Repository navigation
Release Latch v1.0.1 security packages - #16
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a226bd8184
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| publish: | ||
| needs: handler-and-unit | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' |
There was a problem hiding this comment.
The checked release documentation at docs/ci.md:39 still says manual dispatches are read-only, main pushes publish, and the workflow creates a missing tag. This condition now makes manual dispatch the only publishing path, while scripts/release.cjs:69-70 requires the exact tag to exist beforehand. An operator following the repository's sole documented procedure will either see no publication after a main push or receive an error from a manual run without a pre-created tag, so the release instructions need to be updated with the new ordering.
Useful? React with 👍 / 👎.
| The local CLI requires **Node 22+** and **pnpm 10.17.1+**. Integration targets an existing React, TypeScript, and Vite application. The [installation guide](docs/installation.md) lists tested versions and browser setup. | ||
|
|
||
| Version **1.0.0** uses six prebuilt package tarballs with checksums in the [GitHub release](https://github.com/agammann/latch/releases/tag/v1.0.0). The `@latch-local/*` names are local distribution identifiers; packages have not been published to a registry. The public Studio runs on OpenAI Sites. This repository contains the CLI, runtime, local console, examples, and release evidence; the Studio website source is maintained separately. Studio version 5 runtime downloads were verified against the six published v1.0.0 packages on October 7, 2026 (UTC); see the [delivered-release check](docs/studio.md#delivered-v1-release-check-october-7-2026-utc). The [v1 stability contract](docs/stability.md) covers the CLI, typed runtime contracts and React/Vite integration. | ||
| Version **1.0.1** uses six prebuilt package tarballs with checksums in the [GitHub release](https://github.com/agammann/latch/releases/tag/v1.0.1). The `@latch-local/*` names are local distribution identifiers; packages have not been published to a registry. The public Studio runs on OpenAI Sites. This repository contains the CLI, runtime, local console, examples, and release evidence; the Studio website source is maintained separately. Studio version 5 runtime downloads were verified against the six published v1.0.0 packages on October 7, 2026 (UTC); see the [delivered-release check](docs/studio.md#delivered-v1-release-check-october-7-2026-utc). The [v1 stability contract](docs/stability.md) covers the CLI, typed runtime contracts and React/Vite integration. |
There was a problem hiding this comment.
This now advertises 1.0.1 as the current package set and links users to the v1 stability contract, but the linked docs/stability.md:15-17 upgrade procedure still tells 0.1.0 users to replace their packages with v1.0.0. Because this release exists specifically to distribute the project-read and CI-loopback security fixes absent from the 1.0.0 downloads, users following that documented upgrade path will install the old package set instead of the security release.
Useful? React with 👍 / 👎.
The v1.0.0 package downloads predate the project-read and CI loopback fixes. This updates all six matching package versions, generated examples, installation instructions, and release notes. Main, PR, and tag runs verify; publication requires a manual main run and the pre-existing exact tag.
Local validation: full repository verification, handler regressions, six package audits and consumer checks passed; GitHub CI will repeat Ubuntu and Windows lanes.