release: v1.4.3

.github/workflows/ci.yml

@@ -48,7 +48,7 @@ jobs:
       # pin@stable
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
       # pin@v4
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: |
             ~/.cargo/registry/
@@ -75,7 +75,7 @@ jobs:
       # pin@stable
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
       # pin@v4
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: |
             ~/.cargo/registry/
@@ -107,7 +107,7 @@ jobs:
             echo "relevant=false" >> "$GITHUB_OUTPUT"
           fi
       # pin@v4
-      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
         if: steps.changed.outputs.relevant == 'true'
         with:
           dotnet-version: '10.0.x'
@@ -120,7 +120,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
         if: steps.changed.outputs.relevant == 'true'
       # pin@v4
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         if: steps.changed.outputs.relevant == 'true'
         with:
           path: |

.github/workflows/release.yml

@@ -64,7 +64,7 @@ jobs:
 
       - name: Cache cargo
         # pin@v4
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: |
             ~/.cargo/registry
@@ -81,7 +81,7 @@ jobs:
 
       - name: Setup .NET
         # pin@v4
-        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
         with:
           dotnet-version: '10.0.x'
 
@@ -126,14 +126,14 @@ jobs:
 
       - name: Upload kale artifact
         # pin@v4
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ${{ matrix.artifact }}
           path: ${{ matrix.artifact }}
 
       - name: Upload with-csharp artifact
         # pin@v4
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ${{ matrix.artifact_csharp }}
           path: ${{ matrix.artifact_csharp }}
@@ -165,7 +165,7 @@ jobs:
 
       - name: Cache cargo
         # pin@v4
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: |
             ~/.cargo/registry
@@ -197,7 +197,7 @@ jobs:
 
       - name: Setup .NET
         # pin@v4
-        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
         with:
           dotnet-version: '10.0.x'
 
@@ -232,14 +232,14 @@ jobs:
 
       - name: Upload kale artifact
         # pin@v4
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: codesearch-macos-arm64.tar.gz
           path: codesearch-macos-arm64.tar.gz
 
       - name: Upload with-csharp artifact
         # pin@v4
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: codesearch-macos-arm64-with-csharp.tar.gz
           path: codesearch-macos-arm64-with-csharp.tar.gz
@@ -253,14 +253,14 @@ jobs:
     steps:
       - name: Download all artifacts
         # pin@v4
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           path: artifacts
           merge-multiple: true
 
       - name: Create or update Release
         # pin@v2
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64
         with:
           files: artifacts/*
           generate_release_notes: true

CHANGELOG.md

@@ -14,7 +14,7 @@ more PRs land; when the release is actually tagged, the same section is
 finalized in place with a date — no renaming/migration step needed.
 -->
 
-## [1.4.0] - 2026-09-17
+## [1.4.3] - 2026-09-17
 
 ### Security
 
@@ -48,6 +48,12 @@ finalized in place with a date — no renaming/migration step needed.
 
 - **Serve auto-recovers LMDB storage-format corruption with a sequential wipe + rebuild.** After the arroy 0.5→0.8 / heed 0.20→0.22 major upgrades, every repo whose on-disk database was written by the previous binary failed its symbol rebuild with `MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED size` (observed on all C# repos after deploy). When a symbol rebuild now fails with that error class, serve wipes the repo's DB directory — closing the LMDB envs first via the same eviction sequence `remove_repo` uses, with the same bounded retry for transient Windows lock holders — and force-reindexes it through the existing force-reindex machinery, whose store-open path recreates everything on the new formats. Recoveries are queued and processed strictly **one repo at a time**: each rebuild runs a full CPU-bound embed pass, so parallel recoveries would thrash the machine. Read-only repos are skipped with a pointer to the owning writer. This closes the gap the tantivy FTS graceful reset (above) already covered on the FTS side — the vector/symbol stores now self-heal the same upgrade boundary instead of staying red until an operator force-reindexes by hand.
 
+### Fixed
+
+- **Dependency batch: criterion 0.8, serial_test 4, indicatif 0.18, colored 3 (dependabot majors) + CI actions refresh.** The four cargo majors were drop-in for lib/bins; benches and dev-test surface absorbed the criterion 0.5→0.8 and serial_test 3→4 API moves. The five GitHub Actions bumps (upload-artifact v7, download-artifact v8, cache v6, setup-dotnet v6, action-gh-release v3) are the dependabot-proposed SHA pins. dependabot itself now targets develop permanently (`target-branch` in the default-branch config): its rebases used to reset the base to master, tripping the `check-source-branch` guard.
+
+- **Federated chunk fetch works again — URL residue and project-scope routing (todo #153).** Two independent defects: (1) the peer URL for a `chunk_ref` fetch was built by replacing `{id` without the closing brace, so the constructed path carried a stray `}` (`/chunk/2058%7D`) that real peers answered with 400 Bad Request — axum's `{id}` parameter happily swallowed the stray brace into the captured value, which is exactly why the mock-based tests never caught it; the replacement now covers the full `{id}` placeholder, pinned by a test whose route echoes back the exact path it was hit on. (2) `get_chunk` with `project=<peer>/<alias>` plus a plain `chunk_id` died in local routing with "Unknown alias" — mounted remote projects are now routed through the same federated fetch search uses (local aliases still win a name clash), so both `chunk_ref` and `project=`+`chunk_id` forms work against remote peers.
+
 ## [1.3.19]
 
 ### Changed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codesearch"
-version = "1.4.0"
+version = "1.4.3"
 edition = "2021"
 authors = ["codesearch contributors"]
 license = "Apache-2.0"
@@ -88,7 +88,7 @@ tracing-appender = "0.2"
 sha2 = "0.11"
 uuid = { version = "1.11", features = ["v4", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
-colored = "2.1"
+colored = "3.1"
 indicatif = "0.17"
 dirs = "7"
 num_cpus = "1.16"