|
|
@@ -0,0 +1,60 @@
|
|
|
+# Release 0.5.2
|
|
|
+
|
|
|
+Branch: `release-0-5-2` → `main`
|
|
|
+
|
|
|
+PR 4 of the review fixes plan (`docs/review-fixes-plan.md`): the 0.5.2 release of PRs 1-3. After the merge, the merge commit is tagged `v0.5.2` ("MPCkit 0.5.2 (beta)").
|
|
|
+
|
|
|
+## What's new in 0.5.2 (for beta testers)
|
|
|
+
|
|
|
+0.5.2 is a security and reliability release. Nothing changes in how you build kits, and projects from 0.5.1 open as before.
|
|
|
+
|
|
|
+**Opening projects**
|
|
|
+- MPCkit refuses a project file whose sample names point outside its own data folder (for example `../../secret.txt`), or whose samples or sequences are missing information it needs. The message names the problem. Before, such a file could make MPCkit read or write files elsewhere on your computer, or close without warning.
|
|
|
+- MPCkit refuses a project file that would unpack to more than 256 MB. Real projects are about 3 MB. Before, a small crafted file could use gigabytes of memory.
|
|
|
+- If something unexpected still goes wrong, MPCkit shows "Something went wrong inside MPCkit, and the last action may not have finished." instead of closing.
|
|
|
+
|
|
|
+**Exporting**
|
|
|
+- If the samples of a project you opened include a shortcut (a symbolic link), or the data folder itself is one, that sample shows as missing and export is blocked. A shared kit can no longer use a link to slip another file from your computer into an export.
|
|
|
+- Exporting over an earlier export can no longer lose it. If something fails partway, the previous export is left exactly as it was.
|
|
|
+- Exporting into a folder that has since been deleted now says so plainly: "export folder does not exist".
|
|
|
+
|
|
|
+**Adding samples**
|
|
|
+- A WAV that is a shortcut to another file works: MPCkit copies the file it points to.
|
|
|
+- Sample names that would not work on the MPC's card or on Windows are adjusted when you add the sample. `/`, `\`, `: * ? " < > |` and control characters become `_` (`kick\one.wav` becomes `kick_one.wav`), and Windows device names get `_` added (`CON.wav` becomes `CON_.wav`). Such names only occur on macOS and Linux.
|
|
|
+
|
|
|
+**Under the hood**
|
|
|
+- Built with Go 1.27.4, which fixes a security problem in Go's `net/http` package (GO-2026-6859).
|
|
|
+
|
|
|
+## What changed
|
|
|
+
|
|
|
+- **Version 0.5.2** in every file the README's "Releasing" paragraph lists:
|
|
|
+ - `APP_VERSION` in `Taskfile.yml`, and `version` in `build/config.yml`;
|
|
|
+ - Windows: `build/windows/info.json` (four places), `wails.exe.manifest` and `nsis/wails_tools.nsh`;
|
|
|
+ - macOS: `build/darwin/Info.plist` and `Info.dev.plist` (two places each);
|
|
|
+ - Linux: `build/linux/nfpm/nfpm.yaml`.
|
|
|
+- **Examples updated:** the `Version` comment in `internal/app/app.go` (it still said 0.5.0) and the README's About example.
|
|
|
+- **`go.mod`** now has `toolchain go1.27.4`. The `go 1.26.0` line stays, so Go 1.26 or newer can still read the module and fetches 1.27.4 to build it.
|
|
|
+- **README:** the Go requirement now says builds use Go 1.27.4 or later. It also says that where Go is set to `GOTOOLCHAIN=local`, as openSUSE's package is, you set `GOTOOLCHAIN=go1.27.4` for every Go and `wails3` command.
|
|
|
+
|
|
|
+## Notes
|
|
|
+
|
|
|
+- **Left at 0.5.1:** the `version` inside the commented-out iOS block of `build/config.yml`. PR 8 removes that block.
|
|
|
+- **Your Windows laptop:** Go from go.dev uses `GOTOOLCHAIN=auto`, so the first `wails3 build` downloads Go 1.27.4 by itself; nothing to install. The Linux desktop is the same unless its Go comes from a distribution package set to `local`.
|
|
|
+
|
|
|
+## Testing
|
|
|
+
|
|
|
+**On the server, every command with `GOTOOLCHAIN=go1.27.4`** (openSUSE's Go defaults to `local`):
|
|
|
+- `go test ./...` passes, including the round-trip tests.
|
|
|
+- `go vet ./...` and `staticcheck ./...` are clean.
|
|
|
+- **`govulncheck ./...`: "No vulnerabilities found."**
|
|
|
+- `npm install`, `npm run check` (0 errors, 0 warnings) and `npm run build` pass. The lockfile was not committed.
|
|
|
+- `wails3 build` builds. `go version bin/mpckit` says `go1.27.4`, and the binary carries version `0.5.2`. `timeout 15 xvfb-run -a bin/mpckit` starts and runs.
|
|
|
+
|
|
|
+**On the laptop (PowerShell, in the repo):**
|
|
|
+1. `git fetch; git checkout release-0-5-2`
|
|
|
+2. `go env GOTOOLCHAIN`: `auto`. If it says `local`, run `$env:GOTOOLCHAIN = "go1.27.4"` first.
|
|
|
+3. `wails3 build`. The first run may pause while Go 1.27.4 downloads.
|
|
|
+4. `go version bin\mpckit.exe`: `go1.27.4`.
|
|
|
+5. Run `bin\mpckit.exe`. About shows "Version 0.5.2" and a Build line.
|
|
|
+6. Properties → Details of `bin\mpckit.exe`: product version 0.5.2.
|
|
|
+7. Optional: `go run golang.org/x/vuln/cmd/govulncheck@latest ./...` reports "No vulnerabilities found."
|
