RELEASE_NOTES_v0.10.6.md — sigil-telegram

1Move to the sigil 0.18 runtime and sigil-http 0.18.3

3This release exists so consumers can pick up sigil-http's bounded blocking

4segments. sigil-telegram sat on `sigil-http ^0.16.0`, which resolves to the 0.16

5line, and the handshake and request-write bounds shipped on 0.18.3. Anything

6reaching sigil-http through sigil-telegram could not get them without this bump.

8That matters most for courier, which already passes `connect-timeout:` on both

9its poll and send paths and was the one estate consumer positioned to benefit

10immediately. It could not, because the fix was on a line its dependency chain

11never reached.

13## Changes

15- `sigil-http` moves from `^0.16.0` to `^0.18.3`.

16- The runtime moves from `sigil ^0.17` to `^0.18`, which 0.18.3 requires. A 0.17

17 runtime with a 0.18 dependency fails at load with a bytecode version mismatch

18 rather than at resolve time, so the two had to move together.

19- `sigil-lib` is now pinned explicitly, and declared first. Without the explicit

20 pin, a `^0.18` bump relocks `sigil-stdlib` and silently leaves `sigil-lib` on

21 0.17 while exiting 0. Declared first because dependency resolution is

22 order-dependent and a later stricter requirement is rejected rather than

23 unified.

25## Upgrade notes

27Consumers on `^0.10` pick this up on their next resolve. Taking it moves you to

28the sigil 0.18 runtime, so relock and rebuild rather than assuming a drop-in.

30Bounding is opt-in and defaults are unchanged: you still have to pass

31`connect-timeout:` to get the protection. Name resolution remains unbounded.