From 25bc75f1f3a5aa2de9badd743e562fe53df59666 Mon Sep 17 00:00:00 2001 From: Terje Kvernes Date: Sat, 19 Sep 2026 15:21:22 +0200 Subject: [PATCH 1/3] Document the organization-wide dependency refresh --- DEPENDENCIES.md | 64 +++++++++++++++++++++++++++++++++++++++++++++++ MIGRATION.md | 2 ++ README.md | 7 ++++++ profile/README.md | 7 ++++++ 4 files changed, 80 insertions(+) create mode 100644 DEPENDENCIES.md diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md new file mode 100644 index 0000000..f7db1c8 --- /dev/null +++ b/DEPENDENCIES.md @@ -0,0 +1,64 @@ +# September 2026 dependency refresh + +This refresh covers all ten repositories in `treetop-policy-engine`. Package +registries, upstream releases, and action commits were checked on 2026-09-19. +Updates remain in the linked pull requests unless marked as released below. + +## Repository status + +| Repository | Review | Scope and publication status | +| --- | --- | --- | +| Core | [#66](https://github.com/treetop-policy-engine/treetop-core/pull/66) | Merged; [Core 0.2.0 published](https://crates.io/crates/treetop-core/0.2.0), with Cedar 4.13.0 and refreshed dependencies/actions | +| Bundle | [#12](https://github.com/treetop-policy-engine/treetop-bundle/pull/12) | Candidate 0.2.0; uses published Core 0.2.0; Rust, fuzz, CLI, and action updates | +| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Candidate Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates | +| Rust client | [#16](https://github.com/treetop-policy-engine/treetop-client/pull/16) | Open; dependencies, fuzz lockfile, actions, and Rust 1.93.1 minimum | +| Python client | [#16](https://github.com/treetop-policy-engine/treetop-client-python/pull/16) | Open; build/type-check tools, lockfile, and actions | +| Go client | [#5](https://github.com/treetop-policy-engine/treetop-client-go/pull/5) | Open; security and Markdown tools; no external module dependencies; actions already current | +| CLI | [#10](https://github.com/treetop-policy-engine/treetop-cli/pull/10) | Open; dependencies, lockfile, actions, and pinned Rust builder image | +| Frontend | [#5](https://github.com/treetop-policy-engine/treetop-frontend/pull/5) | Open; npm dependencies, lockfile, supported Node versions, and actions | +| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Open; action pins and artifact upload example; Bundle CLI update follows its release | +| Organization | This document | Documentation and action dependencies checked; existing pins already current | + +No release is implied by an open dependency PR. REST, clients, CLI, frontend, +and Bundle Action retain their existing published releases until separately +reviewed and released. The [previous coordinated release](MIGRATION.md) remains +the migration reference for those artifacts. + +## Core, Bundle, and REST rollout + +1. Publish Core 0.2.0 from the verified, merged Core commit. +2. Replace Bundle's temporary Core source pin with the published registry crate, + verify packaging and CI, then publish Bundle 0.2.0 and native CLI archives. +3. Resolve REST against both published 0.2.0 crates and commit registry checksums + in its application and fuzz lockfiles. Review and release REST separately. +4. Update Bundle Action's default CLI and immutable verification source to Bundle + 0.2.0 after its native archives and checksums are available. + +Rebuild and re-sign policy archives with Bundle CLI 0.2.0 before deploying the +updated REST server. Archive generator metadata must match Bundle/Core 0.2.0 +and Cedar 4.13.0 exactly; editing a signed archive is not a migration. Manifest +and signature format 2 and declared label targets remain unchanged. Cedar JSON +consumers must support array-valued `attr` for nested `has` expressions. + +Cedar 4.13 classifies invalid action applications as warnings. Core and Bundle +preserve Treetop's strict validation contract by rejecting these diagnostics as +errors. Other Bundle warnings retain their existing `deny_warnings` behavior. + +## Toolchain and compatibility constraints + +- The Rust client now requires Rust 1.93.1. Its current test and transitive + dependency graph cannot support the former Rust 1.85 minimum. CLI retains its + separately verified Rust 1.89 minimum against the published client 0.1.0. +- The frontend requires Node `^22.22.2 || ^24.15.0 || >=26` for its updated tools. + TypeScript