From dd012047f2bda59ad0f0390af119de2c2cd7c8db Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:10:32 +0200 Subject: [PATCH 1/7] Bump version to 3.1.1 for next release --- Cargo.lock | 6 +++--- Cargo.toml | 2 +- crates/git-same-app/tauri.conf.json | 2 +- crates/git-same-app/ui/package.json | 2 +- crates/git-same-cli/Cargo.toml | 2 +- macos/GitSameBadges/Info.plist | 4 ++-- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 222f6d3..05de972 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1523,7 +1523,7 @@ dependencies = [ [[package]] name = "git-same" -version = "3.1.0" +version = "3.1.1" dependencies = [ "anyhow", "chrono", @@ -1548,7 +1548,7 @@ dependencies = [ [[package]] name = "git-same-app" -version = "3.1.0" +version = "3.1.1" dependencies = [ "anyhow", "chrono", @@ -1566,7 +1566,7 @@ dependencies = [ [[package]] name = "git-same-core" -version = "3.1.0" +version = "3.1.1" dependencies = [ "anyhow", "async-trait", diff --git a/Cargo.toml b/Cargo.toml index 384aab8..fa6bd7c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -7,7 +7,7 @@ members = [ resolver = "2" [workspace.package] -version = "3.1.0" +version = "3.1.1" edition = "2021" authors = ["Manuel Gruber"] license = "MIT" diff --git a/crates/git-same-app/tauri.conf.json b/crates/git-same-app/tauri.conf.json index cdb336f..4df2c8e 100644 --- a/crates/git-same-app/tauri.conf.json +++ b/crates/git-same-app/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Git-Same", - "version": "3.1.0", + "version": "3.1.1", "identifier": "com.zaai.git-same", "build": { "beforeDevCommand": "corepack pnpm dev", diff --git a/crates/git-same-app/ui/package.json b/crates/git-same-app/ui/package.json index d37e928..a1edec1 100644 --- a/crates/git-same-app/ui/package.json +++ b/crates/git-same-app/ui/package.json @@ -1,7 +1,7 @@ { "name": "git-same-app-ui", "private": true, - "version": "3.1.0", + "version": "3.1.1", "type": "module", "packageManager": "pnpm@11.0.9+sha512.34ce82e6780233cf9cad8685029a8f81d2e06196c5a9bad98879f7424940c6817c4e4524fb7d38b8553ceed48b9758b8ebaf1abd3600c232c4c8cf7366086f38", "scripts": { diff --git a/crates/git-same-cli/Cargo.toml b/crates/git-same-cli/Cargo.toml index 75ac847..90ae7ce 100644 --- a/crates/git-same-cli/Cargo.toml +++ b/crates/git-same-cli/Cargo.toml @@ -39,7 +39,7 @@ tui = ["dep:ratatui", "dep:crossterm"] release-tools = ["dep:clap_complete", "dep:clap_mangen"] [dependencies] -git-same-core = { path = "../git-same-core", version = "=3.1.0" } +git-same-core = { path = "../git-same-core", version = "=3.1.1" } clap = { workspace = true } tokio = { workspace = true } serde = { workspace = true } diff --git a/macos/GitSameBadges/Info.plist b/macos/GitSameBadges/Info.plist index b019946..10eb9ec 100644 --- a/macos/GitSameBadges/Info.plist +++ b/macos/GitSameBadges/Info.plist @@ -17,9 +17,9 @@ CFBundlePackageType XPC! CFBundleShortVersionString - 3.1.0 + 3.1.1 CFBundleVersion - 3.1.0 + 3.1.1 NSExtension NSExtensionPointIdentifier From 3015507171c59bfc69a43762d12782412cc5ed79 Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:26:57 +0200 Subject: [PATCH 2/7] Migrate cask to postflight_steps to fix warning Homebrew 7 deprecated Ruby `postflight` blocks in casks and warns on every brew run that loads the tap. Replace the block with the declarative `postflight_steps` DSL (available since Homebrew 5.1.14). The steps run in Homebrew's sandbox with a throwaway HOME, so file steps use `base: :home` instead of "~", and the plist render becomes `copy` + `inreplace` with the `{{appdir}}` token. `run` args have no home token, so launchctl paths are spelled /Users/{{user}}. On a relocated home the plist is still written correctly and only the immediate best-effort `launchctl load` no-ops; the agent then starts at next login. Verified with `brew style` and `brew audit --strict` via toolkit/homebrew/verify-tap.sh --offline. The install smoke test still needs an interactive terminal: the cask's `uninstall delete:` stanza always invokes sudo. --- toolkit/homebrew/cask.rb.tmpl | 43 +++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/toolkit/homebrew/cask.rb.tmpl b/toolkit/homebrew/cask.rb.tmpl index 46c3973..e1429ee 100644 --- a/toolkit/homebrew/cask.rb.tmpl +++ b/toolkit/homebrew/cask.rb.tmpl @@ -29,30 +29,39 @@ cask "git-same" do binary "#{appdir}/Git-Same.app/Contents/Helpers/git-same", target: "gitsa" binary "#{appdir}/Git-Same.app/Contents/Helpers/git-same", target: "gisa" - postflight do - legacy_plist_dst = "#{Dir.home}/Library/LaunchAgents/com.zaai.git-same.daemon.plist" - if File.exist?