Nightly 20260711-abb0c42

Automated nightly build.

Commit: abb0c42

Changes

• abb0c42 Fix host API type declarations flagged by the sound checker (#462)
• eeab0f8 build(deps): bump buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go (#464)
• 585815e chore(dependabot): update ownership (#463)
• 49f30c9 build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#457)
• 8a1de32 build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager (#458)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

v0.3.19a

v0.3.19a

Fix Hub dependency install/update/uninstall reliability by canonicalizing dependency root IDs.

Commit: 93c1a85

Changes

• 93c1a85 fix(registry): canonicalize dependency root IDs (#455)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

v0.3.18a

v0.3.18a

Fix profile-safe Hub dependency install/update planning and registry history replay.

Commit: be6745d

Changes

• be6745d fix(registry): make dependency installs profile-safe (#449)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

v0.3.17a

v0.3.17a

Runtime dependency uninstall now preserves live imported entries during Hub uninstall/update planning.

Commit: a60f9a0

Changes

• a60f9a0 fix: keep live imported entries during dependency uninstall (#454)
• c4d9b7f build(deps): bump github.com/xuri/excelize/v2 from 2.10.1 to 2.11.0 (#453)
• d2a4bd7 build(deps): bump go.temporal.io/sdk from 1.45.0 to 1.46.0 (#452)
• cbbe66f build(deps): bump go.temporal.io/api from 1.63.1 to 1.63.2 (#451)
• c7e622e build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 (#450)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

Nightly 20260709-93c1a85

Automated nightly build.

Commit: 93c1a85

Changes

• 93c1a85 fix(registry): canonicalize dependency root IDs (#455)
• be6745d fix(registry): make dependency installs profile-safe (#449)
• a60f9a0 fix: keep live imported entries during dependency uninstall (#454)
• c4d9b7f build(deps): bump github.com/xuri/excelize/v2 from 2.10.1 to 2.11.0 (#453)
• d2a4bd7 build(deps): bump go.temporal.io/sdk from 1.45.0 to 1.46.0 (#452)
• cbbe66f build(deps): bump go.temporal.io/api from 1.63.1 to 1.63.2 (#451)
• c7e622e build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 (#450)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

v0.3.16a

v0.3.16a

Runtime leak fixes: treesitter native cleanup, HTTP body channel buffering, and ratelimit request-driven cleanup.

Commit: 58f79c6

Changes

• 58f79c6 fix(http/ratelimit): replace cleanup goroutine with lazy TTL sweep (#446)
• 87a92d2 fix(http): buffer body-read channels to stop request goroutine leak (#447)
• a9c4bc8 fix(treesitter): free C object in Close() to stop native heap leak (#440)
• 3601836 build(deps): bump github.com/hashicorp/memberlist from 0.5.4 to 0.6.0 (#444)
• 8ae7caa build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs (#441)
• a8d065b build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager (#442)
• ba0564c build(deps): bump github.com/aws/aws-sdk-go-v2/config (#445)
• fe33a10 Merge pull request #439 from wippyai/fix/live-dependency-update-owner
• dbe8ddd fix(hub): replace same-id module entries on dependency update
• ad5f551 Merge pull request #437 from wippyai/fix/skip-non-entry-manifests
• ff43bff fix(linking): scope module-meta requirement fallback
• 3bea43f fix(loader): skip non-entry json manifests
• a9dc21e fix(hub): descriptive error when the hub is unavailable or rate limiting (#436)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

Nightly 20260708-58f79c6

Automated nightly build.

Commit: 58f79c6

Changes

• 58f79c6 fix(http/ratelimit): replace cleanup goroutine with lazy TTL sweep (#446)
• 87a92d2 fix(http): buffer body-read channels to stop request goroutine leak (#447)
• a9c4bc8 fix(treesitter): free C object in Close() to stop native heap leak (#440)
• 3601836 build(deps): bump github.com/hashicorp/memberlist from 0.5.4 to 0.6.0 (#444)
• 8ae7caa build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs (#441)
• a8d065b build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager (#442)
• ba0564c build(deps): bump github.com/aws/aws-sdk-go-v2/config (#445)
• fe33a10 Merge pull request #439 from wippyai/fix/live-dependency-update-owner
• dbe8ddd fix(hub): replace same-id module entries on dependency update
• ad5f551 Merge pull request #437 from wippyai/fix/skip-non-entry-manifests
• ff43bff fix(linking): scope module-meta requirement fallback
• 3bea43f fix(loader): skip non-entry json manifests

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

v0.3.15a

v0.3.15a

Adds PBKDF2 hashing, PostgreSQL registry history, and an OUTDATED notice for upgradable processes; also improves tracing/metrics and fixes several leaks, dependency linking, and CLI packaging bugs.