stays at 5.9.3: current `openapi-typescript` 7.13.0 requires TypeScript + 5.x, and `typescript-eslint` 8.70.0 excludes TypeScript 6.1 and later. Installing + TypeScript 7.0.2 would violate those peer contracts. Revisit this holdback when + both tools support it. +- Third-party actions and reusable workflows use immutable reviewed commits. + Rust toolchain actions tracking upstream `master` explicitly select `stable`. +- Existing released REST images/source and client versions remain valid pinned + integration prerequisites. An unpublished branch is not a new release. + +Each implementation PR records its own verification. Dependency updates retain +formatting, lint, test, documentation, audit, package, and performance gates; +local environmental limitations are documented rather than treated as passes. diff --git a/MIGRATION.md b/MIGRATION.md index 6d25818..6a38baa 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -2,6 +2,8 @@ Released 2026-09-06 after coordinated review and verification. This document is the organization announcement, breaking migration guide, and upgrade order. +For the later Core/Bundle 0.2.0 and Cedar 4.13 refresh, see the +[dependency rollout notes](DEPENDENCIES.md). Early Treetop releases prioritize correctness over compatibility across every repository. Breaking changes must be intentional, tested, announced, and supplied diff --git a/README.md b/README.md index 1c5f917..623d811 100644 --- a/README.md +++ b/README.md @@ -70,6 +70,13 @@ the Go client is 0.3.0 and Bundle Action is v2. See the [breaking migration and release set](./MIGRATION.md) for the new syntax, required consumer updates, published artifacts, and upgrade order. +## September 2026 dependency refresh + +Core and Bundle 0.2.0 are being prepared for Cedar 4.13.0. The +[dependency refresh status and migration notes](./DEPENDENCIES.md) track every repository, +release prerequisites, and toolchain changes. Open update PRs do not change the +versions of already published artifacts. + ## Projects All repositories below are maintained parts of the Treetop project. Together they provide the REST diff --git a/profile/README.md b/profile/README.md index cc2ead0..96da430 100644 --- a/profile/README.md +++ b/profile/README.md @@ -23,6 +23,13 @@ the Go client is 0.3.0 and Bundle Action is v2. See the [breaking migration and release set](../MIGRATION.md) for the new syntax, required consumer updates, published artifacts, and upgrade order. +## September 2026 dependency refresh + +Core and Bundle 0.2.0 are being prepared for Cedar 4.13.0. The +[dependency refresh status and migration notes](../DEPENDENCIES.md) track every repository, +release prerequisites, and toolchain changes. Open update PRs do not change the +versions of already published artifacts. + ## Projects These repositories are all maintained parts of Treetop, covering the runtime, policy delivery, From efff00aecd13c3aea018ab96fe2217f463850e91 Mon Sep 17 00:00:00 2001 From: Terje Kvernes Date: Sat, 19 Sep 2026 15:41:24 +0200 Subject: [PATCH 2/3] Record published Core and Bundle 0.2.0 releases --- DEPENDENCIES.md | 26 +++++++++++++++----------- README.md | 4 ++-- profile/README.md | 4 ++-- 3 files changed, 19 insertions(+), 15 deletions(-) diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md index f7db1c8..4f36511 100644 --- a/DEPENDENCIES.md +++ b/DEPENDENCIES.md @@ -9,15 +9,15 @@ Updates remain in the linked pull requests unless marked as released below. | Repository | Review | Scope and publication status | | --- | --- | --- | | Core | [#66](https://github.com/treetop-policy-engine/treetop-core/pull/66) | Merged; [Core 0.2.0 published](https://crates.io/crates/treetop-core/0.2.0), with Cedar 4.13.0 and refreshed dependencies/actions | -| Bundle | [#12](https://github.com/treetop-policy-engine/treetop-bundle/pull/12) | Candidate 0.2.0; uses published Core 0.2.0; Rust, fuzz, CLI, and action updates | -| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Candidate Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates | +| Bundle | [#12](https://github.com/treetop-policy-engine/treetop-bundle/pull/12) | Merged; [Bundle 0.2.0 and native CLI published](https://github.com/treetop-policy-engine/treetop-bundle/releases/tag/v0.2.0) | +| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Open; published Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates | | Rust client | [#16](https://github.com/treetop-policy-engine/treetop-client/pull/16) | Open; dependencies, fuzz lockfile, actions, and Rust 1.93.1 minimum | | Python client | [#16](https://github.com/treetop-policy-engine/treetop-client-python/pull/16) | Open; build/type-check tools, lockfile, and actions | | Go client | [#5](https://github.com/treetop-policy-engine/treetop-client-go/pull/5) | Open; security and Markdown tools; no external module dependencies; actions already current | | CLI | [#10](https://github.com/treetop-policy-engine/treetop-cli/pull/10) | Open; dependencies, lockfile, actions, and pinned Rust builder image | | Frontend | [#5](https://github.com/treetop-policy-engine/treetop-frontend/pull/5) | Open; npm dependencies, lockfile, supported Node versions, and actions | -| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Open; action pins and artifact upload example; Bundle CLI update follows its release | -| Organization | This document | Documentation and action dependencies checked; existing pins already current | +| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Open; Bundle CLI 0.2.0 default, immutable release source, action pins, and artifact upload example | +| Organization | [#4](https://github.com/treetop-policy-engine/.github/pull/4) | Documentation and action dependencies checked; existing pins already current | No release is implied by an open dependency PR. REST, clients, CLI, frontend, and Bundle Action retain their existing published releases until separately @@ -26,13 +26,17 @@ the migration reference for those artifacts. ## Core, Bundle, and REST rollout -1. Publish Core 0.2.0 from the verified, merged Core commit. -2. Replace Bundle's temporary Core source pin with the published registry crate, - verify packaging and CI, then publish Bundle 0.2.0 and native CLI archives. -3. Resolve REST against both published 0.2.0 crates and commit registry checksums - in its application and fuzz lockfiles. Review and release REST separately. -4. Update Bundle Action's default CLI and immutable verification source to Bundle - 0.2.0 after its native archives and checksums are available. +1. Completed: Core 0.2.0 is published from verified main commit + `6ebef45b46b1b725e48ab5704a64cf266da25860`. +2. Completed: Bundle 0.2.0 uses the published Core crate and is released from + verified main commit `20c4661296cc23381bbce1d86a94949311823a11`. All four + native CLI archives and `SHA256SUMS` are published. +3. REST's open PR resolves both published crates, with registry checksums in its + application and fuzz lockfiles. Review and release REST separately. +4. Bundle Action's open PR defaults to published CLI 0.2.0 and verifies its exact + release source. This archive-compatibility change requires a new major Action + release after review. Existing v2/v2.0.0 contracts remain fixed; users can + explicitly select `binary-version: 0.2.0` with the published action. Rebuild and re-sign policy archives with Bundle CLI 0.2.0 before deploying the updated REST server. Archive generator metadata must match Bundle/Core 0.2.0 diff --git a/README.md b/README.md index 623d811..e9dd4af 100644 --- a/README.md +++ b/README.md @@ -65,14 +65,14 @@ and attribute. Early Treetop releases prioritize correctness over compatibility; ambiguous ownership, deprecated aliases, and old-format defaults are removed. Bundle/module format 2 requires rebuilt and re-signed archives. -Core, Bundle, REST, Rust/Python clients, CLI, and Workbench are released as 0.1.0; +The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0; the Go client is 0.3.0 and Bundle Action is v2. See the [breaking migration and release set](./MIGRATION.md) for the new syntax, required consumer updates, published artifacts, and upgrade order. ## September 2026 dependency refresh -Core and Bundle 0.2.0 are being prepared for Cedar 4.13.0. The +Core and Bundle 0.2.0 are published with Cedar 4.13.0. The [dependency refresh status and migration notes](./DEPENDENCIES.md) track every repository, release prerequisites, and toolchain changes. Open update PRs do not change the versions of already published artifacts. diff --git a/profile/README.md b/profile/README.md index 96da430..6a36c92 100644 --- a/profile/README.md +++ b/profile/README.md @@ -18,14 +18,14 @@ and attribute. Early Treetop releases prioritize correctness over