From f7f0bfbc482e6fcdb11b146da03281bddb2357e0 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Fri, 12 Jun 2026 23:21:39 +0200 Subject: [PATCH] release: bump 0.8.8 -> 0.8.9 (#285) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maintenance release — supply-chain and CI housekeeping only. No library code or public API changes. ### Security - Triaged the pyo3 advisories RUSTSEC-2026-0176 / RUSTSEC-2026-0177 as not affecting Wickra (vulnerable APIs unreachable from the binding; fix blocked upstream by rust-numpy pinning pyo3 `^0.28`). Recorded in `deny.toml` and `osv-scanner.toml`. ### Changed - Java binding: `central-publishing-maven-plugin` 0.5.0 → 0.10.0. - CI GitHub Actions bumped to latest (checkout, setup-go, setup-java, codeql-action, taiki-e/install-action). - Added a Maven ecosystem to Dependabot. Version bumped across all manifests/lockfiles via `bump_version.py`; Cargo.lock refreshed. CHANGELOG `[0.8.9]` filled. Tag/publish to follow on explicit GO. --- CHANGELOG.md | 28 ++++++++++++- Cargo.lock | 18 ++++----- Cargo.toml | 4 +- SECURITY.md | 6 +-- bindings/csharp/Wickra/Wickra.csproj | 2 +- bindings/java/README.md | 4 +- bindings/java/pom.xml | 2 +- bindings/node/npm/darwin-arm64/package.json | 2 +- bindings/node/npm/darwin-x64/package.json | 2 +- .../node/npm/linux-arm64-gnu/package.json | 2 +- bindings/node/npm/linux-x64-gnu/package.json | 2 +- .../node/npm/win32-arm64-msvc/package.json | 2 +- bindings/node/npm/win32-x64-msvc/package.json | 2 +- bindings/node/package-lock.json | 40 +++++++++---------- bindings/node/package.json | 14 +++---- bindings/python/pyproject.toml | 2 +- bindings/r/DESCRIPTION | 2 +- examples/java/pom.xml | 4 +- examples/node/package-lock.json | 14 +++---- 19 files changed, 89 insertions(+), 63 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f8b81fdb..a1983044 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.8.9] - 2026-06-12 + +Maintenance release: supply-chain and CI housekeeping only. No library code or +public API changes. + +### Security +- Triaged the pyo3 advisories RUSTSEC-2026-0176 (out-of-bounds read in + `PyList`/`PyTuple` `nth`/`nth_back`) and RUSTSEC-2026-0177 (missing `Sync` + bound on `PyCFunction::new_closure`) as **not affecting Wickra**: neither + vulnerable API is reachable from the Python binding. Both are fixed in pyo3 + 0.29, but rust-numpy 0.28 pins pyo3 `^0.28`, so the upgrade is blocked + upstream; the advisories are recorded with their not-affected rationale in + `deny.toml` and `osv-scanner.toml` and will be cleared once rust-numpy 0.29 + ships. + +### Changed +- Java binding: bumped `central-publishing-maven-plugin` 0.5.0 → 0.10.0 (the + Maven Central publishing plugin used at release time). +- Bumped the SHA-pinned GitHub Actions used in CI (`actions/checkout`, + `actions/setup-go`, `actions/setup-java`, `github/codeql-action`, + `taiki-e/install-action`) to their latest releases. +- Added a Maven ecosystem to Dependabot so the Java binding's build plugins and + dependencies are tracked going forward. + + ## [0.8.8] - 2026-06-11 ### Fixed - R binding: declare `Depends: R (>= 2.10)`, clearing the `R CMD check` warning @@ -1572,7 +1597,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 optional Binance live feed. - Bindings for Python, Node.js, and WebAssembly. -[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.8.8...HEAD +[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.8.9...HEAD +[0.8.9]: https://github.com/wickra-lib/wickra/compare/v0.8.8...v0.8.9 [0.8.8]: https://github.com/wickra-lib/wickra/compare/v0.8.7...v0.8.8 [0.8.7]: https://github.com/wickra-lib/wickra/compare/v0.8.6...v0.8.7 [0.8.6]: https://github.com/wickra-lib/wickra/compare/v0.8.5...v0.8.6 diff --git a/Cargo.lock b/Cargo.lock index 1dc51482..ff6aed15 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1944,7 +1944,7 @@ dependencies = [ [[package]] name = "wickra" -version = "0.8.8" +version = "0.8.9" dependencies = [ "approx", "criterion", @@ -1955,7 +1955,7 @@ dependencies = [ [[package]] name = "wickra-bench" -version = "0.8.8" +version = "0.8.9" dependencies = [ "criterion", "kand", @@ -1967,14 +1967,14 @@ dependencies = [ [[package]] name = "wickra-c" -version = "0.8.8" +version = "0.8.9" dependencies = [ "wickra-core", ] [[package]] name = "wickra-core" -version = "0.8.8" +version = "0.8.9" dependencies = [ "approx", "proptest", @@ -1984,7 +1984,7 @@ dependencies = [ [[package]] name = "wickra-data" -version = "0.8.8" +version = "0.8.9" dependencies = [ "approx", "csv", @@ -2001,7 +2001,7 @@ dependencies = [ [[package]] name = "wickra-examples" -version = "0.8.8" +version = "0.8.9" dependencies = [ "serde_json", "tokio", @@ -2011,7 +2011,7 @@ dependencies = [ [[package]] name = "wickra-node" -version = "0.8.8" +version = "0.8.9" dependencies = [ "napi", "napi-build", @@ -2021,7 +2021,7 @@ dependencies = [ [[package]] name = "wickra-python" -version = "0.8.8" +version = "0.8.9" dependencies = [ "numpy", "pyo3", @@ -2030,7 +2030,7 @@ dependencies = [ [[package]] name = "wickra-wasm" -version = "0.8.8" +version = "0.8.9" dependencies = [ "console_error_panic_hook", "js-sys", diff --git a/Cargo.toml b/Cargo.toml index 8fd07dc3..80aa5bc6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -14,7 +14,7 @@ members = [ exclude = ["fuzz"] [workspace.package] -version = "0.8.8" +version = "0.8.9" authors = ["kingchenc "] edition = "2021" rust-version = "1.86" @@ -26,7 +26,7 @@ keywords = ["finance", "trading", "indicators", "technical-analysis", "ta"] categories = ["finance", "mathematics", "science"] [workspace.dependencies] -wickra-core = { path = "crates/wickra-core", version = "0.8.8" } +wickra-core = { path = "crates/wickra-core", version = "0.8.9" } thiserror = "2" rayon = "1.10" diff --git a/SECURITY.md b/SECURITY.md index 1c93a368..02aad673 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,13 +2,13 @@ ## Supported versions -Wickra is pre-1.0. Security fixes are applied to the latest released `0.8.8` +Wickra is pre-1.0. Security fixes are applied to the latest released `0.8.9` version only; please upgrade to the newest release before reporting an issue. | Version | Supported | | --- | --- | -| 0.8.8 (latest) | :white_check_mark: | -| < 0.8.8 | :x: | +| 0.8.9 (latest) | :white_check_mark: | +| < 0.8.9 | :x: | ## Reporting a vulnerability diff --git a/bindings/csharp/Wickra/Wickra.csproj b/bindings/csharp/Wickra/Wickra.csproj index 43549a52..d95194a9 100644 --- a/bindings/csharp/Wickra/Wickra.csproj +++ b/bindings/csharp/Wickra/Wickra.csproj @@ -11,7 +11,7 @@ Wickra - 0.8.8 + 0.8.9 kingchenc High-performance streaming technical-analysis indicators (514 indicators) for .NET, backed by the