Conversation
Refresh version string (0.8.0-preview.1 -> 0.8.0-preview.2) across 24 insta snapshots after the version bump in fd7bb7e: - 16 main_composition screen snapshots (status bar version in footer) - 6 status_bar snapshots + config_about_tab (about box version) - main_integration_test main_screen snapshot (zh footer) - main_composition_help_overlay: only the trailing version digit shows through the overlay box (1 -> 2) cli_version_test is dynamic (CARGO_PKG_VERSION); stage_binaries_test.sh is hermetic (own fake Cargo.toml), so neither needs changes. Full suite green: 3099 passed, 0 failed.
Homebrew 6.0.0 requires explicit trust for non-official taps on macOS and Linux (not Linux-specific). Add 'brew trust --formula openkeyring/oak-keyring/ok' before 'brew install ok' in INSTALL, README, and RELEASE (EN/ZH), with the refusal error text and one-liner alternatives.
Standardize code comments (//, ///, //!), the tui/cloud/sync INSTRUCTIONS.md files, and build/config comments (justfile, .env.example, rust-analyzer.toml) to English, per the project rule that code comments must be uniformly in English. Comments and instruction-doc prose only. No code logic, string literals, locale files (zh-CN.yml), or test snapshots were modified. Verified: cargo build clean, cargo test --doc passes, and the diff is comment-only (155 insertions / 155 deletions, symmetric).
…ocale rust_i18n's locale is process-global and t!() reads it lock-free, so parallel tests that mutate the locale (init/switch_locale) raced with locale-dependent renders (flaky list_render_isolates..., database_recovery, etc.). Prior lock+guard approaches only serialized code that acquired the guard; writers and un-guarded readers bypassed it. Fixed at the read path: wrap t! in a crate-level macro that injects locale = render_locale(), backed by a thread-local (default "en"). Renders now translate per-thread, so cross-thread races are impossible by construction. init/switch_locale set both the thread-local and the global; LocaleGuard becomes thread-local save/restore; LOCALE_LOCK/ReentrantMutex removed entirely. t! is the single choke point, so ~1033 call sites are unchanged. Production render path (view::render) is untouched — the main thread's locale is set at startup via init(config) and updated by switch_locale, preserving existing behavior including the onboarding live-language preview. Verified: full lib x22, tui:: x35, onboarding+isolation x50 — 0 failures (was ~20-100%); full cargo test, cargo fmt --check, and cargo clippy --tests -- -D warnings all clean.
Resolves Dependabot alerts #2 and #3, which are the same vulnerability (GHSA-3rjw-m598-pq24 / CVE-2026-50185) reported once per lockfile: - #2: root Cargo.lock - #3: tools/okb-gen/Cargo.lock cmov's aarch64 Cmov/CmovEq inline asm assumed zero-extension of sub-register-width loads, but the high bits are undefined per the Rust reference, causing csel to pick the wrong branch after a narrowing cast. Fixed in cmov 0.5.4. Both workspaces resolved the same transitive chain to the vulnerable 0.5.3: oak-keyring -> keepass 0.12.9 -> digest 0.11.3 -> ctutils 0.4.2 -> cmov. Updated both independent Cargo.lock files. Verified: release build + full test suite pass on both workspaces.
fix(deps): bump cmov 0.5.3 -> 0.5.4 (GHSA-3rjw-m598-pq24)
- cmov 0.5.3 -> 0.5.4 (GHSA-3rjw-m598-pq24) already on develop; this release propagates it to master. - Update CHANGELOG entry for 0.8.0-preview.3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes
developtomasterand cuts release v0.8.0-preview.3. Primary motivation: clear the 2 open moderate dependabot alerts onmasterfor GHSA-3rjw-m598-pq24 (cmov— Cmov/CmovEq on aarch64 can produce wrong results when high register bits are set). The fix (cmov0.5.3 → 0.5.4) is already ondevelopvia #157; this PR carries it (and the rest of the unreleased work) tomaster.Notable changes (since v0.8.0-preview.2)
cmov0.5.3 → 0.5.4, fixing GHSA-3rjw-m598-pq24 (resolves both open alerts).Release artifacts
0.8.0-preview.2→0.8.0-preview.3(Cargo.toml)v0.8.0-preview.3will be pushed after merge → triggersrelease.yml(4-target builds, GitHub prerelease, npm publish).Verification
cargo fmt --check✅cargo clippy --all-targets -- -D warnings✅cargo test✅ (2600+ tests, 0 failures)