# Release 0.5.2

Branch: `release-0-5-2` → `main`

PR 4 of the review fixes plan (`docs/review-fixes-plan.md`): the 0.5.2 release of PRs 1-3. After the merge, the merge commit is tagged `v0.5.2` ("MPCkit 0.5.2 (beta)").

## What's new in 0.5.2 (for beta testers)

0.5.2 is a security and reliability release. Nothing changes in how you build kits, and projects from 0.5.1 open as before.

**Opening projects**
- MPCkit refuses a project file whose sample names point outside its own data folder (for example `../../secret.txt`), or whose samples or sequences are missing information it needs. The message names the problem. Before, such a file could make MPCkit read or write files elsewhere on your computer, or close without warning.
- MPCkit refuses a project file that would unpack to more than 256 MB. Real projects are about 3 MB. Before, a small crafted file could use gigabytes of memory.
- If something unexpected still goes wrong, MPCkit shows "Something went wrong inside MPCkit, and the last action may not have finished." instead of closing.

**Exporting**
- If the samples of a project you opened include a shortcut (a symbolic link), or the data folder itself is one, that sample shows as missing and export is blocked. A shared kit can no longer use a link to slip another file from your computer into an export.
- Exporting over an earlier export can no longer lose it. If something fails partway, the previous export is left exactly as it was.
- Exporting into a folder that has since been deleted now says so plainly: "export folder does not exist".

**Adding samples**
- A WAV that is a shortcut to another file works: MPCkit copies the file it points to.
- Sample names that would not work on the MPC's card or on Windows are adjusted when you add the sample. `/`, `\`, `: * ? " < > |` and control characters become `_` (`kick\one.wav` becomes `kick_one.wav`), and Windows device names get `_` added (`CON.wav` becomes `CON_.wav`). Such names only occur on macOS and Linux.

**Under the hood**
- Built with Go 1.27.4, which fixes a security problem in Go's `net/http` package (GO-2026-6859).

## What changed

- **Version 0.5.2** in every file the README's "Releasing" paragraph lists:
  - `APP_VERSION` in `Taskfile.yml`, and `version` in `build/config.yml`;
  - Windows: `build/windows/info.json` (four places), `wails.exe.manifest` and `nsis/wails_tools.nsh`;
  - macOS: `build/darwin/Info.plist` and `Info.dev.plist` (two places each);
  - Linux: `build/linux/nfpm/nfpm.yaml`.
- **Examples updated:** the `Version` comment in `internal/app/app.go` (it still said 0.5.0) and the README's About example.
- **`go.mod`** now has `toolchain go1.27.4`. The `go 1.26.0` line stays, so Go 1.26 or newer can still read the module and fetches 1.27.4 to build it.
- **README:** the Go requirement now says builds use Go 1.27.4 or later. It also says that where Go is set to `GOTOOLCHAIN=local`, as openSUSE's package is, you set `GOTOOLCHAIN=go1.27.4` for every Go and `wails3` command.

## Notes

- **Left at 0.5.1:** the `version` inside the commented-out iOS block of `build/config.yml`. PR 8 removes that block.
- **Your Windows laptop:** Go from go.dev uses `GOTOOLCHAIN=auto`, so the first `wails3 build` downloads Go 1.27.4 by itself; nothing to install. The Linux desktop is the same unless its Go comes from a distribution package set to `local`.

## Testing

**On the server, every command with `GOTOOLCHAIN=go1.27.4`** (openSUSE's Go defaults to `local`):
- `go test ./...` passes, including the round-trip tests.
- `go vet ./...` and `staticcheck ./...` are clean.
- **`govulncheck ./...`: "No vulnerabilities found."**
- `npm install`, `npm run check` (0 errors, 0 warnings) and `npm run build` pass. The lockfile was not committed.
- `wails3 build` builds. `go version bin/mpckit` says `go1.27.4`, and the binary carries version `0.5.2`. `timeout 15 xvfb-run -a bin/mpckit` starts and runs.

**On the laptop (PowerShell, in the repo):**
1. `git fetch; git checkout release-0-5-2`
2. `go env GOTOOLCHAIN`: `auto`. If it says `local`, run `$env:GOTOOLCHAIN = "go1.27.4"` first.
3. `wails3 build`. The first run may pause while Go 1.27.4 downloads.
4. `go version bin\mpckit.exe`: `go1.27.4`.
5. Run `bin\mpckit.exe`. About shows "Version 0.5.2" and a Build line.
6. Properties → Details of `bin\mpckit.exe`: product version 0.5.2.
7. Optional: `go run golang.org/x/vuln/cmd/govulncheck@latest ./...` reports "No vulnerabilities found."