make the
collection itself ordered: SandboxMapped gets an Ord mirroring its
manual Eq/Hash key (variant tag, path) and Config::rootfs becomes a
BTreeSet. This fixes every rootfs producer at once; the op-layer
sort/dedup this replaces was only treating one call site's symptom.

The standalone-test path keeps the plain HashSet->BTreeSet swap.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions released this 05 Aug 02:46

release-e0f67c82

e0f67c8

release-e0f67c82

feat(minimald): support arbitrary session exec

github-actions released this 05 Aug 05:29

release-aae389ba

aae389b

release-aae389ba

fix: update guest kernel to carry CONFIG_PROC_CHILDREN

github-actions released this 05 Aug 17:18

release-4882ef32

4882ef3

release-4882ef32

fix: command exec inside minvmd

github-actions released this 05 Aug 19:08

release-046d1d1e

046d1d1

release-046d1d1e

fix(sftp): resolve relative paths to session HOME

github-actions released this 03 Aug 17:07

release-3e1fcbd7

3e1fcbd

build(deps): bump russh from 0.62.4 to 0.62.5

Bumps [russh](https://github.com/warp-tech/russh) from 0.62.4 to 0.62.5.
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](https://github.com/warp-tech/russh/compare/v0.62.4...v0.62.5)

---
updated-dependencies:
- dependency-name: russh
  dependency-version: 0.62.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

github-actions released this 04 Aug 11:39

release-3b26ad64

3b26ad6

build(deps)!: lift the wasm-bindgen ceiling via a topiary patch

nickel-lang-core's `format` feature reaches topiary-web-tree-sitter-sys,
whose released 0.7.3 pins an exact `wasm-bindgen = "=0.2.100"` *untargeted*.
That constrained resolution for the whole graph even though we never build
wasm32, capping js-sys/web-sys at 0.3.77 and holding google-cloud-auth,
google-cloud-storage, reqwest and russh-sftp well below their releases.

Upstream already fixed it — master moved to a caret `wasm-bindgen = "0.2"`
and target-gates the crate behind `cfg(target_arch = "wasm32")` — but has
not published it. Master's workspace version is still 0.7.3, so a
`[patch.crates-io]` satisfies nickel's `topiary-core = "^0.7"` unchanged.
Only the two wasm crates are patched; topiary-core stays on crates.io, so
.ncl formatting output is untouched. Drop the patch once topiary ships
>0.7.3.

Unblocks google-cloud-auth 1.5->1.15, google-cloud-storage 1.7->1.17,
reqwest 0.13.1->0.13.4 and russh-sftp 2.1.2->2.4.0, and collapses the
duplicate RustCrypto 0.10 stack: 65 -> 54 crates carrying more than one
version.

BREAKING CHANGE: russh-sftp 2.3 changed `Handler::Error` to require
`Into<StatusReply>` rather than `Into<StatusCode>`. `SftpError` gains that
impl; the reply carries no message, so the wire output is byte-identical
and `Io` error text (which can embed host paths) still never crosses the
export boundary.

russh-sftp 2.2 also changed `FileAttributes::default()` from dummy zeros to
absent fields, which compiles silently. `root_attrs()` takes the new
meaning deliberately: the synthetic root has no inode, so it now states
only its mode instead of claiming uid 0, size 0 and an epoch mtime. A
regression test pins that contract.

reqwest 0.13.4's deeper types push two futures past rustc's default query
depth (128) when computing their layout, and the overflow surfaces in every
crate root that monomorphizes them rather than where it originates. Both
are boxed at the bottom of the chain instead — `Env::build`, which reaches
the cache fetchers and the client stack beneath them, and the CLI's
`run_command` dispatch. One allocation per session launch and per process
invocation respectively, versus a `recursion_limit` attribute on six crate
roots and every future integration test that touches a launch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

github-actions released this 01 Aug 00:49

release-d0e84db2

9f2c82f

release-d0e84db2

feat(minimald): automatic cache cleaning