chore: release v0.1.28 #205
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
|
|
@@ -7,6 +7,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 | |||
|
|
||||
| ## [Unreleased] | ||||
|
|
||||
| ## [0.1.28](https://github.com/encryption4all/cryptify/compare/v0.1.27...v0.1.28) - 2026-08-07 | ||||
|
|
||||
| ### Added | ||||
|
|
||||
| - configurable email attribute type for the finalize sender check ([#193](https://github.com/encryption4all/cryptify/pull/193)) | ||||
| - *(metrics)* require a bearer token on /metrics when configured ([#177](https://github.com/encryption4all/cryptify/pull/177)) | ||||
| - persist rolling-quota usage to SQLite (usage_db) ([#176](https://github.com/encryption4all/cryptify/pull/176)) | ||||
| - add GET /email-template endpoint keyed on API key ([#175](https://github.com/encryption4all/cryptify/pull/175)) | ||||
| - *(metrics)* capture X-POSTGUARD-CLIENT-VERSION client identity ([#174](https://github.com/encryption4all/cryptify/pull/174)) | ||||
| - *(email)* remove circle around signer-verified checkmark ([#173](https://github.com/encryption4all/cryptify/pull/173)) | ||||
| - *(email)* replace unicode checkmark with inline PNG image ([#172](https://github.com/encryption4all/cryptify/pull/172)) | ||||
| - *(email)* staging-only /staging/preview/<uuid> + shared render API ([#171](https://github.com/encryption4all/cryptify/pull/171)) | ||||
| - *(metrics)* pre-seed known channels at zero on startup ([#165](https://github.com/encryption4all/cryptify/pull/165)) | ||||
| - expose Prometheus /metrics endpoint for usage dashboards ([#102](https://github.com/encryption4all/cryptify/pull/102)) | ||||
|
|
||||
| ### Fixed | ||||
|
|
||||
| - retry the startup verifying-key fetch instead of panicking ([#192](https://github.com/encryption4all/cryptify/pull/192)) | ||||
| - *(cors)* allow X-Cryptify-Source in browser preflights ([#189](https://github.com/encryption4all/cryptify/pull/189)) | ||||
| - *(email)* larger, selectable download-link code block in recipient email ([#187](https://github.com/encryption4all/cryptify/pull/187)) | ||||
| - return generic body from 5xx responses, log detail server-side ([#185](https://github.com/encryption4all/cryptify/pull/185)) | ||||
| - require validated API key on GET /usage (GHSA-5rhx-xgvv-h78h) ([#183](https://github.com/encryption4all/cryptify/pull/183)) | ||||
| - *(cors)* allow Office add-in origins (addin.postguard.eu + localhost:3000) and DELETE method ([#179](https://github.com/encryption4all/cryptify/pull/179)) | ||||
| - *(email)* address postguard#197 deliverability + show disclosed signer name ([#170](https://github.com/encryption4all/cryptify/pull/170)) | ||||
|
|
||||
| ### Other | ||||
|
|
||||
| - retire Docker build/push, publishing moved to postguard ([#206](https://github.com/encryption4all/cryptify/pull/206)) | ||||
| - README banner — development moved to postguard, crate is cryptify/ | ||||
| - tune the oasdiff gate's severity settings and pin them with a test ([#203](https://github.com/encryption4all/cryptify/pull/203)) | ||||
| - add the oasdiff breaking-change gate ([#201](https://github.com/encryption4all/cryptify/pull/201)) | ||||
| - true up api-description.yaml with the mounted routes ([#200](https://github.com/encryption4all/cryptify/pull/200)) | ||||
| - remove unused irma dependency ([#199](https://github.com/encryption4all/cryptify/pull/199)) | ||||
| - remove unused qrcode, strum and strum_macros deps ([#195](https://github.com/encryption4all/cryptify/pull/195)) | ||||
| - extend CLAUDE.md with migrated agent notes ([#190](https://github.com/encryption4all/cryptify/pull/190)) | ||||
| - update dependencies ([#181](https://github.com/encryption4all/cryptify/pull/181)) | ||||
| - *(deps)* cargo update lockfile ([#168](https://github.com/encryption4all/cryptify/pull/168)) | ||||
| - replace pkg_url with https://pkg.postguard.eu/ ([#178](https://github.com/encryption4all/cryptify/pull/178)) | ||||
| - bump pg-core 0.6.0 → 0.6.1 ([#164](https://github.com/encryption4all/cryptify/pull/164)) | ||||
| - add semantic PR title check workflow ([#162](https://github.com/encryption4all/cryptify/pull/162)) | ||||
|
|
||||
| ### Security | ||||
|
|
||||
| - require a validated API key on `GET /usage` and reject unauthenticated callers with 401 (GHSA-5rhx-xgvv-h78h) | ||||
|
Contributor
There was a problem hiding this comment. The Both hand-written Security bullets came from PR #183, so they do belong to 0.1.28 and release-plz reparenting them out of Trim this line rather than the
Suggested change
|
||||
|
|
||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The 0.1.28 notes are missing a change that ships in this release: commit
e700804,chore: bump lettre 0.11.21 -> 0.11.22 (RUSTSEC-2026-0141), dated 2026-05-16 and after the v0.1.27 tag (git merge-base --is-ancestor e700804 v0.1.27is false).Root cause: PR #160 was landed with a merge commit (
6a003d2 Merge pull request #160 from encryption4all/chore/cargo-audit-159) instead of a squash, so release-plz only saw the merge subject, which is not a conventional commit, and dropped it. The two merge commits in the range are6a003d2andf88807a; the latter is the previous release PR (#149) and correctly earns no entry, so #160 is the only real casualty.Worth fixing because it is the only RUSTSEC advisory fix in the release, and readers of the notes would not otherwise know it is included.