native Rust core via the Wickra C ABI. MIT OR Apache-2.0 diff --git a/bindings/java/README.md b/bindings/java/README.md index b0e4f321..cde5d775 100644 --- a/bindings/java/README.md +++ b/bindings/java/README.md @@ -30,14 +30,14 @@ Maven: org.wickra wickra - 0.8.8 + 0.8.9 ``` Gradle: ```kotlin -implementation("org.wickra:wickra:0.8.8") +implementation("org.wickra:wickra:0.8.9") ``` The native library ships prebuilt per platform (Linux, macOS, Windows — x64 and diff --git a/bindings/java/pom.xml b/bindings/java/pom.xml index caf60a46..5651f766 100644 --- a/bindings/java/pom.xml +++ b/bindings/java/pom.xml @@ -6,7 +6,7 @@ org.wickra wickra - 0.8.8 + 0.8.9 jar Wickra diff --git a/bindings/node/npm/darwin-arm64/package.json b/bindings/node/npm/darwin-arm64/package.json index efc8bc15..302cb5d9 100644 --- a/bindings/node/npm/darwin-arm64/package.json +++ b/bindings/node/npm/darwin-arm64/package.json @@ -1,6 +1,6 @@ { "name": "wickra-darwin-arm64", - "version": "0.8.8", + "version": "0.8.9", "description": "Native binding for wickra (macOS Apple Silicon). Installed automatically as an optional dependency of wickra on matching platforms.", "main": "wickra.darwin-arm64.node", "files": [ diff --git a/bindings/node/npm/darwin-x64/package.json b/bindings/node/npm/darwin-x64/package.json index 39c2a10e..75243854 100644 --- a/bindings/node/npm/darwin-x64/package.json +++ b/bindings/node/npm/darwin-x64/package.json @@ -1,6 +1,6 @@ { "name": "wickra-darwin-x64", - "version": "0.8.8", + "version": "0.8.9", "description": "Native binding for wickra (macOS Intel). Installed automatically as an optional dependency of wickra on matching platforms.", "main": "wickra.darwin-x64.node", "files": [ diff --git a/bindings/node/npm/linux-arm64-gnu/package.json b/bindings/node/npm/linux-arm64-gnu/package.json index 911db23e..7efe29d7 100644 --- a/bindings/node/npm/linux-arm64-gnu/package.json +++ b/bindings/node/npm/linux-arm64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "wickra-linux-arm64-gnu", - "version": "0.8.8", + "version": "0.8.9", "description": "Native binding for wickra (linux arm64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.", "main": "wickra.linux-arm64-gnu.node", "files": [ diff --git a/bindings/node/npm/linux-x64-gnu/package.json b/bindings/node/npm/linux-x64-gnu/package.json index d9110731..734a5e71 100644 --- a/bindings/node/npm/linux-x64-gnu/package.json +++ b/bindings/node/npm/linux-x64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "wickra-linux-x64-gnu", - "version": "0.8.8", + "version": "0.8.9", "description": "Native binding for wickra (linux x64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.", "main": "wickra.linux-x64-gnu.node", "files": [ diff --git a/bindings/node/npm/win32-arm64-msvc/package.json b/bindings/node/npm/win32-arm64-msvc/package.json index 1dd4f1bc..ec9bf64b 100644 --- a/bindings/node/npm/win32-arm64-msvc/package.json +++ b/bindings/node/npm/win32-arm64-msvc/package.json @@ -1,6 +1,6 @@ { "name": "wickra-win32-arm64-msvc", - "version": "0.8.8", + "version": "0.8.9", "description": "Native binding for wickra (Windows arm64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.", "main": "wickra.win32-arm64-msvc.node", "files": [ diff --git a/bindings/node/npm/win32-x64-msvc/package.json b/bindings/node/npm/win32-x64-msvc/package.json index 