enricobuehler
ababeafce3
ci / bun-nix (pull_request) Successful in 36s
ci / docs-site (pull_request) Successful in 1m9s
ci / web (pull_request) Successful in 1m44s
ci / rust-arm64 (pull_request) Successful in 2m14s
ci / docs-drift (pull_request) Successful in 2m15s
ci / rust (pull_request) Successful in 8m42s
Two overstatements in the v0.32.0 notes, both flagged on reading the published release. **"anyone who could open your web console page"** was simply wrong, and it is the sentence the Discord embed leads with. Reaching the pairing routes required an ALREADY-AUTHENTICATED console session — it was privilege escalation inside the console (those routes alone among the trust-root actions never re-asked for the console password), not something an unauthenticated peer on the network could touch. The notes now say so plainly, and say why it still mattered: pairing is what grants launch, so a console sign-in became the ability to start a process on the host. **"58 security issues"** invites the reading that there were 58 exploitable defects. There were 58 findings, and the long tail is minor hardening and build-infrastructure tightening. Both documents now lead with that proportion instead of the raw count. Same correction applied to CHANGELOG.md in three places: the section intro, the `Breaking changes` entry, and the security-review heading. Nothing about the fix itself changed — only the description of its severity. The tag does not need re-pointing: `announce.yml` checks out the ref it is dispatched on rather than the tag, and `apply_release_notes` re-syncs the body from `docs/releases/<tag>.md` there, so this lands in the announcement. The live release body is PATCHed to match in the same pass. Gates: the ISO 24495 auditor is back to its 2 standing findings (NVIDIA and AMD, company names deliberately left unexpanded); check-docs-links.sh and check-docs-drift.sh both exit 0.