diff --git a/CHANGELOG.md b/CHANGELOG.md index bead310..dfa73f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [v1.1.1](https://github.com/skyoo2003/devcloud/releases/tag/v1.1.1) - 2026-09-07 +### Security +* An S3 object key can no longer leave the bucket that owns it — a key such as `../victim/secret.txt` stayed under the store base directory and so passed the old containment check, letting one tenant read, overwrite and delete another tenant's objects — because every user-controlled path component is now guarded with `filepath.IsLocal` ([#155](https://github.com/skyoo2003/devcloud/issues/155)) +### Documentation +* Changelog fragments are capped at one sentence, two at most — stated with a worked example in RELEASE.md, in the pre-flight checklist, in CONTRIBUTING.md and the PR checklist, and enforced by a 400-character body limit `changie new` refuses to exceed. Every entry already in the changelog is rewritten to that limit, and the v1.1.0 and v1.0.0 release notes are republished from their fragment files ([#152](https://github.com/skyoo2003/devcloud/issues/152)) +* The documentation no longer publishes the same figure at five different values: six numbers restated across pages now live in docs/coverage.md, which every other page links to. Three claims the code does not back are corrected — an unregistered `GET /devcloud/api/health`, a Lambda invoke failure blamed on Docker, and codegen outputs no template emits — and eighteen files are 1,063 lines shorter ([#151](https://github.com/skyoo2003/devcloud/issues/151)) +* The documentation is now published as a searchable site at https://skyoo2003.github.io/devcloud/, built with Hugo from the same `docs/*.md` files GitHub renders — no front matter added and no links rewritten. ([#154](https://github.com/skyoo2003/devcloud/issues/154)) ## [v1.1.0](https://github.com/skyoo2003/devcloud/releases/tag/v1.1.0) - 2026-09-06 ### Added * Provider-namespaced configuration: service blocks can be written as `providers.aws.services.*`, forward-compatible with `providers.azure.*`. The top-level `services` block is the same block under its historical name and keeps working ([#135](https://github.com/skyoo2003/devcloud/issues/135)) diff --git a/changes/unreleased/Documentation-20260906-185423.yaml b/changes/unreleased/Documentation-20260906-185423.yaml deleted file mode 100644 index 3e85e79..0000000 --- a/changes/unreleased/Documentation-20260906-185423.yaml +++ /dev/null @@ -1,5 +0,0 @@ -kind: Documentation -body: Changelog fragments are capped at one sentence, two at most — stated with a worked example in RELEASE.md, in the pre-flight checklist, in CONTRIBUTING.md and the PR checklist, and enforced by a 400-character body limit `changie new` refuses to exceed. Every entry already in the changelog is rewritten to that limit, and the v1.1.0 and v1.0.0 release notes are republished from their fragment files -time: 2026-09-06T18:54:23.073014+09:00 -custom: - Issue: "152" diff --git a/changes/unreleased/Documentation-20260906-234500.yaml b/changes/unreleased/Documentation-20260906-234500.yaml deleted file mode 100644 index 112962d..0000000 --- a/changes/unreleased/Documentation-20260906-234500.yaml +++ /dev/null @@ -1,5 +0,0 @@ -kind: Documentation -body: 'The documentation no longer publishes the same figure at five different values: six numbers restated across pages now live in docs/coverage.md, which every other page links to. Three claims the code does not back are corrected — an unregistered `GET /devcloud/api/health`, a Lambda invoke failure blamed on Docker, and codegen outputs no template emits — and eighteen files are 1,063 lines shorter' -time: 2026-09-06T23:45:00.000000+09:00 -custom: - Issue: "151" diff --git a/changes/unreleased/Documentation-20260907-101500.yaml b/changes/unreleased/Documentation-20260907-101500.yaml deleted file mode 100644 index bcb8be1..0000000 --- a/changes/unreleased/Documentation-20260907-101500.yaml +++ /dev/null @@ -1,5 +0,0 @@ -kind: Documentation -body: The documentation is now published as a searchable site at https://skyoo2003.github.io/devcloud/, built with Hugo from the same `docs/*.md` files GitHub renders — no front matter added and no links rewritten. -time: 2026-09-07T10:15:00.000000+09:00 -custom: - Issue: "154" diff --git a/changes/unreleased/Security-20260907-074946.yaml b/changes/unreleased/Security-20260907-074946.yaml deleted file mode 100644 index 540131b..0000000 --- a/changes/unreleased/Security-20260907-074946.yaml +++ /dev/null @@ -1,5 +0,0 @@ -kind: Security -body: An S3 object key can no longer leave the bucket that owns it — a key such as `../victim/secret.txt` stayed under the store base directory and so passed the old containment check, letting one tenant read, overwrite and delete another tenant's objects — because every user-controlled path component is now guarded with `filepath.IsLocal` -time: 2026-09-07T07:49:46.951306+09:00 -custom: - Issue: "155" diff --git a/changes/v1.1.1.md b/changes/v1.1.1.md new file mode 100644 index 0000000..cd99dd3 --- /dev/null +++ b/changes/v1.1.1.md @@ -0,0 +1,7 @@ +## [v1.1.1](https://github.com/skyoo2003/devcloud/releases/tag/v1.1.1) - 2026-09-07 +### Security +* An S3 object key can no longer leave the bucket that owns it — a key such as `../victim/secret.txt` stayed under the store base directory and so passed the old containment check, letting one tenant read, overwrite and delete another tenant's objects — because every user-controlled path component is now guarded with `filepath.IsLocal` ([#155](https://github.com/skyoo2003/devcloud/issues/155)) +### Documentation +* Changelog fragments are capped at one sentence, two at most — stated with a worked example in RELEASE.md, in the pre-flight checklist, in CONTRIBUTING.md and the PR checklist, and enforced by a 400-character body limit `changie new` refuses to exceed. Every entry already in the changelog is rewritten to that limit, and the v1.1.0 and v1.0.0 release notes are republished from their fragment files ([#152](https://github.com/skyoo2003/devcloud/issues/152)) +* The documentation no longer publishes the same figure at five different values: six numbers restated across pages now live in docs/coverage.md, which every other page links to. Three claims the code does not back are corrected — an unregistered `GET /devcloud/api/health`, a Lambda invoke failure blamed on Docker, and codegen outputs no template emits — and eighteen files are 1,063 lines shorter ([#151](https://github.com/skyoo2003/devcloud/issues/151)) +* The documentation is now published as a searchable site at https://skyoo2003.github.io/devcloud/, built with Hugo from the same `docs/*.md` files GitHub renders — no front matter added and no links rewritten. ([#154](https://github.com/skyoo2003/devcloud/issues/154))