chore(task-057): v0.8.2 version bump (Part A) — publish TASK-056 Settings UI - #44
Merged
Merged
Conversation
…lease Reconcile the app version metadata to 0.8.2 on a branch off real main (df79423, incl. TASK-056) so a distributed 0.8.1 build's update check can detect the coming v0.8.2 release. Version-strings + docs only; no source, schema, CSP, capability, or dependency change. - src-tauri/Cargo.toml / tauri.conf.json / Cargo.lock (vire): 0.8.1 → 0.8.2 (cargo build --locked confirms no dependency drift) - RELEASE.md: prepend ## v0.8.2 (TASK-056 Settings UI + unsigned Plan-B/xattr) - README.md: Current version v0.8.0 → v0.8.2; DMG examples 0.8.1 → 0.8.2 - update_check/ untouched; no tauri-plugin-updater; U-lite check unchanged Verify: cargo build --locked OK; cargo test update_check 11/0; updateCheckUi 12/0; npm run build OK; cargo fmt --check clean; openspec validate --strict OK. Part B (DMG build + gh release) is SW-6, after merge. Refs: TASK-057 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Refs: TASK-057 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ed tag Refs: TASK-057 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR prepares the v0.8.2 release by bumping Vire’s version metadata (Tauri + Cargo) from 0.8.1 → 0.8.2 and updating user-facing release/install docs so an existing 0.8.1 build can detect an upcoming v0.8.2 GitHub Release via the existing U-lite update check flow.
Changes:
- Bump version to
0.8.2insrc-tauri/Cargo.toml,src-tauri/tauri.conf.json, and thevireentry insrc-tauri/Cargo.lock. - Update root
RELEASE.mdandREADME.mdto referencev0.8.2and theVire_0.8.2_aarch64.dmgartifact name. - Add TASK-057 OpenSpec change bundle (proposal/design/spec/tasks + gate artifacts) documenting the Part A/Part B release process.
Reviewed changes
Copilot reviewed 15 out of 16 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
src-tauri/tauri.conf.json |
Bumps Tauri app version to 0.8.2. |
src-tauri/Cargo.toml |
Bumps crate version to 0.8.2. |
src-tauri/Cargo.lock |
Updates the vire package version entry to 0.8.2 (no dep drift). |
RELEASE.md |
Prepends v0.8.2 release notes and release/DMG guidance for TASK-057. |
README.md |
Updates “Current version” and DMG filename examples to v0.8.2. |
openspec/changes/task-057-publish-v082-release/tasks.md |
Adds Part A/Part B task checklist for publishing v0.8.2. |
openspec/changes/task-057-publish-v082-release/specs/in-app-update-check/spec.md |
Defines spec delta scenarios/requirements for detectability + DMG guidance. |
openspec/changes/task-057-publish-v082-release/sec.md |
Records SW-5 security gate evidence for Part A scope. |
openspec/changes/task-057-publish-v082-release/review.md |
Records SW-4 code review gate evidence for Part A scope. |
openspec/changes/task-057-publish-v082-release/RELEASE.md |
SW-6 Part A release artifact (declarations + Part B handoff). |
openspec/changes/task-057-publish-v082-release/qa.md |
SW-3 QA gate evidence for Part A checks/scope. |
openspec/changes/task-057-publish-v082-release/proposal.md |
Captures motivation/scope constraints for TASK-057. |
openspec/changes/task-057-publish-v082-release/handoff.md |
Compact state + next steps handoff to SW-6 Part B after merge. |
openspec/changes/task-057-publish-v082-release/docs.md |
Documentation gate checklist/evidence for Part A wording. |
openspec/changes/task-057-publish-v082-release/design.md |
Design notes for version bump + release publication sequencing. |
openspec/changes/task-057-publish-v082-release/arch-review.md |
Architecture review: confirms scope/ordering constraints and no split. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+13
to
+15
| **Precondition:** `git fetch origin`; branch `feat/task-057-publish-v082-release` off the current | ||
| `origin/main` that includes the TASK-056 merge `df79423` (local `origin/main` ref may be stale). Confirm | ||
| `git show origin/main:src-tauri/src/main.ts` shows the TASK-056 capture panel before branching. |
| This release makes the **TASK-056 in-app Active-window capture Settings panel discoverable** to anyone running the distributed `0.8.1` build. TASK-056 (PR #43, merge `df79423`) shipped the **Settings → Active-window capture** panel — the enable toggle, sample-interval/idle/retention controls, a live capture status/health readout, and a Captured-vs-Never-captured privacy table with truthful status/privacy copy — but carried **no version bump**, so `main` still read `0.8.1` and the latest Release was still `v0.8.1`. A distributed `0.8.1` build ran "Check for updates" and resolved **UpToDate**, so the new UI was invisible to anyone on the released binary. This release reconciles the version metadata to `0.8.2` and publishes a `v0.8.2` Release for the check to point at. | ||
