Files

T

kingchenc 099ae66b57 release: bump 0.4.7 -> 0.5.0 (#159 )

Version bump for the 0.5.0 release, which ships the relicense to MIT OR Apache-2.0.

Stacked on #158 (base branch `chore/relicense-mit-apache`) so this PR's diff is the bump only. After #158 merges to main, GitHub retargets this PR to main; merge it, then tag `v0.5.0` to publish.

## Changes
- Bump 0.4.7 -> 0.5.0 across the Cargo workspace, Python `pyproject.toml`, Node `package.json` + 6 platform manifests + 2 lockfiles, and `Cargo.lock`.
- CHANGELOG: cut the [0.5.0] section (the relicense) and add compare URLs.
- SECURITY.md: supported versions 0.4.x -> 0.5.x.

Minor (not patch) bump: a relicense is a significant change. No code changes.

NOTE: do not tag/release until you give the go (irreversible publish to crates.io/PyPI/npm). Suggested merge order: #158 -> this -> tag `v0.5.0` -> then the downstream PRs.

2026-06-03 18:53:23 +02:00

1.4 KiB

Raw Blame History

Security Policy

Supported versions

Wickra is pre-1.0. Security fixes are applied to the latest released 0.5.x version only; please upgrade to the newest release before reporting an issue.

Version	Supported
0.5.x (latest)	✅
older 0.5.x	❌

Reporting a vulnerability

Do not open a public issue for a security vulnerability.

Report it privately through one of:

GitHub's private vulnerability reporting ("Report a vulnerability" under the repository's Security tab), or
email to support@wickra.org with a subject line starting with [wickra security].

Please include:

the affected version(s) and platform / language binding,
a description of the issue and its impact,
steps to reproduce, ideally a minimal proof of concept.

What to expect

An acknowledgement within 5 working days.
An assessment and, if confirmed, a planned fix with a target release.
Coordinated disclosure: we will agree on a disclosure date with you and credit you in the release notes unless you prefer to stay anonymous.

Scope

In scope: the published crates (wickra-core, wickra-data, wickra), the PyPI/npm packages, and the build/release workflows in .github/workflows/.

Out of scope: vulnerabilities in third-party dependencies (report those upstream; we track them via Dependabot and cargo-deny).