Release 0.5.2

Set the version to 0.5.2 in every file the README lists and in the
Version comment's example. Add toolchain go1.27.4 to go.mod for the
net/http fix (GO-2026-6859); govulncheck now finds nothing. The README
explains the toolchain and GOTOOLCHAIN=local. The PR record lists what
0.5.2 fixes for beta testers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -25,7 +25,7 @@ MPCkit is a [Wails v3](https://v3.wails.io) app: Go for all file work, Svelte +
 
 You need:
 
-- Go 1.26 or newer
+- Go 1.26 or newer. Builds use Go 1.27.4 or later (the `toolchain` line in `go.mod`, for a `net/http` security fix); an older Go downloads 1.27.4 by itself. Some Linux packages, openSUSE's among them, set `GOTOOLCHAIN=local` and ignore that line: there, set `GOTOOLCHAIN=go1.27.4` for every Go and `wails3` command.
 - Node.js (current LTS) with npm
 - The Wails CLI: `go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0`
 - On Windows, the WebView2 runtime (already part of Windows 11). On Linux, the GTK and WebKitGTK development packages that `wails3 doctor` lists.
@@ -40,7 +40,7 @@ wails3 build       # builds bin/mpckit (bin\mpckit.exe on Windows)
 
 The first run installs the frontend packages and generates `frontend/bindings` from the Go service.
 
-`wails3 build` stamps the version (`APP_VERSION` in `Taskfile.yml`, kept in step with `version` in `build/config.yml`) and the commit it was built from, so About shows, for example, "Version 0.5.1" and "Build 2354f57" ("-dirty" if there were uncommitted changes). `wails3 dev` shows "dev".
+`wails3 build` stamps the version (`APP_VERSION` in `Taskfile.yml`, kept in step with `version` in `build/config.yml`) and the commit it was built from, so About shows, for example, "Version 0.5.2" and "Build 2354f57" ("-dirty" if there were uncommitted changes). `wails3 dev` shows "dev".
 
 Releasing a new version: set it in `APP_VERSION` (`Taskfile.yml`), `version` in `build/config.yml`, `build/windows/info.json` (four places), `build/windows/wails.exe.manifest`, `build/windows/nsis/wails_tools.nsh`, `build/darwin/Info.plist` and `Info.dev.plist` (two places each) and `build/linux/nfpm/nfpm.yaml`. After the merge, tag the merge commit `v<version>`.
 

Taskfile.yml

@@ -6,7 +6,7 @@ vars:
   # Shown in the About dialog of production builds: the version, and the
   # commit it was built from ("-dirty" if there were uncommitted changes).
   # Keep APP_VERSION in step with `version` in build/config.yml.
-  APP_VERSION: "0.5.1"
+  APP_VERSION: "0.5.2"
   COMMIT:
     sh: git describe --always --dirty --exclude "*" 2>/dev/null || echo unknown
   BIN_DIR: "bin"

build/config.yml

@@ -11,7 +11,7 @@ info:
   description: "Desktop kit editor for the MPC Sample" # The application description
   copyright: "(c) 2026 bajdev" # Copyright text
   comments: "Not affiliated with Akai Professional" # Comments
-  version: "0.5.1" # The application version
+  version: "0.5.2" # The application version
   # cfBundleIconName: "appicon" # The macOS icon name in Assets.car icon bundles (optional)
   #                               # Should match the name of your .icon file without the extension
   #                               # If not set and Assets.car exists, defaults to "appicon"

build/darwin/Info.dev.plist

@@ -17,9 +17,9 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>0.5.1</string>
+		<string>0.5.2</string>
 		<key>CFBundleVersion</key>
-		<string>0.5.1</string>
+		<string>0.5.2</string>
 		<key>LSMinimumSystemVersion</key>
 		<string>12.0.0</string>
 		<key>NSAppTransportSecurity</key>