(legacy_plist_dst) - system_command "/bin/launchctl", args: ["unload", legacy_plist_dst], sudo: false, must_succeed: false - File.delete(legacy_plist_dst) + # Steps run in Homebrew's sandbox with a throwaway HOME, so file paths use + # `base: :home` (the real home) instead of "~". `run` args have no home + # token, so launchctl paths are spelled /Users/{{user}}. All launchctl and + # pluginkit calls are best-effort: the agent also loads at next login. + postflight_steps do + if_path_exists "Library/LaunchAgents/com.zaai.git-same.daemon.plist", base: :home do + run "/bin/launchctl", + args: ["unload", "/Users/{{user}}/Library/LaunchAgents/com.zaai.git-same.daemon.plist"], + must_succeed: false + remove "Library/LaunchAgents/com.zaai.git-same.daemon.plist", base: :home end - plist_src = "#{appdir}/Git-Same.app/Contents/Resources/com.zaai.git-same.monitor.plist" - plist_dst = "#{Dir.home}/Library/LaunchAgents/com.zaai.git-same.monitor.plist" - monitor_binary = "#{appdir}/Git-Same.app/Contents/Helpers/git-same" - - FileUtils.mkdir_p(File.dirname(plist_dst)) - rendered = File.read(plist_src).gsub("__GIT_SAME_MONITOR_BINARY__", monitor_binary) - File.write(plist_dst, rendered) - system_command "/bin/launchctl", args: ["unload", plist_dst], sudo: false, must_succeed: false - system_command "/bin/launchctl", args: ["load", plist_dst], sudo: false, must_succeed: false + copy "Git-Same.app/Contents/Resources/com.zaai.git-same.monitor.plist", + "Library/LaunchAgents/com.zaai.git-same.monitor.plist", + source_base: :appdir, target_base: :home + inreplace "Library/LaunchAgents/com.zaai.git-same.monitor.plist", + "__GIT_SAME_MONITOR_BINARY__", + "{{appdir}}/Git-Same.app/Contents/Helpers/git-same", + base: :home + run "/bin/launchctl", + args: ["unload", "/Users/{{user}}/Library/LaunchAgents/com.zaai.git-same.monitor.plist"], + must_succeed: false + run "/bin/launchctl", + args: ["load", "/Users/{{user}}/Library/LaunchAgents/com.zaai.git-same.monitor.plist"], + must_succeed: false # Clear stale FinderSync registration from pre-rename builds (id was # `com.zaai.git-same.GitSameBadge.FinderSync`; renamed to # `com.zaai.git-same.badges` in 3.1.0). Best-effort: ignored if the id # is not present in pluginkit's cache. - system_command "/usr/bin/pluginkit", - args: ["-e", "ignore", "-i", "com.zaai.git-same.GitSameBadge.FinderSync"], - sudo: false, must_succeed: false + run "/usr/bin/pluginkit", + args: ["-e", "ignore", "-i", "com.zaai.git-same.GitSameBadge.FinderSync"], + must_succeed: false end # Both labels listed for one release: `com.zaai.git-same.daemon` is the From 634381563d87aebfb953a0bb6f0f7d760bae5df7 Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:42:38 +0200 Subject: [PATCH 3/7] Bump postcss to 8.5.28 to fix XSS advisories Resolves Dependabot alerts 16 (GHSA-r28c-9q8g-f849) and 19 (GHSA-fxqj-rqcc-2cmp). postcss is transitive via vite; lockfile-only refresh, also lifts nanoid to 3.3.19. --- crates/git-same-app/ui/pnpm-lock.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/crates/git-same-app/ui/pnpm-lock.yaml b/crates/git-same-app/ui/pnpm-lock.yaml index 7b3fa1b..b1c44ca 100644 --- a/crates/git-same-app/ui/pnpm-lock.yaml +++ b/crates/git-same-app/ui/pnpm-lock.yaml @@ -430,8 +430,8 @@ packages: resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==} engines: {node: '>=4'} - nanoid@3.3.15: - resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==} + nanoid@3.3.19: + resolution: {integrity: sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -446,8 +446,8 @@ packages: resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.28: + resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==} engines: {node: ^10 || ^12 || >=14} readdirp@4.1.2: @@ -824,7 +824,7 @@ snapshots: mri@1.2.0: {} - nanoid@3.3.15: {} + nanoid@3.3.19: {} obug@2.1.3: {} @@ -832,9 +832,9 @@ snapshots: picomatch@4.0.4: {} - postcss@8.5.15: + postcss@8.5.28: dependencies: - nanoid: 3.3.15 + nanoid: 3.3.19 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -922,7 +922,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.28 rolldown: 1.1.3 tinyglobby: 0.2.17 optionalDependencies: From 95c62a9b15a62110ead5a60741b091dd896a7a1d Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:42:38 +0200 Subject: [PATCH 4/7] Bump devalue to 5.9.2 to fix security alert Resolves Dependabot alert 21 (GHSA-9rgm-9g3h-6x36). devalue is transitive via svelte; lockfile-only refresh. --- crates/git-same-app/ui/pnpm-lock.