[rawframe-release]

🤖 I have created a release beep boop

1.1.0 (2026-11-04)

Added

• Every call that takes a muniSegmentIterator or a
  muniScriptIterator back now checks it first, and refuses one no
  init call set up with muni_errorInvalid, leaving it as it was: a
  zeroed iterator, one of stray bytes, or one whose counts, flags or
  states are out of range. Such an iterator was undefined behavior
  before, and a forged script iterator could overflow a buffer on the
  stack. muniSegmentIterator_GetLineBreakStrictness and
  muniSegmentIterator_GetWritingSystem give their defaults for it, as
  for NULL. A copy of an initialized iterator is accepted. The
  pointers an iterator keeps (the text, the overrides, the breaker)
  cannot be checked, so an iterator changed there by hand stays outside
  the contract
  (#264,
  #267).

Changed

• The check costs each iterator call a few nanoseconds: line breaking
  over English prose takes 1 to 2% longer, and up to 20% where every
  call reports a boundary two code points after the last. Neither
  iterator changes size
  (#264).

No results change: the Unicode data is still 18.0.0 and
MUNI_RESULTS_VERSION stays 2, so stored normalized keys, skeletons
and verdicts from 1.0.0 stay valid.

---

This PR was generated with Release Please. See documentation.

[siracozmen01]

Review of the 1.1.0 curation at dfdc90c: ready. Read against #264's body; #262 is ci.

• Added matches #264.
  • Every call that takes an iterator back checks it and refuses with muni_errorInvalid, leaving it unchanged: a zeroed one, stray bytes, or counts, flags or states out of range.
  • The forged script iterator's stack overflow is what #264 names: 65 bytes copied into a 4-byte window. The getters give their NULL defaults.
  • A copy is accepted, and the pointers (text, overrides, breaker) stay outside the contract.
• Changed matches #264's measurements.
  • "A few nanoseconds": +1.3, +1.9 and +4.9 ns best, medians up to +5.4.
  • "1 to 2% on English prose": the UDHR text, +1% best and +2% median.
  • "Up to 20%": lines of "a " repeated, a boundary every two code points.
  • Neither iterator changes size, since the cookie fills existing padding.
• No results change. base.h at the head still has Unicode 18.0.0 and MUNI_RESULTS_VERSION 2, and #264 says every result for an initialized iterator is the same.
• The bump is right. 1.1.0 for a feat at 1.x, with no !, as the standard asks for a call that was undefined behavior and now refuses with a documented result. maul-unicode stamps no ABI version into a def, so there is no rebuild note to add.
• Left out: #262 and #260, both ci, are the other PRs merged since 1.0.0. Leaving both out is right.
• The body and the CHANGELOG entry are identical line for line. The manifest and MUNI_VERSION_MINOR agree.

[siracozmen01]

Re-curation review at c9e589d: ready. Main is c6c66ec (#267's merge). Its release run finished with success; its ci and codeql runs were still queued when I looked. The PR's own checks are assumed to pass.

The difference from dfdc90c, which I approved. In CHANGELOG.md, the only change is the Added entry's link line, from ([#264](...)). to ([#264](...), followed by [#267](...)).. There is no Fixed section in either version. The body's 1.1.0 section is again the same text as the CHANGELOG's, intro and "No results change" paragraph included. The headers are the same blobs at both heads, base.h included, and the manifest is still 1.1.0.

Folding #267 into Added is right. The iterator check is #264's, and it ships first in 1.1.0: 1.0.0's section has no such check. So the start check #267 added fixes nothing a release carried. It completes the same feature before it ships, and a separate Fixed line would describe a bug no released version had.

"Refuses one no init call set up" holds with #267 in. From my review of #267, Load now refuses an SA run whose start is past the cursor, and already held next to the run's length. Those are the only fields of the run the calls compute with, apart from the text pointer, its length and the breaker. The entry already names those three as the pointers an iterator keeps, which cannot be checked. So an iterator changed in its counts, flags or states, the run's start included, is refused, as the entry says.

[rawframe-release]

🤖 Created releases:

• v1.1.0

🌻