@oakoss/oakum 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.5.1 (2026-10-15)
+
+### Fixed
+
+Discovery's `cargo metadata`, `pnpm root -w` and `pnpm list`, and the `pnpm --version` that `init` and `migrate` run, now run under the same wall-clock deadline as oakum's git children: five minutes, or `OAKUM_REMOTE_DEADLINE` seconds, per child. A child that never answered, for example `cargo metadata` blocked opening a member `Cargo.toml` that is a FIFO, used to hang every command that discovers packages with no output, the CI version job included. Oakum now kills it at the deadline and reports the look as unverified (exit 2), naming the tool and the variable. A malformed `OAKUM_REMOTE_DEADLINE`, which discovery used to ignore, now leaves discovery unverified too, as it already did for git. When one tool times out and the other fails outright, the failure decides (exit 1). If `cargo` or `pnpm` is a wrapper that starts the real tool as its own child, the real tool can outlive the kill.
+
+A git call that never answers now leaves the run unverified (exit 2): one killed at `OAKUM_REMOTE_DEADLINE`, or one whose output stalled or could not be read. The exit used to follow the kind of call, so a hung `git log` made `check --strict` exit 1, a hung `merge-base` made `version` and `status` exit 1, and a hung config probe, the first git call a command makes, made `version` exit 1, each reporting a failure where nothing was settled. `ci version-pr` keeps exit 2 when it adds context to a git error, and the `release` changelog read keeps a call that never answered unverified while still refusing one that answered with a failure.
+
+`release` re-checks a `git tag` or `git push` that never answered. When the tag is found locally, or the push on the remote, it stops with exit 1 and names the stage (`tagged` or `pushed`); when the tag is not there, the stage is the one before. Only when the re-check fails too is the stop unverified (exit 2). A `git tag` that never answered no longer reports `completed: none` over a tag it wrote. The detail under an unverified stop says `unverified` once, not twice.
+
+A `git` that cannot be started, or that answered with a failure, keeps its exit.
+
+Update rustls to 0.23.46 for RUSTSEC-2026-0346, -0347, -0348, and -0349, along with other semver-compatible dependency updates. serde-saphyr is capped below 1.3, so `cargo install oakum` without `--locked` keeps reading an empty block scalar (`core: |`) in a pnpm catalog as unresolved.
+
 ## 0.5.0 (2026-10-05)
 
 ### Changed
@@ -268,4 +282,4 @@ Release workflow checks out the homebrew tap in a subdirectory so the composite
 
 Self-host release CI uploads cargo-dist artifacts into the GitHub Release oakum already created, instead of calling create again.
 
-Generated by oakum 0.4.0.
+Generated by oakum 0.5.0.

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@oakoss/oakum",
-      "version": "0.5.0"
+      "version": "0.5.1"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.5.0"
+  "version": "0.5.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/oakoss/oakum/releases/download/v0.5.0"
+    "https://github.com/oakoss/oakum/releases/download/v0.5.1"
   ],
   "author": "Jace Babin",
   "bin": {
@@ -105,7 +105,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.5.0",
+  "version": "0.5.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"