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/crates/git-same-app/ui/pnpm-lock.yaml b/crates/git-same-app/ui/pnpm-lock.yaml index b1c44ca..893cc9b 100644 --- a/crates/git-same-app/ui/pnpm-lock.yaml +++ b/crates/git-same-app/ui/pnpm-lock.yaml @@ -315,8 +315,8 @@ packages: resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==} engines: {node: '>=8'} - devalue@5.8.1: - resolution: {integrity: sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==} + devalue@5.9.2: + resolution: {integrity: sha512-po4PAY5c53tw5XMocSnf8A/5OHhbbUftpr93aEN6BBoAdntUmK7vu7wOATqvt7cXO7m1Cl4gMVn6p7n6n4mj0w==} esm-env@1.2.2: resolution: {integrity: sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==} @@ -748,7 +748,7 @@ snapshots: detect-libc@2.1.2: {} - devalue@5.8.1: {} + devalue@5.9.2: {} esm-env@1.2.2: {} @@ -898,7 +898,7 @@ snapshots: aria-query: 5.3.1 axobject-query: 4.1.0 clsx: 2.1.1 - devalue: 5.8.1 + devalue: 5.9.2 esm-env: 1.2.2 esrap: 2.2.12 is-reference: 3.0.3 From aee27b298bc0a46a39838a0657937bbfcab9e90a Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:42:38 +0200 Subject: [PATCH 5/7] Bump setup-node to v7 to stay on current major Supersedes Dependabot PR 22. v7 is an ESM migration with no input changes; we only pass node-version. --- .github/workflows/S1-Test-CI.yml | 2 +- .github/workflows/S2-Release-GitHub.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/S1-Test-CI.yml b/.github/workflows/S1-Test-CI.yml index 097c016..cdffeac 100644 --- a/.github/workflows/S1-Test-CI.yml +++ b/.github/workflows/S1-Test-CI.yml @@ -114,7 +114,7 @@ jobs: - uses: Swatinem/rust-cache@v2 - name: Install Node - uses: actions/setup-node@v6 + uses: actions/setup-node@v7 with: node-version: 24 diff --git a/.github/workflows/S2-Release-GitHub.yml b/.github/workflows/S2-Release-GitHub.yml index aa54467..e8fbb5f 100644 --- a/.github/workflows/S2-Release-GitHub.yml +++ b/.github/workflows/S2-Release-GitHub.yml @@ -423,7 +423,7 @@ jobs: - uses: Swatinem/rust-cache@v2 - name: Install Node - uses: actions/setup-node@v6 + uses: actions/setup-node@v7 with: node-version: 24 From a91afcd05a4e6b2e960958cc74e14daf7bcb3f28 Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:42:38 +0200 Subject: [PATCH 6/7] Bump action-gh-release to 3.0.3 for bug fixes Supersedes Dependabot PR 24. SHA verified against the v3.0.3 tag. --- .github/workflows/S2-Release-GitHub.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/S2-Release-GitHub.yml b/.github/workflows/S2-Release-GitHub.yml index e8fbb5f..02b4f17 100644 --- a/.github/workflows/S2-Release-GitHub.yml +++ b/.github/workflows/S2-Release-GitHub.yml @@ -502,7 +502,7 @@ jobs: find artifacts -type f -exec cp {} release-assets/ \; - name: Create/update release - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: files: release-assets/* env: From 25f6789accc327abc8a1a2e112bfd2b1d0d038c4 Mon Sep 17 00:00:00 2001 From: Manuel Date: Sat, 19 Sep 2026 15:42:38 +0200 Subject: [PATCH 7/7] Ignore install-action patch bumps to cut PR noise Supersedes Dependabot PR 23, which rewrote the floating @v2 tag to a patch pin that would be reopened weekly. Major bumps still get a PR. --- .github/dependabot.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2289aff..d7d9992 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,15 @@ updates: directory: "/" schedule: interval: "weekly" + ignore: + # taiki-e/install-action is referenced by its floating @v2 major tag and + # ships patch releases almost daily. Without this, Dependabot rewrites + # @v2 to a patch pin (@v2.x.y) and reopens that PR every week. Major + # bumps still get a PR. + - dependency-name: "taiki-e/install-action" + update-types: + - "version-update:semver-minor" + - "version-update:semver-patch" # Cargo is configured only to record accepted-risk suppressions, not to open # version-bump PRs (open-pull-requests-limit: 0 disables version updates; the