v0.10.6

This release exists so consumers can pick up sigil-http's bounded blocking segments. sigil-telegram sat on sigil-http ^0.16.0, which resolves to the 0.16 line, and the handshake and request-write bounds shipped on 0.18.3. Anything reaching sigil-http through sigil-telegram could not get them without this bump.

That matters most for courier, which already passes connect-timeout: on both its poll and send paths and was the one estate consumer positioned to benefit immediately. It could not, because the fix was on a line its dependency chain never reached.

Changes

• sigil-http moves from ^0.16.0 to ^0.18.3.
• The runtime moves from sigil ^0.17 to ^0.18, which 0.18.3 requires. A 0.17 runtime with a 0.18 dependency fails at load with a bytecode version mismatch rather than at resolve time, so the two had to move together.
• sigil-lib is now pinned explicitly, and declared first. Without the explicit pin, a ^0.18 bump relocks sigil-stdlib and silently leaves sigil-lib on 0.17 while exiting 0. Declared first because dependency resolution is order-dependent and a later stricter requirement is rejected rather than unified.

Upgrade notes

Consumers on ^0.10 pick this up on their next resolve. Taking it moves you to the sigil 0.18 runtime, so relock and rebuild rather than assuming a drop-in.

Bounding is opt-in and defaults are unchanged: you still have to pass connect-timeout: to get the protection. Name resolution remains unbounded.