mpckit/pull-requests/release-0-5-2/release-0-5-2.md

Release 0.5.2

Branch: release-0-5-2 → main

PR 4 of the review fixes plan (docs/review-fixes-plan.md): the 0.5.2 release of PRs 1-3. After the merge, the merge commit is tagged v0.5.2 ("MPCkit 0.5.2 (beta)").

What's new in 0.5.2 (for beta testers)

0.5.2 is a security and reliability release. Nothing changes in how you build kits, and projects from 0.5.1 open as before.

Opening projects

• MPCkit refuses a project file whose sample names point outside its own data folder (for example ../../secret.txt), or whose samples or sequences are missing information it needs. The message names the problem. Before, such a file could make MPCkit read or write files elsewhere on your computer, or close without warning.
• MPCkit refuses a project file that would unpack to more than 256 MB. Real projects are about 3 MB. Before, a small crafted file could use gigabytes of memory.
• If something unexpected still goes wrong, MPCkit shows "Something went wrong inside MPCkit, and the last action may not have finished." instead of closing.

Exporting

• If the samples of a project you opened include a shortcut (a symbolic link), or the data folder itself is one, that sample shows as missing and export is blocked. A shared kit can no longer use a link to slip another file from your computer into an export.
• Exporting over an earlier export can no longer lose it. If something fails partway, the previous export is left exactly as it was.
• Exporting into a folder that has since been deleted now says so plainly: "export folder does not exist".

Adding samples

• A WAV that is a shortcut to another file works: MPCkit copies the file it points to.
• Sample names that would not work on the MPC's card or on Windows are adjusted when you add the sample. /, \, : * ? " < > | and control characters become _ (kick\one.wav becomes kick_one.wav), and Windows device names get _ added (CON.wav becomes CON_.wav). Such names only occur on macOS and Linux.

Under the hood

• Built with Go 1.27.4, which fixes a security problem in Go's net/http package (GO-2026-6859).

What changed

• Version 0.5.2 in every file the README's "Releasing" paragraph lists:
  • APP_VERSION in Taskfile.yml, and version in build/config.yml;
  • Windows: build/windows/info.json (four places), wails.exe.manifest and nsis/wails_tools.nsh;
  • macOS: build/darwin/Info.plist and Info.dev.plist (two places each);
  • Linux: build/linux/nfpm/nfpm.yaml.
• Examples updated: the Version comment in internal/app/app.go (it still said 0.5.0) and the README's About example.
• go.mod now has toolchain go1.27.4. The go 1.26.0 line stays, so Go 1.26 or newer can still read the module and fetches 1.27.4 to build it.
• README: the Go requirement now says builds use Go 1.27.4 or later. It also says that where Go is set to GOTOOLCHAIN=local, as openSUSE's package is, you set GOTOOLCHAIN=go1.27.4 for every Go and wails3 command.

Notes

• Left at 0.5.1: the version inside the commented-out iOS block of build/config.yml. PR 8 removes that block.
• Your Windows laptop: Go from go.dev uses GOTOOLCHAIN=auto, so the first wails3 build downloads Go 1.27.4 by itself; nothing to install. The Linux desktop is the same unless its Go comes from a distribution package set to local.

Testing

On the server, every command with GOTOOLCHAIN=go1.27.4 (openSUSE's Go defaults to local):

• go test ./... passes, including the round-trip tests.
• go vet ./... and staticcheck ./... are clean.
• govulncheck ./...: "No vulnerabilities found."
• npm install, npm run check (0 errors, 0 warnings) and npm run build pass. The lockfile was not committed.
• wails3 build builds. go version bin/mpckit says go1.27.4, and the binary carries version 0.5.2. timeout 15 xvfb-run -a bin/mpckit starts and runs.

On the laptop (PowerShell, in the repo):

1. git fetch; git checkout release-0-5-2
2. go env GOTOOLCHAIN: auto. If it says local, run $env:GOTOOLCHAIN = "go1.27.4" first.
3. wails3 build. The first run may pause while Go 1.27.4 downloads.
4. go version bin\mpckit.exe: go1.27.4.
5. Run bin\mpckit.exe. About shows "Version 0.5.2" and a Build line.
6. Properties → Details of bin\mpckit.exe: product version 0.5.2.
7. Optional: go run golang.org/x/vuln/cmd/govulncheck@latest ./... reports "No vulnerabilities found."