|
|
||
| - **Version metadata reconciled `0.8.1` → `0.8.2`.** `src-tauri/Cargo.toml`, `src-tauri/tauri.conf.json`, and the `vire` package entry in `src-tauri/Cargo.lock` (regenerated by `cargo build`) now all read `0.8.2`, so the Tauri/Cargo metadata and the in-app current-version string (`CARGO_PKG_VERSION`) agree. | ||
| - **Published GitHub Release.** A single **full** (non-draft, non-prerelease) Release tagged `v0.8.2` is published against the merged `main` commit that includes TASK-056 (published by the Release Manager in SW-6, after this change merges), so `/releases/latest` returns `v0.8.2`. Once published, the distributed `0.8.1` build resolves "Check for updates" to **UpdateAvailable (0.8.1 → 0.8.2)** with a real `release_url`; a rebuilt `0.8.2` build resolves to **UpToDate**; "Open GitHub Releases" reaches a real release page. |
|
|
||
| ### DMG asset + unsigned first-launch remedy (Plan B) | ||
|
|
||
| The published `v0.8.2` Release attaches the built **`Vire_0.8.2_aarch64.dmg`** (Apple Silicon / `aarch64` only, matching the `v0.8.1` single-arch precedent), built from the merged `main` head that includes TASK-056. The build is **unsigned and unnotarized**: a browser-downloaded copy carries `com.apple.quarantine`, so Apple Silicon Gatekeeper reports **"Vire is damaged and can't be opened"** — a policy verdict, not corruption, and right-click → Open does not clear it. The one-time, per-app remedy is to run, after copying the app to `/Applications`: |
…ries Required `dependency-advisories` gate failed on PR #44 with two new scored RustSec advisories against quick-xml 0.39.4: - RUSTSEC-2026-0194 (O(N^2) duplicate-attr DoS, CVSS 7.5) - RUSTSEC-2026-0195 (unbounded ns-decl alloc DoS, CVSS 7.5) No upstream fix exists: quick-xml enters only via plist 1.9.0 (latest), which hard-pins quick-xml ^0.39.2 (<0.40); tauri 2.11.2 is latest 2.x. A quick-xml >=0.41 bump is resolver-rejected; no plist/tauri upgrade clears it. Accepted via the repo's documented targeted [advisories].ignore mechanism (new group C in src-tauri/deny.toml) on an unreachability basis: quick-xml is reached only through plist's Apple Info.plist handling (the app's own sealed plist, never untrusted XML); vire first-party code uses neither quick-xml nor plist. Both advisories are remote DoS against services ingesting untrusted XML at scale — not reachable in a single-user local desktop app. Policy-only change: version stays 0.8.2; no code/dep/lockfile/release changes. Verified with pinned cargo-deny 0.19.9: `advisories ok` (exit 0); control run fails on exactly those two IDs. See ops-review.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TASK-057 — Part A (SW-2): land v0.8.2 metadata on
mainBranched off real
origin/maindf79423(includes the TASK-056 merge, PR #43). Reconciles the app version metadata to0.8.2so a distributed0.8.1build's in-app "Check for updates" can detect the comingv0.8.2release. Version-strings + docs only — no source, schema, CSP, capability, or dependency change;src-tauri/src/update_check/untouched; notauri-plugin-updater; the check stays U-lite (detect → Open Releases → manual install).Changed (5 files)
src-tauri/Cargo.toml,src-tauri/tauri.conf.json,src-tauri/Cargo.lock(vire):0.8.1 → 0.8.2—cargo build --lockedconfirms no dependency drift.RELEASE.md: prepended## v0.8.2(rolls up TASK-056 Settings → Active-window capture UI + unsigned/unnotarized Plan-Bxattrremedy;v0.8.1/v0.8.0intact).README.md:Current version: v0.8.0 → v0.8.2; two DMG examples0.8.1 → 0.8.2.Verification (Part A, all green)
cargo build --lockedOK; version triple all0.8.2.cargo test update_check11/0;updateCheckUi.test.mjs12/0.npm run buildOK;cargo fmt --all -- --checkclean.openspec validate task-057-publish-v082-release --strictvalid.Out of scope (Part B — SW-6, after merge)
DMG build (
npm run tauri:build) +gh release create v0.8.2(full, server-side tag, DMG asset, Plan-B notes) and live update-check verification. No GitHub Release / asset upload / auto-updater / signing in this PR.Refs: TASK-057
🤖 Generated with Claude Code