build/darwin/Info.plist

@@ -17,9 +17,9 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>0.5.1</string>
+		<string>0.5.2</string>
 		<key>CFBundleVersion</key>
-		<string>0.5.1</string>
+		<string>0.5.2</string>
 		<key>LSMinimumSystemVersion</key>
 		<string>12.0.0</string>
 		<key>NSHighResolutionCapable</key>

build/linux/nfpm/nfpm.yaml

@@ -6,7 +6,7 @@
 name: "mpckit"
 arch: ${GOARCH}
 platform: "linux"
-version: "0.5.1"
+version: "0.5.2"
 section: "default"
 priority: "extra"
 maintainer: ${GIT_COMMITTER_NAME} <${GIT_COMMITTER_EMAIL}>

build/windows/info.json

@@ -1,12 +1,12 @@
 {
 	"fixed": {
-		"file_version": "0.5.1",
-		"product_version": "0.5.1"
+		"file_version": "0.5.2",
+		"product_version": "0.5.2"
 	},
 	"info": {
 		"0409": {
-			"FileVersion": "0.5.1",
-			"ProductVersion": "0.5.1",
+			"FileVersion": "0.5.2",
+			"ProductVersion": "0.5.2",
 			"CompanyName": "bajdev",
 			"FileDescription": "Desktop kit editor for the MPC Sample",
 			"LegalCopyright": "(c) 2026 bajdev",

build/windows/nsis/wails_tools.nsh

@@ -14,7 +14,7 @@
     !define INFO_PRODUCTNAME "MPCkit"
 !endif
 !ifndef INFO_PRODUCTVERSION
-    !define INFO_PRODUCTVERSION "0.5.1"
+    !define INFO_PRODUCTVERSION "0.5.2"
 !endif
 !ifndef INFO_COPYRIGHT
     !define INFO_COPYRIGHT "(c) 2026 bajdev"

build/windows/wails.exe.manifest

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
-    <assemblyIdentity type="win32" name="com.monoexp.mpckit" version="0.5.1" processorArchitecture="*"/>
+    <assemblyIdentity type="win32" name="com.monoexp.mpckit" version="0.5.2" processorArchitecture="*"/>
     <dependency>
         <dependentAssembly>
             <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>

go.mod

@@ -2,6 +2,8 @@ module git.monoexp.com/bajdev/mpckit
 
 go 1.26.0
 
+toolchain go1.27.4
+
 require github.com/wailsapp/wails/v3 v3.1.0
 
 require (

internal/app/app.go

@@ -17,7 +17,7 @@ import (
 )
 
 // Version and Commit are set by production builds (Taskfile.yml) with
-// -ldflags "-X git.monoexp.com/bajdev/mpckit/internal/app.Version=0.5.0
+// -ldflags "-X git.monoexp.com/bajdev/mpckit/internal/app.Version=0.5.2
 // -X git.monoexp.com/bajdev/mpckit/internal/app.Commit=2354f57".
 var (
 	Version = "dev"

