bdo-cli 0.45.0 → 0.45.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +43 -0
- package/README.md +7 -4
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,49 @@ All notable changes to Bushido (bdo) will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.45.2] (2026-09-11)
|
|
9
|
+
|
|
10
|
+
### Security
|
|
11
|
+
|
|
12
|
+
- **Dependency audit**: `quick-xml` 0.37 → 0.41, `anyhow` 1.0.103,
|
|
13
|
+
`crossbeam-epoch` 0.9.20. The quick-xml jump changed its event model
|
|
14
|
+
(entity references now arrive as separate events); both XML consumers —
|
|
15
|
+
`.csproj` project-kind detection and TRX test-result parsing — were
|
|
16
|
+
migrated so their output is byte-for-byte unchanged, with tests locking
|
|
17
|
+
that in.
|
|
18
|
+
|
|
19
|
+
### Chores
|
|
20
|
+
|
|
21
|
+
- CI now runs `cargo audit` against `Cargo.lock` on every push and PR, with
|
|
22
|
+
warnings (including unmaintained crates) treated as failures.
|
|
23
|
+
|
|
24
|
+
## [0.45.1] (2026-09-05)
|
|
25
|
+
|
|
26
|
+
The `bdo` binary is unchanged from 0.45.0 — this release fixes the installer
|
|
27
|
+
and the CI guard around it.
|
|
28
|
+
|
|
29
|
+
### Fixes
|
|
30
|
+
|
|
31
|
+
- **`install.sh` could never install anything.** It requested
|
|
32
|
+
`bdo-<target>.tar.gz`, but releases publish `bushido-<target>.tar.xz` — the
|
|
33
|
+
archive is named after the crate, not the binary, and compressed with xz, so
|
|
34
|
+
every download 404'd. Adding checksum verification in 0.45.0 didn't reveal
|
|
35
|
+
this because the failure happens a step earlier. Alongside the name: the
|
|
36
|
+
explicit `-z` is gone (GNU tar applies a compression flag literally and fails
|
|
37
|
+
on a valid archive; both tars auto-detect), and the binary is now taken from
|
|
38
|
+
the `<crate>-<target>/` directory the archive actually contains rather than
|
|
39
|
+
the archive root.
|
|
40
|
+
- **The installer reported the wrong binary.** `verify()` resolved `bdo`
|
|
41
|
+
through `PATH`, so another copy shadowing the install directory printed its
|
|
42
|
+
version — making a good install read as a failed upgrade. It now reports the
|
|
43
|
+
binary it just installed, by path, and warns when something else on `PATH`
|
|
44
|
+
will run instead.
|
|
45
|
+
- **`scripts/check-release-hardening.sh` passed mutable action refs.** It
|
|
46
|
+
blocklisted `@v<digit>` instead of requiring a 40-char commit SHA, so
|
|
47
|
+
`@main`, `@latest` and `@1.2.3` all reported "hardening intact" — false
|
|
48
|
+
assurance about the workflow that holds the publish tokens. It now asserts
|
|
49
|
+
the allowed shape.
|
|
50
|
+
|
|
8
51
|
## [0.45.0] (2026-08-16)
|
|
9
52
|
|
|
10
53
|
A security release. Two changes alter behavior you may notice — see
|
package/README.md
CHANGED
|
@@ -76,16 +76,19 @@ cargo install --git https://github.com/tedorigawa001/TokenReductionTool
|
|
|
76
76
|
### Pre-built Binaries
|
|
77
77
|
|
|
78
78
|
Download from [releases](https://github.com/tedorigawa001/TokenReductionTool/releases):
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
79
|
+
Archives are named after the crate (`bushido`); the binary inside is `bdo`.
|
|
80
|
+
Each has a `.sha256` sidecar — verify before extracting.
|
|
81
|
+
|
|
82
|
+
- macOS: `bushido-x86_64-apple-darwin.tar.xz` / `bushido-aarch64-apple-darwin.tar.xz`
|
|
83
|
+
- Linux: `bushido-x86_64-unknown-linux-gnu.tar.xz` / `bushido-aarch64-unknown-linux-gnu.tar.xz`
|
|
84
|
+
- Windows: `bushido-x86_64-pc-windows-msvc.zip`
|
|
82
85
|
|
|
83
86
|
> **Windows users**: Extract the zip and place `bdo.exe` somewhere in your PATH (e.g. `C:\Users\<you>\.local\bin`). Run Bushido from **Command Prompt**, **PowerShell**, or **Windows Terminal** — do not double-click the `.exe` (it will flash and close). For the best experience, use [WSL](https://learn.microsoft.com/en-us/windows/wsl/install) where the full hook system works natively. See [Windows setup](#windows) below for details.
|
|
84
87
|
|
|
85
88
|
### Verify Installation
|
|
86
89
|
|
|
87
90
|
```bash
|
|
88
|
-
bdo --version # Should show "bdo 0.45.
|
|
91
|
+
bdo --version # Should show "bdo 0.45.2"
|
|
89
92
|
bdo gain # Should show token savings stats
|
|
90
93
|
```
|
|
91
94
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"artifactDownloadUrls": [
|
|
3
|
-
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.
|
|
3
|
+
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.2"
|
|
4
4
|
],
|
|
5
5
|
"author": "Patrick Szymkowiak",
|
|
6
6
|
"bin": {
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"zipExt": ".tar.xz"
|
|
92
92
|
}
|
|
93
93
|
},
|
|
94
|
-
"version": "0.45.
|
|
94
|
+
"version": "0.45.2",
|
|
95
95
|
"volta": {
|
|
96
96
|
"node": "18.14.1",
|
|
97
97
|
"npm": "9.5.0"
|