chore: release v0.1.28

[github-actions]

🤖 New release

• cryptify: 0.1.27 -> 0.1.28

Changelog

0.1.28 - 2026-08-07

Added

• configurable email attribute type for the finalize sender check (#193)
• (metrics) require a bearer token on /metrics when configured (#177)
• persist rolling-quota usage to SQLite (usage_db) (#176)
• add GET /email-template endpoint keyed on API key (#175)
• (metrics) capture X-POSTGUARD-CLIENT-VERSION client identity (#174)
• (email) remove circle around signer-verified checkmark (#173)
• (email) replace unicode checkmark with inline PNG image (#172)
• (email) staging-only /staging/preview/ + shared render API (#171)
• (metrics) pre-seed known channels at zero on startup (#165)
• expose Prometheus /metrics endpoint for usage dashboards (#102)

Fixed

• retry the startup verifying-key fetch instead of panicking (#192)
• (cors) allow X-Cryptify-Source in browser preflights (#189)
• (email) larger, selectable download-link code block in recipient email (#187)
• return generic body from 5xx responses, log detail server-side (#185)
• require validated API key on GET /usage (GHSA-5rhx-xgvv-h78h) (#183)
• (cors) allow Office add-in origins (addin.postguard.eu + localhost:3000) and DELETE method (#179)
• (email) address postguard#197 deliverability + show disclosed signer name (#170)

Other

• retire Docker build/push, publishing moved to postguard (#206)
• README banner — development moved to postguard, crate is cryptify/
• tune the oasdiff gate's severity settings and pin them with a test (#203)
• add the oasdiff breaking-change gate (#201)
• true up api-description.yaml with the mounted routes (#200)
• remove unused irma dependency (#199)
• remove unused qrcode, strum and strum_macros deps (#195)
• extend CLAUDE.md with migrated agent notes (#190)
• update dependencies (#181)
• (deps) cargo update lockfile (#168)
• replace pkg_url with https://pkg.postguard.eu/ (#178)
• bump pg-core 0.6.0 → 0.6.1 (#164)
• add semantic PR title check workflow (#162)

Security

• require a validated API key on GET /usage and reject unauthenticated callers with 401 (GHSA-5rhx-xgvv-h78h)
• compare cryptify_token values in constant time, matching the recovery-token path

---

This PR was generated with release-plz.

[dobby-coder]

Thanks for opening this! I'm on it — taking a look at the cryptify 0.1.27 → 0.1.28 release PR now and will follow up with a review shortly.

[dobby-coder]

Two problems in the generated 0.1.28 notes. Both are one-click suggestions below.

The release is missing the lettre 0.11.22 bump (#160), which is the only RUSTSEC advisory fix in this range. It dropped out because #160 was landed as a merge commit (6a003d2), so release-plz only saw the merge subject, which is not a conventional commit. Every other PR in the range was squash-merged and made it in. Verified with git merge-base --is-ancestor e700804 v0.1.27 (false, so the commit sits after the tag) and by grepping the 0.1.28 section for lettre (no hit).

The GET /usage hardening is listed twice: once auto-generated under ### Fixed (line 31) and once in the hand-written ### Security block that release-plz reparented out of [Unreleased].

One caveat on the first suggestion: it edits the auto-generated ### Other section, so it holds as long as no new commits land on main before this merges. If release-plz regenerates the section, re-apply it.

Checked and clean: the PR title satisfies the pr-title.yml semantic check; the patch bump is right (no ! or BREAKING CHANGE commits in the range, and the crate is publish = false / git_only = true with no [lib] target, so there is no public API surface a minor bump would protect); no banned words in the prose.

For future releases, git log <last-tag>..HEAD against the generated section catches this class of drop.

[dobby-coder]

The 0.1.28 notes are missing a change that ships in this release: commit e700804, chore: bump lettre 0.11.21 -> 0.11.22 (RUSTSEC-2026-0141), dated 2026-05-16 and after the v0.1.27 tag (git merge-base --is-ancestor e700804 v0.1.27 is false).

Root cause: PR #160 was landed with a merge commit (6a003d2 Merge pull request #160 from encryption4all/chore/cargo-audit-159) instead of a squash, so release-plz only saw the merge subject, which is not a conventional commit, and dropped it. The two merge commits in the range are 6a003d2 and f88807a; the latter is the previous release PR (#149) and correctly earns no entry, so #160 is the only real casualty.

Worth fixing because it is the only RUSTSEC advisory fix in the release, and readers of the notes would not otherwise know it is included.

Suggested change

	- add semantic PR title check workflow ([#162](https://github.com/encryption4all/cryptify/pull/162))
	- add semantic PR title check workflow ([#162](https://github.com/encryption4all/cryptify/pull/162))
	- bump lettre 0.11.21 → 0.11.22 (RUSTSEC-2026-0141) ([#160](https://github.com/encryption4all/cryptify/pull/160))

[dobby-coder]

The GET /usage hardening is now listed twice inside the same 0.1.28 section: once auto-generated under ### Fixed (line 31, require validated API key on GET /usage (GHSA-5rhx-xgvv-h78h) (#183)) and again here under the hand-written ### Security.

Both hand-written Security bullets came from PR #183, so they do belong to 0.1.28 and release-plz reparenting them out of [Unreleased] landed them correctly. The leftover is just the duplicate.

Trim this line rather than the ### Fixed one, since release-plz regenerates the auto sections on every release. The constant-time cryptify_token bullet on line 53 has no auto-generated counterpart, so it stays.

Suggested change

- require a validated API key on `GET /usage` and reject unauthenticated callers with 401 (GHSA-5rhx-xgvv-h78h)

[dobby-coder]

I reviewed this release PR and requested changes: #205 review.

Two fixes needed in CHANGELOG.md, both with one-click suggestions:

• The 0.1.28 notes are missing the lettre 0.11.21 → 0.11.22 bump (chore: address cargo audit advisories #160), the only RUSTSEC fix in this range — it was dropped because chore: address cargo audit advisories #160 landed as a merge commit rather than a squash, so release-plz didn't pick up its subject line.
• The GET /usage hardening entry is listed twice (once auto-generated, once hand-written under Security) — trimmed the duplicate.

Everything else checks out: PR title passes the semantic check, the version bump (patch) is correct, and I ruled out a false-positive claim that the Added entries required a minor bump — this crate is binary-only and not published, so there's no public API surface at stake.

One heads-up for whoever merges: the changelog suggestion touches an auto-generated section, so if new commits land on main before merge, it'll need reapplying.