diff --git a/CHANGELOG.md b/CHANGELOG.md index c5e9aa5..0043cf4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ Notable user-visible changes are recorded here, newest first. ## Unreleased +## [0.6.1] - 2026-10-11 + +See the [release notes](docs/releases/v0.6.1.md) for upgrade details. + - Upgrade llm-sketchkit to v0.2.3 for parser allocation limits, more efficient summary combination and safer secret/error diagnostics. Keep the existing x/text v0.41.0 normalization dependency, identities and summary wire format. diff --git a/SECURITY.md b/SECURITY.md index 69cc766..5aa4ed7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Supported Versions -Security fixes target the latest patch in the `0.5.x` release line and `main`. +Security fixes target the latest patch in the `0.6.x` release line and `main`. Use the newest patch and record its version and revision when running trials. Older patches and development snapshots do not receive routine backports. Dependencies and the Go toolchain are reviewed on an ongoing basis. diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md index 1f9d894..5c336b0 100644 --- a/docs/OPERATIONS.md +++ b/docs/OPERATIONS.md @@ -8,7 +8,7 @@ unprivileged. All input and output stays on your machine. The initial supported targets are Linux and macOS on AMD64 and ARM64. Native Windows binaries are not provided. Download a binary from the -[release page](https://github.com/llm-measurement/fleetdiff/releases/tag/v0.6.0). +[release page](https://github.com/llm-measurement/fleetdiff/releases/tag/v0.6.1). Go is not needed to run it. The commands below use `curl` for downloading and the [GitHub CLI](https://cli.github.com/) for provenance verification. @@ -20,7 +20,7 @@ subshell stops on any download or verification failure: ```sh ( set -eu -version=v0.6.0 +version=v0.6.1 case "$(uname -s)" in Linux) os=linux ;; Darwin) os=darwin ;; @@ -54,7 +54,7 @@ From a reviewed repository checkout, the same download and verification steps are available as a script (no Go compiler needed): ```sh -sh scripts/install.sh v0.6.0 ./fleetdiff-install +sh scripts/install.sh v0.6.1 ./fleetdiff-install ./fleetdiff-install/fleetdiff --version ``` @@ -65,7 +65,7 @@ curl --fail --location --proto '=https' --tlsv1.2 \ https://raw.githubusercontent.com/llm-measurement/fleetdiff/e75518e1b62ead77a6870cfeabd3ddae944a1e0a/scripts/install.sh \ --output fleetdiff-install.sh less fleetdiff-install.sh -sh fleetdiff-install.sh v0.6.0 ./fleetdiff-install +sh fleetdiff-install.sh v0.6.1 ./fleetdiff-install ./fleetdiff-install/fleetdiff --version ``` @@ -115,7 +115,7 @@ Install a published version with a currently patched Go 1.26 or later toolchain: go install github.com/llm-measurement/fleetdiff/cmd/fleetdiff@latest ``` -Use `@v0.6.0` instead of `@latest` to pin that release. The binary is installed +Use `@v0.6.1` instead of `@latest` to pin that release. The binary is installed under `GOBIN`, or `$(go env GOPATH)/bin` when unset; put that directory on `PATH`. This path uses Go module verification rather than the archive attestation above, and does not include unreleased checkout features. @@ -136,7 +136,7 @@ Check `--version` on the binary you actually run: | Build | Version | Revision | |---|---|---| | Unstamped checkout build above | Go's embedded module/VCS version, or `dev` when unavailable | `unknown` | -| Tagged `go install ...@v0.6.0` | `v0.6.0`, from Go's module metadata | `unknown` | +| Tagged `go install ...@v0.6.1` | `v0.6.1`, from Go's module metadata | `unknown` | | Verified release archive | Stamped release version | Stamped source revision | A checkout may report a pseudo-version and `+dirty`, depending on the Go toolchain diff --git a/docs/releases/v0.6.1.md b/docs/releases/v0.6.1.md new file mode 100644 index 0000000..b00c63f --- /dev/null +++ b/docs/releases/v0.6.1.md @@ -0,0 +1,29 @@ +# v0.6.1 Release Notes + +This patch brings llm-sketchkit v0.2.3 hardening to fleetdiff's summary readers: +parser allocation limits, more efficient summary combination, and safer +secret and error diagnostics. + +## Compatibility + +Existing identities, summary wire formats and accounting remain unchanged. +The build keeps `golang.org/x/text` v0.41.0. This is the identity-preserving +sketchkit backport, not its v0.3.0 migration. Readers reject oversized or malformed +encodings according to sketchkit's +[resource limits](https://github.com/llm-measurement/llm-sketchkit/blob/v0.2.3/docs/OPERATIONS.md). + +The LiteLLM spend importer and the summary, trace and configuration commands +keep their v0.6.0 behavior. Replace the verified executable; no collector +upgrade, key rotation or window reset is required. + +## Install And Verify + +Use the [verified installer](../OPERATIONS.md#install-and-verify) with +`v0.6.1`, or verify the release archives before extracting them. Linux and macOS +archives cover AMD64 and ARM64, built with Go 1.26.9, with dependency licenses, +checksums, an SBOM and signed build provenance. + +The release workflow tests the packaged commands on all four platforms and +exercises the pinned LiteLLM SQL export through the packaged importer. The +installer's default is now v0.6.1. Release automation and the synthetic capture +recipe also include the reviewed dependency updates merged since v0.6.0. diff --git a/scripts/install.sh b/scripts/install.sh index fb19f4a..4905d91 100644 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -6,11 +6,11 @@ umask 077 usage() { printf '%s\n' 'Usage: sh scripts/install.sh [VERSION [NEW_DIRECTORY]]' \ - 'Defaults: v0.6.0 ./fleetdiff-install. Requires curl, gh, shasum, and tar.' + 'Defaults: v0.6.1 ./fleetdiff-install. Requires curl, gh, shasum, and tar.' } case "${1:-}" in --help|-h) usage; exit 0 ;; esac if [ "$#" -gt 2 ]; then usage >&2; exit 2; fi -version=${1-v0.6.0} +version=${1-v0.6.1} destination=${2-./fleetdiff-install} case "$version" in ''|*[!a-zA-Z0-9.-]*) printf '%s\n' 'Supply a release version such as v0.3.0.' >&2; exit 2 ;; diff --git a/scripts/install_test.go b/scripts/install_test.go index 7c5719c..905f0f1 100644 --- a/scripts/install_test.go +++ b/scripts/install_test.go @@ -15,7 +15,7 @@ import ( "testing" ) -const installTestVersion = "v0.6.0" +const installTestVersion = "v0.6.1" func TestInstallDefaultVersion(t *testing.T) { root, env := installEnvironment(t, "Darwin", "arm64", "darwin_arm64", "")