Commitdc3f4c01Recorded25 Aug 2026Repositoryapiary

Bump sigil-log range to ^0.17

Message

sigil-log v0.17.0 quotes and escapes log field VALUES and sanitises field KEYS, closing a log-forgery hole: a string value carrying whitespace and an equals sign used to render as several convincing fields, and a value carrying a newline forged a whole log event. apiary logs untrusted input, so it needs the fix.

A caret range stops at the minor pre-1.0, so ^0.16 cannot resolve 0.17.0 and the range genuinely has to move. sigil.lock is re-resolved by sigil deps install, which moves only this entry; every other pin is left where it was.

Log output changes for anything that reads or parses these lines. Measured across 27 realistic values by the release: 15 render identically, 12 change. A value is now quoted if and only if it contains a space, an =, a ", a , a control character or a Unicode separator, or is empty.

Changed
 package.sgl | 2 +-
 sigil.lock  | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)
Diff
package.sglmodified
@@ -36,7 +36,7 @@
36
(from-git url: "codeberg:sigil/sigil"
37
package: "sigil-lib" version: "^0.19")
38
(from-git url: "codeberg:sigil/sigil-json" version: "^0.16")
−39
(from-git url: "codeberg:sigil/sigil-log" version: "^0.16")
+39
(from-git url: "codeberg:sigil/sigil-log" version: "^0.17")
40
(from-git url: "codeberg:sigil/sigil-mcp" version: "^0.17") ; the 0.17 line REQUIRES the 0.18 runtime; ^0.16 must not be used here
41
(from-git url: "codeberg:sigil/sigil-irc" version: "^0.16"))
42
sigil.lockmodified
@@ -19,9 +19,9 @@
19
version: "0.16.0")
20
(package name: "sigil-log"
21
url: "codeberg:sigil/sigil-log"
−22
ref: "^0.16"
−23
sha: "56e4fc5a52dc370c037ef14502bb8d6d2876dc53"
−24
version: "0.16.0")
+22
ref: "^0.17"
+23
sha: "e50644a2d73729cca94f7c6dfd4934f4d8530c21"
+24
version: "0.17.0")
25
(package name: "sigil-mcp"
26
url: "codeberg:sigil/sigil-mcp"
27
ref: "^0.17"