bdo-cli 0.46.0 → 0.46.1

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.46.1] (2026-10-17)
+
+### Security
+
+- **rustls 0.23.45 → 0.23.46** (via `ureq`), fixing RUSTSEC-2026-0346
+  (`Debug` impls for client session values expose TLS secrets, medium),
+  RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 (including an
+  unauthenticated ServerHello downgrading later connections to classical key
+  exchange, low). Caught by the daily scheduled `cargo audit` run. No code
+  changes.
+
+- **CI actions pinned to commit SHAs.** `ci.yml` used mutable refs
+  (`actions/checkout@v6`, `dtolnay/rust-toolchain@1.91`), so whoever controls
+  those tags or branches could change what runs on every PR. They are now
+  pinned like `release.yml`, every checkout drops its credentials
+  (`persist-credentials: false`), and the hardening check runs against
+  `ci.yml` too, so an unpinned action fails CI.
+
 ## [0.46.0] (2026-10-04)
 
 ### Features

package/README.md

@@ -97,7 +97,7 @@ Each has a `.sha256` sidecar — verify before extracting.
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.46.0"
+bdo --version   # Should show "bdo 0.46.1"
 bdo gain        # Should show token savings stats
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.46.0"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.46.1"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.46.0",
+  "version": "0.46.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"