4d0f6b9c..3107d429 100644 --- a/bindings/node/npm/win32-x64-msvc/package.json +++ b/bindings/node/npm/win32-x64-msvc/package.json @@ -1,6 +1,6 @@ { "name": "wickra-win32-x64-msvc", - "version": "0.8.8", + "version": "0.8.9", "description": "Native binding for wickra (Windows x64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.", "main": "wickra.win32-x64-msvc.node", "files": [ diff --git a/bindings/node/package-lock.json b/bindings/node/package-lock.json index 0c91c8d0..800b6021 100644 --- a/bindings/node/package-lock.json +++ b/bindings/node/package-lock.json @@ -1,12 +1,12 @@ { "name": "wickra", - "version": "0.8.8", + "version": "0.8.9", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "wickra", - "version": "0.8.8", + "version": "0.8.9", "license": "MIT OR Apache-2.0", "devDependencies": { "@napi-rs/cli": "^2.18.0" @@ -15,12 +15,12 @@ "node": ">= 18" }, "optionalDependencies": { - "wickra-darwin-arm64": "0.8.8", - "wickra-darwin-x64": "0.8.8", - "wickra-linux-arm64-gnu": "0.8.8", - "wickra-linux-x64-gnu": "0.8.8", - "wickra-win32-arm64-msvc": "0.8.8", - "wickra-win32-x64-msvc": "0.8.8" + "wickra-darwin-arm64": "0.8.9", + "wickra-darwin-x64": "0.8.9", + "wickra-linux-arm64-gnu": "0.8.9", + "wickra-linux-x64-gnu": "0.8.9", + "wickra-win32-arm64-msvc": "0.8.9", + "wickra-win32-x64-msvc": "0.8.9" } }, "node_modules/@napi-rs/cli": { @@ -41,8 +41,8 @@ } }, "node_modules/wickra-darwin-arm64": { - "version": "0.8.8", - "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.8.8.tgz", + "version": "0.8.9", + "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.8.9.tgz", "integrity": "sha512-4eZiBR/yGUdr4nzhEUFy2i69XgNx64iI2ax/LPamsThgylC0KpHOZKK19QzJ2d9KbK4C8nMjME5FLuR+4GNEwQ==", "cpu": [ "arm64" @@ -57,8 +57,8 @@ } }, "node_modules/wickra-darwin-x64": { - "version": "0.8.8", - "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.8.8.tgz", + "version": "0.8.9", + "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.8.9.tgz", "integrity": "sha512-6hf8zI3QPjTFp4zCpmgUwDvNtu6jHqNUHKD5e55POo0CgA52HkpyxSPtVm8TGTIZDI7kPjlbOdBM8CJ76mmXwA==", "cpu": [ "x64" @@ -73,8 +73,8 @@ } }, "node_modules/wickra-linux-arm64-gnu": { - "version": "0.8.8", - "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.8.8.tgz", + "version": "0.8.9", + "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.8.9.tgz", "integrity": "sha512-kSe6y0xBMSiqdPLXNjwop5WZdHtvdBNKSEBCwZ4hFq33p4apW25/wrlzv9/oDuyD4kuPabJEhCCnFOplh58CUg==", "cpu": [ "arm64" @@ -89,8 +89,8 @@ } }, "node_modules/wickra-linux-x64-gnu": { - "version": "0.8.8", - "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.8.8.tgz", + "version": "0.8.9", + "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.8.9.tgz", "integrity": "sha512-tWBWS4qz7hxM4xnpFb59bhf6TaLwXq0Z3jEa/2l7r8PiHA94g8r8S53NRMiT+4yiL5hSWe/nUiC/YXdRrhEZ4g==", "cpu": [ "x64" @@ -105,8 +105,8 @@ } }, "node_modules/wickra-win32-arm64-msvc": { - "version": "0.8.8", - "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.8.8.tgz", + "version": "0.8.9", + "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.8.9.tgz", "integrity": "sha512-EXIckHxAtF75PUGDKRzXyqMe9ldP0JjSdu68WFN6iJfp+McYrGu6h40TEJlQ/oUEIoPqiZB/xhVyo/el5Lg7zw==", "cpu": [ "arm64" @@ -121,8 +121,8 @@ } }, "node_modules/wickra-win32-x64-msvc": { - "version": "0.8.8", - "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.8.8.tgz", + "version": "0.8.9", + "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.8.9.tgz", "integrity": "sha512-Yfsqq1Xwp6hdxMyLze411vNdo7BDwI6+lPSe7A9XdqyPecNDbtKwYLpsal2r8EHbNzqM+R8XnuRtUaEQS5VlUQ==", "cpu": [ "x64" diff --git a/bindings/node/package.json b/bindings/node/package.json index ec787e63..800d7a05 100644 --- a/bindings/node/package.json +++ b/bindings/node/package.json @@ -1,6 +1,6 @@ { "name": "wickra", - "version": "0.8.8", + "version": "0.8.9", "description": "Streaming-first technical indicators: incremental, fast, install-free. Node bindings powered by Rust.", "author": "kingchenc ", "main": "index.js", @@ -47,12 +47,12 @@ "node": ">= 18" }, "optionalDependencies": { - "wickra-linux-x64-gnu": "0.8.8", - "wickra-linux-arm64-gnu": "0.8.8", - "wickra-darwin-x64": "0.8.8", - "wickra-darwin-arm64": "0.8.8", - "wickra-win32-x64-msvc": "0.8.8", - "wickra-win32-arm64-msvc": "0.8.8" + "wickra-linux-x64-gnu": "0.8.9", + "wickra-linux-arm64-gnu": "0.8.9", + "wickra-darwin-x64": "0.8.9", + "wickra-darwin-arm64": "0.8.9", + "wickra-win32-x64-msvc": "0.8.9", + "wickra-win32-arm64-msvc": "0.8.9" }, "scripts": { "build": "napi build --platform --release", diff --git a/bindings/python/pyproject.toml b/bindings/python/pyproject.toml index a157e6b3..e366eecf 100644 --- a/bindings/python/pyproject.toml +++ b/bindings/python/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "maturin" [project] name = "wickra" -version = "0.8.8" +version = "0.8.9" description = "Streaming-first technical indicators: incremental, fast, install-free." readme = "README.md" license = "MIT OR Apache-2.0" diff --git a/bindings/r/DESCRIPTION b/bindings/r/DESCRIPTION index 1ce5cb7d..b7283c68 100644 --- a/bindings/r/DESCRIPTION +++ b/bindings/r/DESCRIPTION @@ -1,7 +1,7 @@ Package: wickra Type: Package Title: Streaming-First Technical Indicators -Version: 0.8.8 +Version: 0.8.9 Authors@R: person("Wickra contributors", role = c("aut", "cre"), email = "support@wickra.org") Description: R bindings for the Wickra technical-analysis library over its C ABI hub. Exposes 514 indicators, each an O(1) streaming state machine shared with diff --git a/examples/java/pom.xml b/examples/java/pom.xml index 7b880d73..fbbb8bed 100644 --- a/examples/java/pom.xml +++ b/examples/java/pom.xml @@ -6,7 +6,7 @@ org.wickra.examples wickra-examples - 0.8.8 + 0.8.9 jar Wickra Java examples @@ -21,7 +21,7 @@ org.wickra wickra - 0.8.8 + 0.8.9 diff --git a/examples/node/package-lock.json b/examples/node/package-lock.json index 49093bc6..07a62b2b 100644 --- a/examples/node/package-lock.json +++ b/examples/node/package-lock.json @@ -17,7 +17,7 @@ }, "../../bindings/node": { "name": "wickra", - "version": "0.8.8", + "version": "0.8.9", "license": "MIT OR Apache-2.0", "devDependencies": { "@napi-rs/cli": "^2.18.0" @@ -26,12 +26,12 @@ "node": ">= 18" }, "optionalDependencies": { - "wickra-darwin-arm64": "0.8.8", - "wickra-darwin-x64": "0.8.8", - "wickra-linux-arm64-gnu": "0.8.8", - "wickra-linux-x64-gnu": "0.8.8", - "wickra-win32-arm64-msvc": "0.8.8", - "wickra-win32-x64-msvc": "0.8.8" + "wickra-darwin-arm64": "0.8.9", + "wickra-darwin-x64": "0.8.9", + "wickra-linux-arm64-gnu": "0.8.9", + "wickra-linux-x64-gnu": "0.8.9", + "wickra-win32-arm64-msvc": "0.8.9", + "wickra-win32-x64-msvc": "0.8.9" } }, "node_modules/wickra": {