compatibility; ambiguous ownership, deprecated aliases, and old-format defaults are removed. Bundle/module format 2 requires rebuilt and re-signed archives. -Core, Bundle, REST, Rust/Python clients, CLI, and Workbench are released as 0.1.0; +The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0; the Go client is 0.3.0 and Bundle Action is v2. See the [breaking migration and release set](../MIGRATION.md) for the new syntax, required consumer updates, published artifacts, and upgrade order. ## September 2026 dependency refresh -Core and Bundle 0.2.0 are being prepared for Cedar 4.13.0. The +Core and Bundle 0.2.0 are published with Cedar 4.13.0. The [dependency refresh status and migration notes](../DEPENDENCIES.md) track every repository, release prerequisites, and toolchain changes. Open update PRs do not change the versions of already published artifacts. From 47dcb266b1e77f76f132f80d6991f3fe4266f5ab Mon Sep 17 00:00:00 2001 From: Terje Kvernes Date: Sat, 19 Sep 2026 16:55:31 +0200 Subject: [PATCH 3/3] Record completed dependency merges and release status --- DEPENDENCIES.md | 44 ++++++++++++++++++++++++++++---------------- README.md | 4 ++-- profile/README.md | 4 ++-- 3 files changed, 32 insertions(+), 20 deletions(-) diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md index 4f36511..7fdb177 100644 --- a/DEPENDENCIES.md +++ b/DEPENDENCIES.md @@ -2,7 +2,9 @@ This refresh covers all ten repositories in `treetop-policy-engine`. Package registries, upstream releases, and action commits were checked on 2026-09-19. -Updates remain in the linked pull requests unless marked as released below. +The implementation updates were squash-merged in dependency order on 2026-09-19. +Core and Bundle 0.2.0 are published; the other updates are on `main` and await +separate versioned releases. ## Repository status @@ -10,18 +12,18 @@ Updates remain in the linked pull requests unless marked as released below. | --- | --- | --- | | Core | [#66](https://github.com/treetop-policy-engine/treetop-core/pull/66) | Merged; [Core 0.2.0 published](https://crates.io/crates/treetop-core/0.2.0), with Cedar 4.13.0 and refreshed dependencies/actions | | Bundle | [#12](https://github.com/treetop-policy-engine/treetop-bundle/pull/12) | Merged; [Bundle 0.2.0 and native CLI published](https://github.com/treetop-policy-engine/treetop-bundle/releases/tag/v0.2.0) | -| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Open; published Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates | -| Rust client | [#16](https://github.com/treetop-policy-engine/treetop-client/pull/16) | Open; dependencies, fuzz lockfile, actions, and Rust 1.93.1 minimum | -| Python client | [#16](https://github.com/treetop-policy-engine/treetop-client-python/pull/16) | Open; build/type-check tools, lockfile, and actions | -| Go client | [#5](https://github.com/treetop-policy-engine/treetop-client-go/pull/5) | Open; security and Markdown tools; no external module dependencies; actions already current | -| CLI | [#10](https://github.com/treetop-policy-engine/treetop-cli/pull/10) | Open; dependencies, lockfile, actions, and pinned Rust builder image | -| Frontend | [#5](https://github.com/treetop-policy-engine/treetop-frontend/pull/5) | Open; npm dependencies, lockfile, supported Node versions, and actions | -| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Open; Bundle CLI 0.2.0 default, immutable release source, action pins, and artifact upload example | +| REST | [#82](https://github.com/treetop-policy-engine/treetop-rest/pull/82) | Merged; published Core/Bundle 0.2.0 and Cedar 4.13.0; application/fuzz lockfiles and action updates | +| Rust client | [#16](https://github.com/treetop-policy-engine/treetop-client/pull/16) | Merged; dependencies, fuzz lockfile, actions, and Rust 1.93.1 minimum | +| Python client | [#16](https://github.com/treetop-policy-engine/treetop-client-python/pull/16) | Merged; build/type-check tools, lockfile, and actions | +| Go client | [#5](https://github.com/treetop-policy-engine/treetop-client-go/pull/5) | Merged; security and Markdown tools; no external module dependencies; actions already current | +| CLI | [#10](https://github.com/treetop-policy-engine/treetop-cli/pull/10) | Merged; dependencies, lockfile, actions, and pinned Rust builder image | +| Frontend | [#5](https://github.com/treetop-policy-engine/treetop-frontend/pull/5) | Merged; npm