Commit2b52afe9Recorded25 Aug 2026Repositorycourier

Bump sigil-log range to ^0.17

Message

sigil-log v0.17.0 quotes and escapes log field VALUES and sanitises field KEYS, closing a log-forgery hole: a string value carrying whitespace and an equals sign used to render as several convincing fields, and a value carrying a newline forged a whole log event. courier logs untrusted input, so it needs the fix.

A caret range stops at the minor pre-1.0, so ^0.16 cannot resolve 0.17.0 and the range genuinely has to move. sigil.lock is re-resolved by sigil deps install, which moves only this entry; every other pin is left where it was.

Log output changes for anything that reads or parses these lines. Measured across 27 realistic values by the release: 15 render identically, 12 change. A value is now quoted if and only if it contains a space, an =, a ", a , a control character or a Unicode separator, or is empty.

Changed
 package.sgl | 2 +-
 sigil.lock  | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)
Diff
package.sglmodified
@@ -44,7 +44,7 @@
44
(from-git url: "codeberg:sigil/sigil"
45
package: "sigil-lib" version: "^0.19")
46
(from-git url: "codeberg:sigil/sigil-json" version: "^0.16")
−47
(from-git url: "codeberg:sigil/sigil-log" version: "^0.16")
+47
(from-git url: "codeberg:sigil/sigil-log" version: "^0.17")
48
(from-git url: "codeberg:sigil/sigil-mcp" version: "^0.17") ; the 0.17 line REQUIRES the 0.18 runtime; ^0.16 must not be used here
49
(from-git url: "codeberg:sigil/sigil-yaml" version: "^0.9.1")
50
(from-git url: "codeberg:sigil/sigil-telegram" version: "^0.10.0"))
sigil.lockmodified
@@ -19,9 +19,9 @@
19
version: "0.16.0")
20
(package name: "sigil-log"
21
url: "codeberg:sigil/sigil-log"
−22
ref: "^0.16"
−23
sha: "56e4fc5a52dc370c037ef14502bb8d6d2876dc53"
−24
version: "0.16.0")
+22
ref: "^0.17"
+23
sha: "e50644a2d73729cca94f7c6dfd4934f4d8530c21"
+24
version: "0.17.0")
25
(package name: "sigil-mcp"
26
url: "codeberg:sigil/sigil-mcp"
27
ref: "^0.17"