diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md new file mode 100644 index 0000000..7fdb177 --- /dev/null +++ b/DEPENDENCIES.md @@ -0,0 +1,80 @@ +# September 2026 dependency refresh + +This refresh covers all ten repositories in `treetop-policy-engine`. Package +registries, upstream releases, and action commits were checked on 2026-09-19. +The implementation updates were squash-merged in dependency order on 2026-09-19. +Core and Bundle 0.2.0 are published; the other updates are on `main` and await +separate versioned releases. + +## Repository status + +| Repository | Review | Scope and publication status | +| --- | --- | --- | +| Core | [#66](https://github.com/treetop-policy-engine/treetop-core/pull/66) | Merged; [Core 0.2.0 published](https://crates.io/crates/treetop-core/0.2.0), with Cedar 4.13.0 and refreshed dependencies/actions | +| Bundle | [#12](https://github.com/treetop-policy-engine/treetop-bundle/pull/12) | Merged; [Bundle 0.2.0 and native CLI published](https://github.com/treetop-policy-engine/treetop-bundle/releases/tag/v0.2.0) | +| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Merged; published Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates | +| Rust client | [#16](https://github.com/treetop-policy-engine/treetop-client/pull/16) | Merged; dependencies, fuzz lockfile, actions, and Rust 1.93.1 minimum | +| Python client | [#16](https://github.com/treetop-policy-engine/treetop-client-python/pull/16) | Merged; build/type-check tools, lockfile, and actions | +| Go client | [#5](https://github.com/treetop-policy-engine/treetop-client-go/pull/5) | Merged; security and Markdown tools; no external module dependencies; actions already current | +| CLI | [#10](https://github.com/treetop-policy-engine/treetop-cli/pull/10) | Merged; dependencies, lockfile, actions, and pinned Rust builder image | +| Frontend | [#5](https://github.com/treetop-policy-engine/treetop-frontend/pull/5) | Merged; npm dependencies, lockfile, supported Node versions, and actions | +| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Merged; Bundle CLI 0.2.0 default, immutable release source, action pins, and artifact upload example | +| Organization | [#4](https://github.com/treetop-policy-engine/.github/pull/4) | Documentation and action dependencies checked; existing pins already current | + +A merged dependency update does not create a versioned release. REST, clients, +CLI, frontend, and Bundle Action retain their existing published releases until +separate release preparation and publication. The [previous coordinated release](MIGRATION.md) remains +the migration reference for those artifacts. + +## Core, Bundle, and REST rollout + +1. Completed: Core 0.2.0 is published from verified main commit + `6ebef45b46b1b725e48ab5704a64cf266da25860`. +2. Completed: Bundle 0.2.0 uses the published Core crate and is released from + verified main commit `20c4661296cc23381bbce1d86a94949311823a11`. All four + native CLI archives and `SHA256SUMS` are published. +3. Completed: REST's merged update resolves both published crates, with registry + checksums in its application and fuzz lockfiles. Prepare and release the next + server version separately. +4. Completed: Bundle Action's merged update defaults to published CLI 0.2.0 and + verifies its exact release source. This archive-compatibility change requires + a new major Action release. Existing v2/v2.0.0 contracts remain fixed; users can + explicitly select `binary-version: 0.2.0` with the published action. + +Rebuild and re-sign policy archives with Bundle CLI 0.2.0 before deploying the +updated REST server. Archive generator metadata must match Bundle/Core 0.2.0 +and Cedar 4.13.0 exactly; editing a signed archive is not a migration. Manifest +and signature format 2 and declared label targets remain unchanged. Cedar JSON +consumers must support array-valued `attr` for nested `has` expressions. + +Cedar 4.13 classifies invalid action applications as warnings. Core and Bundle +preserve Treetop's strict validation contract by rejecting these diagnostics as +errors. Other Bundle warnings retain their existing `deny_warnings` behavior. + +## Merge order + +Core and Bundle were merged and released first. The remaining implementation PRs +were then squash-merged as REST, Rust/Python/Go clients, CLI, frontend, and Bundle +Action, followed by this organization record. Each merge used the verified PR +head and retained substantive rationale and migration notes in its squash body. +Published REST/client integration pins remain intentional prerequisites for +consumer checks; merging a newer implementation does not move those releases. + +## Toolchain and compatibility constraints + +- The Rust client now requires Rust 1.93.1. Its current test and transitive + dependency graph cannot support the former Rust 1.85 minimum. CLI retains its + separately verified Rust 1.89 minimum against the published client 0.1.0. +- The frontend requires Node `^22.22.2 || ^24.15.0 || >=26` for its updated tools. + TypeScript stays at 5.9.3: current `openapi-typescript` 7.13.0 requires TypeScript + 5.x, and `typescript-eslint` 8.70.0 excludes TypeScript 6.1 and later. Installing + TypeScript 7.0.2 would violate those peer contracts. Revisit this holdback when + both tools support it. +- Third-party actions and reusable workflows use immutable reviewed commits. + Rust toolchain actions tracking upstream `master` explicitly select `stable`. +- Existing released REST images/source and client versions remain valid pinned + integration prerequisites. An unpublished branch is not a new release. + +Each implementation PR records its own verification. Dependency updates retain +formatting, lint, test, documentation, audit, package, and performance gates; +local environmental limitations are documented rather than treated as passes. diff --git a/MIGRATION.md b/MIGRATION.md index 6d25818..6a38baa 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -2,6 +2,8 @@ Released 2026-09-06 after coordinated review and verification. This document is the organization announcement, breaking migration guide, and upgrade order. +For the later Core/Bundle 0.2.0 and Cedar 4.13 refresh, see the +[dependency rollout notes](DEPENDENCIES.md). Early Treetop releases prioritize correctness over compatibility across every repository. Breaking changes must be intentional, tested, announced, and supplied diff --git a/README.md b/README.md index 1c5f917..f313e4f 100644 --- a/README.md +++ b/README.md @@ -65,11 +65,18 @@ and attribute. Early Treetop releases prioritize correctness over compatibility; ambiguous ownership, deprecated aliases, and old-format defaults are removed. Bundle/module format 2 requires rebuilt and re-signed archives. -Core, Bundle, REST, Rust/Python clients, CLI, and Workbench are released as 0.1.0; +The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0; the Go client is 0.3.0 and Bundle Action is v2. See the [breaking migration and release set](./MIGRATION.md) for the new syntax, required consumer updates, published artifacts, and upgrade order. +## September 2026 dependency refresh + +Core and Bundle 0.2.0 are published with Cedar 4.13.0. The +[dependency refresh status and migration notes](./DEPENDENCIES.md) track every repository, +release prerequisites, and toolchain changes. The dependency updates are merged; +versioned releases beyond Core and Bundle remain separate. + ## Projects All repositories below are maintained parts of the Treetop project. Together they provide the REST diff --git a/profile/README.md b/profile/README.md index cc2ead0..7d1b003 100644 --- a/profile/README.md +++ b/profile/README.md @@ -18,11 +18,18 @@ and attribute. Early Treetop releases prioritize correctness over compatibility; ambiguous ownership, deprecated aliases, and old-format defaults are removed. Bundle/module format 2 requires rebuilt and re-signed archives. -Core, Bundle, REST, Rust/Python clients, CLI, and Workbench are released as 0.1.0; +The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0; the Go client is 0.3.0 and Bundle Action is v2. See the [breaking migration and release set](../MIGRATION.md) for the new syntax, required consumer updates, published artifacts, and upgrade order. +## September 2026 dependency refresh + +Core and Bundle 0.2.0 are published with Cedar 4.13.0. The +[dependency refresh status and migration notes](../DEPENDENCIES.md) track every repository, +release prerequisites, and toolchain changes. The dependency updates are merged; +versioned releases beyond Core and Bundle remain separate. + ## Projects These repositories are all maintained parts of Treetop, covering the runtime, policy delivery,