Bump to 0.10.6: sigil-http 0.18.3 on the 0.18 runtime

Message

sigil-telegram sat on sigil-http ^0.16.0, so anything reaching sigil-http through it was pinned to the 0.16 line and could not receive the bounded handshake and request-write shipped in 0.18.3. Courier is the case that matters: it already passes connect-timeout: on both its poll and send paths, and was the one estate consumer positioned to benefit immediately, but the fix was on a line its dependency chain never reached.

The runtime had to move with it. A 0.17 runtime carrying a 0.18 dependency fails at load with a bytecode version mismatch rather than at resolve time, so the two are one change.

sigil-lib is pinned explicitly and declared first. Bumping the runtime alone relocked sigil-stdlib to 0.18.2 and silently left sigil-lib on 0.17.1 while exiting 0, which is the documented partial-relock defect; declaring it first avoids the order-dependent resolution that rejects a later stricter requirement instead of unifying it. Both were hit while making this change, not recalled.

Changed

 RELEASE_NOTES_v0.10.6.md | 31 +++++++++++++++++++++++++++++++
 package.sgl              | 11 ++++++++---
 sigil.lock               | 30 +++++++++++++++---------------
 3 files changed, 54 insertions(+), 18 deletions(-)

Diff

RELEASE_NOTES_v0.10.6.mdadded

@@ -0,0 +1,31 @@

Move to the sigil 0.18 runtime and sigil-http 0.18.3

This release exists so consumers can pick up sigil-http's bounded blocking

segments. sigil-telegram sat on `sigil-http ^0.16.0`, which resolves to the 0.16

line, and the handshake and request-write bounds shipped on 0.18.3. Anything

reaching sigil-http through sigil-telegram could not get them without this bump.

That matters most for courier, which already passes `connect-timeout:` on both

its poll and send paths and was the one estate consumer positioned to benefit

+10

immediately. It could not, because the fix was on a line its dependency chain

+11

never reached.

+12

+13

## Changes

+14

+15

- `sigil-http` moves from `^0.16.0` to `^0.18.3`.

+16

- The runtime moves from `sigil ^0.17` to `^0.18`, which 0.18.3 requires. A 0.17

+17

runtime with a 0.18 dependency fails at load with a bytecode version mismatch

+18

rather than at resolve time, so the two had to move together.

+19

- `sigil-lib` is now pinned explicitly, and declared first. Without the explicit

+20

pin, a `^0.18` bump relocks `sigil-stdlib` and silently leaves `sigil-lib` on

+21

0.17 while exiting 0. Declared first because dependency resolution is

+22

order-dependent and a later stricter requirement is rejected rather than

+23

unified.

+24

+25

## Upgrade notes

+26

+27

Consumers on `^0.10` pick this up on their next resolve. Taking it moves you to

+28

the sigil 0.18 runtime, so relock and rebuild rather than assuming a drop-in.

+29

+30

Bounding is opt-in and defaults are unchanged: you still have to pass

+31

`connect-timeout:` to get the protection. Name resolution remains unbounded.

package.sglmodified

@@ -6,8 +6,8 @@

(package

name: "sigil-telegram"

−9

version: "0.10.5"

−10

sigil: "^0.17"

version: "0.10.6"

+10

sigil: "^0.18"

description: "Telegram Bot API client library"

url: "https://codeberg.org/sigil/sigil-telegram"

license: "BSD-3-Clause"

@@ -26,8 +26,13 @@

optimize: 2))

dependencies: (list

+29

;; sigil-lib pinned EXPLICITLY and FIRST. Without the explicit pin a ^0.18

+30

;; bump relocks sigil-stdlib and silently leaves sigil-lib on 0.17, exit 0

+31

;; (t-4ea2). Declared first because `sigil deps install` is order-dependent

+32

;; and a later stricter requirement is rejected rather than unified (t-86ec).

+33

(from-git url: "codeberg:sigil/sigil" package: "sigil-lib" version: "^0.18")

(from-git url: "codeberg:sigil/sigil-json" version: "^0.14.0")

−30

(from-git url: "codeberg:sigil/sigil-http" version: "^0.16.0"))

+35

(from-git url: "codeberg:sigil/sigil-http" version: "^0.18.3"))

dev-dependencies: (list

(from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: "^0.17")

sigil.lockmodified

@@ -2,10 +2,16 @@

(lock

(package name: "sigil-stdlib"

url: "codeberg:sigil/sigil"

−5

ref: "^0.17"

−6

sha: "61ba6501f4ff5d1fd534c13c4a3494b69cc88412"

ref: "^0.18"

sha: "7e7c8873d45338a8e892aa3982b6991d9a1fa5a5"

package-selector: "sigil-stdlib"

−8

version: "0.17.1")

version: "0.18.2")

(package name: "sigil-lib"

+10

url: "codeberg:sigil/sigil"

+11

ref: "^0.18"

+12

sha: "7e7c8873d45338a8e892aa3982b6991d9a1fa5a5"

+13

package-selector: "sigil-lib"

+14

version: "0.18.2")

(package name: "sigil-json"

url: "codeberg:sigil/sigil-json"

ref: "^0.14.0"

@@ -13,9 +19,9 @@

version: "0.14.0")

(package name: "sigil-http"

url: "codeberg:sigil/sigil-http"

−16

ref: "^0.16.0"

−17

sha: "9a9c716c147136457db2a0cc4a428686bc43a0a8"

−18

version: "0.16.6")

+22

ref: "^0.18.3"

+23

sha: "98e86e5b24efc775c0eda24bf886c9b39b3ffbe2"

+24

version: "0.18.3")

(package name: "sigil-test"

url: "codeberg:sigil/sigil"

ref: "^0.17"

@@ -35,9 +41,9 @@

version: "0.16.0")

(package name: "sigil-tls"

url: "codeberg:sigil/sigil-tls"

−38

ref: "^0.16.0"

−39

sha: "e67c3b00b19bc495e38527203d0a563a8bcd5eab"

−40

version: "0.16.2")

+44

ref: "^0.16.5"

+45

sha: "fe4b756f2f46eacf5e3a4eb5d17f2681d88c5ee8"

+46

version: "0.16.5")

(package name: "sigil-ansi"

url: "codeberg:sigil/sigil-ansi"

ref: "^0.16.0"

@@ -53,12 +59,6 @@

ref: "^0.16.0"

sha: "0da6221050319ee241461b45eaba1a353b7bf0ec"

version: "0.16.0")

−56

(package name: "sigil-lib"

−57

url: "codeberg:sigil/sigil"

−58

ref: "^0.17"

−59

sha: "61ba6501f4ff5d1fd534c13c4a3494b69cc88412"

−60

package-selector: "sigil-lib"

−61

version: "0.17.1")

(package name: "sigil-crypto"

url: "codeberg:sigil/sigil-crypto"

ref: "^0.16"