From 07c69f1f4f9e16bf5b54dda08828e6fb540d87a7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 22 Sep 2026 14:47:37 +0000 Subject: [PATCH] chore(release): hooray 0.9.0 ## 0.9.0 (2026-09-22) ### Features - **scanners:** IaC checks for docker-compose and GitHub Actions (3a6cbe6) ### Bug Fixes - **parsers:** resolve lockfile edge, scope, and abort defects from audit (985a893) - **reports:** harden SBOM ingestion, renderers, model, monitor, and store (362111e) - **parity:** harden corpus loading, comparison keys, gates, and recording validation (7767d39) - **parsers:** harden archive readers and expose OCI filesystem builder (99a1f78) - **engine:** harden OSV matching, graph classification, and input handling (0a5caaa) - **scanners:** close audit findings in secret, IaC, service-config, SAST, and license (9ec9d45) - **parsers:** resolve quoted and multi-version Yarn classic dependencies (9a7fa8a) - **store:** require FULL synchronous for commit durability (35e3491) - **risk:** rank Unknown severity above Low in severity_points (43cee0a) - **input:** bound serde_yaml alias expansion on untrusted lockfiles (9a24589) - **parsers:** accept multi-document pnpm-lock.yaml (#337) (2f1cd6f) ### Other Changes - **ci:** align dependabot naming with hoolicy policy (#116) (de8f062) - **parity:** harden recording integrity and corpus coverage assertions (54112a3) - bump actions/github-script from 8.0.0 to 9.0.0 (#117) (847f10b) - bump rusqlite from 0.37.0 to 0.40.2 (#118) (776a160) - bump zstd from 0.13.3 to 0.14.0 (#119) (1c59e21) - bump toml from 0.9.12+spec-1.1.0 to 1.1.6+spec-1.1.0 (#120) (9ed037b) --- CHANGELOG.md | 29 +++++++++++++++++++++++++++++ Cargo.lock | 10 +++++----- Cargo.toml | 2 +- actions/README.md | 2 +- actions/scan/action.yml | 2 +- actions/setup/action.yml | 2 +- 6 files changed, 38 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7365793..aeb4491 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,34 @@ # Changelog +## 0.9.0 (2026-09-22) + +### Features + +- **scanners:** IaC checks for docker-compose and GitHub Actions (3a6cbe6) + +### Bug Fixes + +- **parsers:** resolve lockfile edge, scope, and abort defects from audit (985a893) +- **reports:** harden SBOM ingestion, renderers, model, monitor, and store (362111e) +- **parity:** harden corpus loading, comparison keys, gates, and recording validation (7767d39) +- **parsers:** harden archive readers and expose OCI filesystem builder (99a1f78) +- **engine:** harden OSV matching, graph classification, and input handling (0a5caaa) +- **scanners:** close audit findings in secret, IaC, service-config, SAST, and license (9ec9d45) +- **parsers:** resolve quoted and multi-version Yarn classic dependencies (9a7fa8a) +- **store:** require FULL synchronous for commit durability (35e3491) +- **risk:** rank Unknown severity above Low in severity_points (43cee0a) +- **input:** bound serde_yaml alias expansion on untrusted lockfiles (9a24589) +- **parsers:** accept multi-document pnpm-lock.yaml (#337) (2f1cd6f) + +### Other Changes + +- **ci:** align dependabot naming with hoolicy policy (#116) (de8f062) +- **parity:** harden recording integrity and corpus coverage assertions (54112a3) +- bump actions/github-script from 8.0.0 to 9.0.0 (#117) (847f10b) +- bump rusqlite from 0.37.0 to 0.40.2 (#118) (776a160) +- bump zstd from 0.13.3 to 0.14.0 (#119) (1c59e21) +- bump toml from 0.9.12+spec-1.1.0 to 1.1.6+spec-1.1.0 (#120) (9ed037b) + ## 0.8.0 (2026-09-18) ### Features diff --git a/Cargo.lock b/Cargo.lock index a9e5d6f..12debb5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -792,7 +792,7 @@ checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284" [[package]] name = "hooray" -version = "0.8.0" +version = "0.9.0" dependencies = [ "anyhow", "axum", @@ -908,9 +908,9 @@ dependencies = [ [[package]] name = "hyper-rustls" -version = "0.27.9" +version = "0.27.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f" +checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53" dependencies = [ "http", "hyper", @@ -1542,9 +1542,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.10.2" +version = "0.10.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" +checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af" dependencies = [ "chacha20", "getrandom 0.4.3", diff --git a/Cargo.toml b/Cargo.toml index 7e45107..0bbb5fa 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "hooray" -version = "0.8.0" +version = "0.9.0" edition = "2024" rust-version = "1.90" license = "Apache-2.0" diff --git a/actions/README.md b/actions/README.md index ec7d378..24f4433 100644 --- a/actions/README.md +++ b/actions/README.md @@ -5,7 +5,7 @@ Use immutable action revisions in consuming repositories. ```yaml - uses: openhoo/hooray/actions/scan@ with: - version: 0.8.0 + version: 0.9.0 policy: hooray-policy.yaml ``` diff --git a/actions/scan/action.yml b/actions/scan/action.yml index 11dcbde..6432719 100644 --- a/actions/scan/action.yml +++ b/actions/scan/action.yml @@ -4,7 +4,7 @@ inputs: version: description: Hooray release version to install. required: false - default: "0.8.0" + default: "0.9.0" executable: description: Optional Hooray executable path; skips release installation when set. required: false diff --git a/actions/setup/action.yml b/actions/setup/action.yml index 30c138b..7239f88 100644 --- a/actions/setup/action.yml +++ b/actions/setup/action.yml @@ -4,7 +4,7 @@ inputs: version: description: Hooray release version to install. required: false - default: "0.8.0" + default: "0.9.0" outputs: version: description: Hooray version configured by this action.