mpckit/pull-requests/release-0-5-3/release-0-5-3.md

Release 0.5.3

Branch: release-0-5-3 → main

PR 9 of the review fixes plan (docs/review-fixes-plan.md): the 0.5.3 release of PRs 5–8 and 8b. After the merge, the merge commit is tagged v0.5.3 ("MPCkit 0.5.3 (beta)").

What's new in 0.5.3 (for beta testers)

0.5.3 is a hardening release. Projects from 0.5.2 open as before, and the files MPCkit exports are byte-for-byte the same as before for the same edits.

You'll notice

• Pad labels are now "A1", "B2", … "H16" instead of "A01", "B02", everywhere: the pad and sequence grids, the side panels, the move/copy picker and the confirm dialogs. One format everywhere, the same as MPCkit's command-line tool. Sequence names such as "Sequence 01" are unchanged, because that is how the device names them.
• Declining to replace an export forgets the folder or file you picked. The next export asks again.

Safer under the hood

• A failed edit no longer leaves a project half-changed, for example on a project file with an unusual pad layout. A failed tune, mute-group or sequence edit no longer marks the project as having unsaved changes.
• The window's code can no longer load, assign or export using a file path of its own. MPCkit only opens and writes files you picked in a dialog or dropped on a pad.
• Builds are reproducible:
  • the frontend's package versions are locked;
  • npm won't pick a package version published in the last 7 days;
  • unused server-mode and Docker build options are gone.

What changed

• Version 0.5.3 in every file the README's "Releasing" paragraph lists:
  • APP_VERSION in Taskfile.yml, and version in build/config.yml;
  • Windows: build/windows/info.json (four places), wails.exe.manifest and nsis/wails_tools.nsh;
  • macOS: build/darwin/Info.plist and Info.dev.plist (two places each);
  • Linux: build/linux/nfpm/nfpm.yaml.
• Examples updated: the Version comment's example in internal/app/app.go, and the README's About example.
• No toolchain change: go.mod keeps toolchain go1.27.4 from 0.5.2, and govulncheck still finds nothing.

PRs in this release:

PR	Branch	Findings fixed	What it did
5	unbind-paths	S4	Export goes where the dialog chose; no bound method takes a path.
6	atomic-edits	M3, M4	Edits are all-or-nothing; project state is only written by project.
7	a1-labels	M6	"A1" labels everywhere.
8	build-cleanup	S6 (without CI), M7, M8, R1	Lockfile, .npmrc min-release-age=7, no server, Docker or cross-compile tasks, config clean-up, unused Version() removed.
8b	bound-surface	S4 (rest)	Go-only methods on an unbound Host, bound methods pinned by TestBoundMethods, and CancelExport.

Notes

• The review's open items are in the plan's Backlog: S5, M9–M11 and R2–R7. None of them blocks this release.
• Open question 7 is unrelated to these fixes and still open: whether currentSequence holds a slot or a list position.

Testing

On the server, every command with GOTOOLCHAIN=go1.27.4:

• go test ./... passes.
• go vet ./... (also with GOOS=windows) and staticcheck ./... are clean.
• govulncheck ./...: "No vulnerabilities found."
• In frontend: npm ci, npm run check (0 errors, 0 warnings) and npm run build.
• wails3 build builds. go version bin/mpckit says go1.27.4, the binary carries version 0.5.3, and it starts under Xvfb.

On the laptop (PowerShell, in the repo):

1. git fetch; git checkout release-0-5-3
2. wails3 build, then run bin\mpckit.exe. About shows "Version 0.5.3" and a Build line.
3. Properties → Details of bin\mpckit.exe: product version 0.5.3.
4. go version bin\mpckit.exe: go1.27.4.
5. Quick tour:
   • load testdata\device\DemoFile.xpj: the pads show "A1"-style labels;
   • preview a pad;
   • export to a folder, then export again and choose Cancel at "Replace existing files?".
6. Optional: go run golang.org/x/vuln/cmd/govulncheck@latest ./... reports "No vulnerabilities found."