dependencies, lockfile, supported Node versions, and actions | +| Bundle Action | [#9](https://github.com/treetop-policy-engine/treetop-bundle-action/pull/9) | Merged; Bundle CLI 0.2.0 default, immutable release source, action pins, and artifact upload example | | Organization | [#4](https://github.com/treetop-policy-engine/.github/pull/4) | Documentation and action dependencies checked; existing pins already current | -No release is implied by an open dependency PR. REST, clients, CLI, frontend, -and Bundle Action retain their existing published releases until separately -reviewed and released. The [previous coordinated release](MIGRATION.md) remains +A merged dependency update does not create a versioned release. REST, clients, +CLI, frontend, and Bundle Action retain their existing published releases until +separate release preparation and publication. The [previous coordinated release](MIGRATION.md) remains the migration reference for those artifacts. ## Core, Bundle, and REST rollout @@ -31,11 +33,12 @@ the migration reference for those artifacts. 2. Completed: Bundle 0.2.0 uses the published Core crate and is released from verified main commit `20c4661296cc23381bbce1d86a94949311823a11`. All four native CLI archives and `SHA256SUMS` are published. -3. REST's open PR resolves both published crates, with registry checksums in its - application and fuzz lockfiles. Review and release REST separately. -4. Bundle Action's open PR defaults to published CLI 0.2.0 and verifies its exact - release source. This archive-compatibility change requires a new major Action - release after review. Existing v2/v2.0.0 contracts remain fixed; users can +3. Completed: REST's merged update resolves both published crates, with registry + checksums in its application and fuzz lockfiles. Prepare and release the next + server version separately. +4. Completed: Bundle Action's merged update defaults to published CLI 0.2.0 and + verifies its exact release source. This archive-compatibility change requires + a new major Action release. Existing v2/v2.0.0 contracts remain fixed; users can explicitly select `binary-version: 0.2.0` with the published action. Rebuild and re-sign policy archives with Bundle CLI 0.2.0 before deploying the @@ -48,6 +51,15 @@ Cedar 4.13 classifies invalid action applications as warnings. Core and Bundle preserve Treetop's strict validation contract by rejecting these diagnostics as errors. Other Bundle warnings retain their existing `deny_warnings` behavior. +## Merge order + +Core and Bundle were merged and released first. The remaining implementation PRs +were then squash-merged as REST, Rust/Python/Go clients, CLI, frontend, and Bundle +Action, followed by this organization record. Each merge used the verified PR +head and retained substantive rationale and migration notes in its squash body. +Published REST/client integration pins remain intentional prerequisites for +consumer checks; merging a newer implementation does not move those releases. + ## Toolchain and compatibility constraints - The Rust client now requires Rust 1.93.1. Its current test and transitive diff --git a/README.md b/README.md index e9dd4af..f313e4f 100644 --- a/README.md +++ b/README.md @@ -74,8 +74,8 @@ updates, published artifacts, and upgrade order. Core and Bundle 0.2.0 are published with Cedar 4.13.0. The [dependency refresh status and migration notes](./DEPENDENCIES.md) track every repository, -release prerequisites, and toolchain changes. Open update PRs do not change the -versions of already published artifacts. +release prerequisites, and toolchain changes. The dependency updates are merged; +versioned releases beyond Core and Bundle remain separate. ## Projects diff --git a/profile/README.md b/profile/README.md index 6a36c92..7d1b003 100644 --- a/profile/README.md +++ b/profile/README.md @@ -27,8 +27,8 @@ updates, published artifacts, and upgrade order. Core and Bundle 0.2.0 are published with Cedar 4.13.0. The [dependency refresh status and migration notes](../DEPENDENCIES.md) track every repository, -release prerequisites, and toolchain changes. Open update PRs do not change the -versions of already published artifacts. +release prerequisites, and toolchain changes. The dependency updates are merged; +versioned releases beyond Core and Bundle remain separate. ## Projects