Commit: 8636f7b

Changes

• 8636f7b feat(otel,metrics): comprehensive tracing + metrics coverage and correctness fixes (#398)
• f47d3c5 Merge pull request #427 from wippyai/codex/kickside-pack-hub-run
• 2ac214e fix(cli): harden hub pack cache and embed all fs
• 6a7ffb3 Merge pull request #423 from wippyai/fix/dependency-linker-fqn-scope
• 9a1e35b fix(deps): hydrate replacement manifest dependencies
• e3d0737 Merge remote lint alignment into local hardening commits
• 42f2fc5 fix lint field alignment
• 884cb3f Merge pull request #433 from wippyai/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/feature/s3/manager-1.22.30
• 7c0ed8d build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager
• 1c4ae30 Merge pull request #431 from wippyai/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.19.26
• 0d814dc build(deps): bump github.com/aws/aws-sdk-go-v2/credentials
• a6cff33 Merge pull request #432 from wippyai/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/sqs-1.44.2
• 820a488 Merge pull request #430 from wippyai/dependabot/go_modules/github.com/kaptinlin/jsonschema-0.9.3
• bf2df0e Merge pull request #425 from wippyai/fix/pg-registry-history
• 5913da6 build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
• cdb42c9 build(deps): bump github.com/kaptinlin/jsonschema from 0.9.2 to 0.9.3
• 6fca6e1 Merge pull request #429 from wippyai/feat/hash-pbkdf2
• bec2746 feat(hash): add pbkdf2
• c04b099 Merge pull request #428 from wippyai/fix/queue-max-length
• 2ca8fad fix(attrs): safely coerce integer config values
• 57be69d Fix linter
• 8e8b420 Accept float64/int64/json.Number in Bag.GetInt
• c3197c7 Snapshot process inspector state
• de1af9e Fail on rejected index entries
• 90e64d6 Harden transactional module extraction
• 52c8ddf test(deps): lock uninstall of parameterized dependency roots
• 4ca6efa fix(cli): keep publish unbundled and pack app containers
• 02aab42 fix(registry): serialize sqlite history cold open
• 31d1cea test.sh: cover boot and system/registry packages
• 1707154 Add coverage for module-qualified fan-out in linking
• f87c1b2 restore bare-name fan-out in link stage; value conflict is the only guard
• ee9402e Add tests for qualified, three-way, and mixed ambiguous requirement addressing
• d42f800 fix(deps): defer owned-address ambiguity to actual ambiguous use
• 26ba905 feat(registry): add postgres history backend
• 4513476 fix(prometheus): bound time-series cardinality to prevent memory leak (#426)
• b6a7b41 feat(process): OUTDATED notification for upgradable processes on code invalidation
• 2435e08 fix(http-client): bound client pool to prevent FD/goroutine leak (#424)
• 05b2249 fix(entry): legacy *_env directive keeps inline value when the name is not a registered variable
• 6d9cdbe fix(deps): normalize link params to concrete requirement ids; root-over-transitive precedence in the linker
• f608884 fix(deps): detect diamond version conflicts via constraint-intersection fixpoint
• 4c83856 fix(deps): remove parameter name priority
• b408cc1 fix(deps): scope lock fallback to installed roots
• d1dcb58 fix(deps): trust lock for untouched modules
• c1021c8 fix(deps): preserve installed host entries
• f2c33bb fix(deps): keep installed entry owners
• d9d23cb fix(deps): infer packed entry owners
• 1529741 fix(deps): preserve packed entry ownership
• 9ec1f4f fix(linker): prefer exact dependency parameters
• 4770462 fix(deps): preserve untouched module entries
• 0ae36b2 fix(linker): prefer root dependency parameters
• 7229542 fix(deps): reject duplicate root dependencies
• b5dd1ec test(linker): lock dependency parameter scoping

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

Nightly 20260707-a9dc21e

Automated nightly build.