pull-requests/release-0-5-2/release-0-5-2.md

@@ -0,0 +1,60 @@
+# Release 0.5.2
+
+Branch: `release-0-5-2` → `main`
+
+PR 4 of the review fixes plan (`docs/review-fixes-plan.md`): the 0.5.2 release of PRs 1-3. After the merge, the merge commit is tagged `v0.5.2` ("MPCkit 0.5.2 (beta)").
+
+## What's new in 0.5.2 (for beta testers)
+
+0.5.2 is a security and reliability release. Nothing changes in how you build kits, and projects from 0.5.1 open as before.
+
+**Opening projects**
+- MPCkit refuses a project file whose sample names point outside its own data folder (for example `../../secret.txt`), or whose samples or sequences are missing information it needs. The message names the problem. Before, such a file could make MPCkit read or write files elsewhere on your computer, or close without warning.
+- MPCkit refuses a project file that would unpack to more than 256 MB. Real projects are about 3 MB. Before, a small crafted file could use gigabytes of memory.
+- If something unexpected still goes wrong, MPCkit shows "Something went wrong inside MPCkit, and the last action may not have finished." instead of closing.
+
+**Exporting**
+- If the samples of a project you opened include a shortcut (a symbolic link), or the data folder itself is one, that sample shows as missing and export is blocked. A shared kit can no longer use a link to slip another file from your computer into an export.
+- Exporting over an earlier export can no longer lose it. If something fails partway, the previous export is left exactly as it was.
+- Exporting into a folder that has since been deleted now says so plainly: "export folder does not exist".
+
+**Adding samples**
+- A WAV that is a shortcut to another file works: MPCkit copies the file it points to.
+- Sample names that would not work on the MPC's card or on Windows are adjusted when you add the sample. `/`, `\`, `: * ? " < > |` and control characters become `_` (`kick\one.wav` becomes `kick_one.wav`), and Windows device names get `_` added (`CON.wav` becomes `CON_.wav`). Such names only occur on macOS and Linux.
+
+**Under the hood**
+- Built with Go 1.27.4, which fixes a security problem in Go's `net/http` package (GO-2026-6859).
+
+## What changed
+
+- **Version 0.5.2** in every file the README's "Releasing" paragraph lists:
+  - `APP_VERSION` in `Taskfile.yml`, and `version` in `build/config.yml`;
+  - Windows: `build/windows/info.json` (four places), `wails.exe.manifest` and `nsis/wails_tools.nsh`;
+  - macOS: `build/darwin/Info.plist` and `Info.dev.plist` (two places each);
+  - Linux: `build/linux/nfpm/nfpm.yaml`.
+- **Examples updated:** the `Version` comment in `internal/app/app.go` (it still said 0.5.0) and the README's About example.
+- **`go.mod`** now has `toolchain go1.27.4`. The `go 1.26.0` line stays, so Go 1.26 or newer can still read the module and fetches 1.27.4 to build it.
+- **README:** the Go requirement now says builds use Go 1.27.4 or later. It also says that where Go is set to `GOTOOLCHAIN=local`, as openSUSE's package is, you set `GOTOOLCHAIN=go1.27.4` for every Go and `wails3` command.
+
+## Notes
+
+- **Left at 0.5.1:** the `version` inside the commented-out iOS block of `build/config.yml`. PR 8 removes that block.
+- **Your Windows laptop:** Go from go.dev uses `GOTOOLCHAIN=auto`, so the first `wails3 build` downloads Go 1.27.4 by itself; nothing to install. The Linux desktop is the same unless its Go comes from a distribution package set to `local`.
+
+## Testing
+
+**On the server, every command with `GOTOOLCHAIN=go1.27.4`** (openSUSE's Go defaults to `local`):
+- `go test ./...` passes, including the round-trip tests.
+- `go vet ./...` and `staticcheck ./...` are clean.
+- **`govulncheck ./...`: "No vulnerabilities found."**
+- `npm install`, `npm run check` (0 errors, 0 warnings) and `npm run build` pass. The lockfile was not committed.
+- `wails3 build` builds. `go version bin/mpckit` says `go1.27.4`, and the binary carries version `0.5.2`. `timeout 15 xvfb-run -a bin/mpckit` starts and runs.
+
+**On the laptop (PowerShell, in the repo):**
+1. `git fetch; git checkout release-0-5-2`
+2. `go env GOTOOLCHAIN`: `auto`. If it says `local`, run `$env:GOTOOLCHAIN = "go1.27.4"` first.
+3. `wails3 build`. The first run may pause while Go 1.27.4 downloads.
+4. `go version bin\mpckit.exe`: `go1.27.4`.
+5. Run `bin\mpckit.exe`. About shows "Version 0.5.2" and a Build line.
+6. Properties → Details of `bin\mpckit.exe`: product version 0.5.2.
+7. Optional: `go run golang.org/x/vuln/cmd/govulncheck@latest ./...` reports "No vulnerabilities found."