From 77c21eb137ab3334ee10db255187ef8bd717578a Mon Sep 17 00:00:00 2001 From: Brian Corder Date: Sun, 24 May 2026 11:01:53 -0500 Subject: [PATCH] chore: release 0.2.0 --- CHANGELOG.md | 2 ++ Cargo.lock | 14 +++++++------- Cargo.toml | 2 +- README.md | 6 +++--- RELEASING.md | 2 +- docs/RELEASES.md | 2 +- docs/VERIFYING_RELEASES.md | 2 +- 7 files changed, 16 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5a52ad..2dc0bbb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ and SessionScope uses semantic versioning as described in ## Unreleased +## 0.2.0 - 2026-05-24 + ### Added - Added `docs/COVERAGE_MATRIX.md` as the per-check source of truth for supported, review-required, and intentionally not-covered SessionScope evidence patterns across languages, frameworks, libraries, lifecycle stages, finding categories, and SARIF rule IDs. diff --git a/Cargo.lock b/Cargo.lock index 8ee4648..d3d2a37 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -452,14 +452,14 @@ dependencies = [ [[package]] name = "sessionscope-classifier" -version = "0.1.0" +version = "0.2.0" dependencies = [ "sessionscope-model", ] [[package]] name = "sessionscope-cli" -version = "0.1.0" +version = "0.2.0" dependencies = [ "serde", "serde_json", @@ -474,7 +474,7 @@ dependencies = [ [[package]] name = "sessionscope-core" -version = "0.1.0" +version = "0.2.0" dependencies = [ "globset", "ignore", @@ -487,7 +487,7 @@ dependencies = [ [[package]] name = "sessionscope-detectors" -version = "0.1.0" +version = "0.2.0" dependencies = [ "regex", "sessionscope-model", @@ -499,7 +499,7 @@ dependencies = [ [[package]] name = "sessionscope-model" -version = "0.1.0" +version = "0.2.0" dependencies = [ "serde", "serde_json", @@ -507,7 +507,7 @@ dependencies = [ [[package]] name = "sessionscope-reporters" -version = "0.1.0" +version = "0.2.0" dependencies = [ "percent-encoding", "serde-sarif", @@ -518,7 +518,7 @@ dependencies = [ [[package]] name = "sessionscope-testing" -version = "0.1.0" +version = "0.2.0" dependencies = [ "serde", "serde_json", diff --git a/Cargo.toml b/Cargo.toml index 93ae41a..366d0ed 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -11,7 +11,7 @@ members = [ resolver = "2" [workspace.package] -version = "0.1.0" +version = "0.2.0" edition = "2024" rust-version = "1.95" description = "Defensive session, cookie, JWT, and token lifecycle auditing for product-security review." diff --git a/README.md b/README.md index fa4c785..460ef13 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ jobs: steps: - uses: actions/checkout@v4 - id: sessionscope - uses: Ozark-Security-Labs/SessionScope@v0.1.0 + uses: Ozark-Security-Labs/SessionScope@v0.2.0 with: mode: advisory path: . @@ -200,13 +200,13 @@ Config precedence is: ## Project status -- **Release target:** v0.1.0 first packaged release through GitHub Releases. Release packaging, versioning, and installation workflow are tracked in #28. +- **Release target:** v0.2.0 packaged release through GitHub Releases. - **Complete:** v0.1 foundation plus the v0.2 depth-first edge-case hardening round for cookie rules, JWT crypto-trust, OAuth/OIDC flow integrity, client storage hygiene, lifecycle gaps, false-positive fixtures, JSON snapshots, and CLI exit-code tests. - **Deferred:** v0.3+ breadth expansion for new languages and frameworks; see [docs/ROADMAP.md](docs/ROADMAP.md). - **Schema:** JSON contract v0.5.0. - **Rust:** edition 2024. MSRV is 1.95. - **Platforms:** Linux, macOS, and Windows are covered by CI where workflow support exists. -- **Versioning:** workspace `Cargo.toml` is `0.1.0`; release tags use `vMAJOR.MINOR.PATCH`. +- **Versioning:** workspace `Cargo.toml` is `0.2.0`; release tags use `vMAJOR.MINOR.PATCH`. Phase plan and upcoming work are tracked in [docs/ROADMAP.md](docs/ROADMAP.md). diff --git a/RELEASING.md b/RELEASING.md index d204c5b..f1c3aa6 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -176,7 +176,7 @@ gh run watch -R Ozark-Security-Labs/SessionScope After the release publishes, verify at least one binary archive: ```sh -TAG=v0.1.0 +TAG=v0.2.0 HOST=x86_64-unknown-linux-gnu gh release download "$TAG" -R Ozark-Security-Labs/SessionScope \ -p '*.tar.gz' -p '*.zip' -p '*.sha256' -p '*.intoto.jsonl' diff --git a/docs/RELEASES.md b/docs/RELEASES.md index 5b6cd1a..84399db 100644 --- a/docs/RELEASES.md +++ b/docs/RELEASES.md @@ -33,7 +33,7 @@ A parallel summary lives in [`SCHEMA.md` Version policy](SCHEMA.md#version-polic | Surface | Constant | Current | Governs | | ------- | -------- | ------- | ------- | -| CLI release | `sessionscope` crate version (`Cargo.toml`) | `0.1.0` | CLI flags, command grammar, output paths, exit codes, `sessionscope.toml` keys, GitHub Action inputs | +| CLI release | `sessionscope` crate version (`Cargo.toml`) | `0.2.0` | CLI flags, command grammar, output paths, exit codes, `sessionscope.toml` keys, GitHub Action inputs | | Scan report | `SCHEMA_VERSION` (`schema.rs`) | `0.5.0` | `ScanReport` JSON inventory and findings shape | | Baseline | `BASELINE_SCHEMA_VERSION` (`baseline.rs`) | `0.1.0` | Baseline JSON wire format | | Diff | `DIFF_SCHEMA_VERSION` (`baseline.rs`) | `0.1.0` | Diff JSON wire format | diff --git a/docs/VERIFYING_RELEASES.md b/docs/VERIFYING_RELEASES.md index 0400b22..f45c7e5 100644 --- a/docs/VERIFYING_RELEASES.md +++ b/docs/VERIFYING_RELEASES.md @@ -36,7 +36,7 @@ go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest ## Verify checksums ```sh -TAG=v0.1.0 +TAG=v0.2.0 HOST=x86_64-unknown-linux-gnu gh release download "$TAG" -R Ozark-Security-Labs/SessionScope \