Commit: a9dc21e

Changes

• a9dc21e fix(hub): descriptive error when the hub is unavailable or rate limiting (#436)
• 8636f7b feat(otel,metrics): comprehensive tracing + metrics coverage and correctness fixes (#398)
• f47d3c5 Merge pull request #427 from wippyai/codex/kickside-pack-hub-run
• 2ac214e fix(cli): harden hub pack cache and embed all fs
• 6a7ffb3 Merge pull request #423 from wippyai/fix/dependency-linker-fqn-scope
• 9a1e35b fix(deps): hydrate replacement manifest dependencies
• e3d0737 Merge remote lint alignment into local hardening commits
• 42f2fc5 fix lint field alignment
• 884cb3f Merge pull request #433 from wippyai/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/feature/s3/manager-1.22.30
• 7c0ed8d build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager
• 1c4ae30 Merge pull request #431 from wippyai/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.19.26
• 0d814dc build(deps): bump github.com/aws/aws-sdk-go-v2/credentials
• a6cff33 Merge pull request #432 from wippyai/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/sqs-1.44.2
• 820a488 Merge pull request #430 from wippyai/dependabot/go_modules/github.com/kaptinlin/jsonschema-0.9.3
• bf2df0e Merge pull request #425 from wippyai/fix/pg-registry-history
• 5913da6 build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
• cdb42c9 build(deps): bump github.com/kaptinlin/jsonschema from 0.9.2 to 0.9.3
• 6fca6e1 Merge pull request #429 from wippyai/feat/hash-pbkdf2
• bec2746 feat(hash): add pbkdf2
• c04b099 Merge pull request #428 from wippyai/fix/queue-max-length
• 2ca8fad fix(attrs): safely coerce integer config values
• 57be69d Fix linter
• 8e8b420 Accept float64/int64/json.Number in Bag.GetInt
• c3197c7 Snapshot process inspector state
• de1af9e Fail on rejected index entries
• 90e64d6 Harden transactional module extraction
• 52c8ddf test(deps): lock uninstall of parameterized dependency roots
• 4ca6efa fix(cli): keep publish unbundled and pack app containers
• 02aab42 fix(registry): serialize sqlite history cold open
• 31d1cea test.sh: cover boot and system/registry packages
• 1707154 Add coverage for module-qualified fan-out in linking
• f87c1b2 restore bare-name fan-out in link stage; value conflict is the only guard
• ee9402e Add tests for qualified, three-way, and mixed ambiguous requirement addressing
• d42f800 fix(deps): defer owned-address ambiguity to actual ambiguous use
• 26ba905 feat(registry): add postgres history backend
• b6a7b41 feat(process): OUTDATED notification for upgradable processes on code invalidation
• 05b2249 fix(entry): legacy *_env directive keeps inline value when the name is not a registered variable
• 6d9cdbe fix(deps): normalize link params to concrete requirement ids; root-over-transitive precedence in the linker
• f608884 fix(deps): detect diamond version conflicts via constraint-intersection fixpoint
• 4c83856 fix(deps): remove parameter name priority
• b408cc1 fix(deps): scope lock fallback to installed roots
• d1dcb58 fix(deps): trust lock for untouched modules
• c1021c8 fix(deps): preserve installed host entries
• f2c33bb fix(deps): keep installed entry owners
• d9d23cb fix(deps): infer packed entry owners
• 1529741 fix(deps): preserve packed entry ownership
• 9ec1f4f fix(linker): prefer exact dependency parameters
• 4770462 fix(deps): preserve untouched module entries
• 0ae36b2 fix(linker): prefer root dependency parameters
• 7229542 fix(deps): reject duplicate root dependencies
• b5dd1ec test(linker): lock dependency parameter scoping

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub

Nightly 20260706-4513476

Automated nightly build.

Commit: 4513476

Changes

• 4513476 fix(prometheus): bound time-series cardinality to prevent memory leak (#426)
• 2435e08 fix(http-client): bound client pool to prevent FD/goroutine leak (#424)

Verify

sha256sum -c SHA256SUMS
# each wippy-<os>-<arch>.sig is base64(ed25519 detached sig); verify with release_key.pub