From 91839c5788b5a02532ae35675e55d43b4355d5c1 Mon Sep 17 00:00:00 2001 From: h4x0r Date: Sun, 16 Aug 2026 03:01:38 +0000 Subject: [PATCH] chore(release): bump memf-core/format/strings/windows to publish the security fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #17 fixed this repo's tree but published nothing, and the reason is structural rather than a mistake in the commit subject: the squash touched 8 files, none of them under `crates/`, and release-plz runs with `dependencies_update = false`. So no library package changed by its own reckoning, and it correctly declined — logging `no commit matches the release_commits regex` for every member. The consequence is that downstream is still exposed. The PUBLISHED crates declare the old requirements: memf-windows 0.4.4 yara-x ^0.12 -> wasmtime 26.0.1, 18 advisories memf-strings 0.2.2 yara-x ^0.12 -> same memf-core 0.2.5 lru ^0.16 -> below the patched 0.18.2 memf-format 0.3.1 lru ^0.16 -> same `4n6mount` and `issen` consume those published crates, so nothing reaches them until these four are republished. This bump is what makes release-plz's `release` job publish them: it ships any library whose version is ahead of crates.io, regardless of commit type. Bump levels are chosen from whether the dependency is reachable through each crate's PUBLIC API, checked by reading every occurrence rather than by a pattern match: - memf-windows 0.4.4 -> 0.5.0 (MINOR — breaking under 0.x). `pub fn scan_yara(reader, ps_head_vaddr, rules: &yara_x::Rules, ...)` takes a yara-x type across the API boundary. A caller holding a `Rules` built by yara-x 0.12 cannot pass it to a signature expecting 1.7, so this is a breaking change and a patch bump would have shipped it silently. - memf-core 0.2.5 -> 0.2.6, memf-format 0.3.1 -> 0.3.2, memf-strings 0.2.2 -> 0.2.3 (PATCH). In each, the dependency is held behind a private field — `tlb_cache`, `cache`, `rules` — and no public signature mentions it. The compiled dependency set changes; the API does not. The workspace's path-dep declarations move with them: they pin exact versions (`memf-windows = { version = "0.4.4", path = ... }`), and `^0.4.4` cannot match 0.5.0, so leaving them would break the build rather than merely lag. `chore(release):` is deliberate. `release_commits` excludes chore, so this does not trigger a second version bump on top of this one, while the `release` job still publishes on the version-ahead-of-crates.io rule. Verified: `cargo update -w` moves all four in the lock, and `cargo check --workspace --all-features --all-targets` is clean. KNOWN GAP, deliberately not fixed here: published `memf-carve 0.1.5` requires `memf-windows ^0.4` and so cannot resolve 0.5.0. Nothing downstream of this repo currently consumes memf-carve, so it is left for its own release rather than widened blind in a security bump. --- Cargo.lock | 8 ++++---- Cargo.toml | 8 ++++---- crates/memf-core/Cargo.toml | 2 +- crates/memf-format/Cargo.toml | 2 +- crates/memf-strings/Cargo.toml | 2 +- crates/memf-windows/Cargo.toml | 2 +- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 46817be..01e1f2c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1980,7 +1980,7 @@ dependencies = [ [[package]] name = "memf-core" -version = "0.2.5" +version = "0.2.6" dependencies = [ "bytemuck", "lru", @@ -2010,7 +2010,7 @@ dependencies = [ [[package]] name = "memf-format" -version = "0.3.1" +version = "0.3.2" dependencies = [ "flate2", "goblin", @@ -2051,7 +2051,7 @@ dependencies = [ [[package]] name = "memf-strings" -version = "0.2.2" +version = "0.2.3" dependencies = [ "aho-corasick", "inventory", @@ -2077,7 +2077,7 @@ dependencies = [ [[package]] name = "memf-windows" -version = "0.4.4" +version = "0.5.0" dependencies = [ "aes 0.8.4", "aes-gcm", diff --git a/Cargo.toml b/Cargo.toml index 4506885..852098c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -30,13 +30,13 @@ shellitem = "0.2" # its in-memory prefetch carve to this fleet crate. prefetch-core = "0.1" # Internal (version + path: path drives local dev, version is used on publish). -memf-format = { version = "0.3.1", path = "crates/memf-format" } -memf-strings = { version = "0.2.2", path = "crates/memf-strings" } +memf-format = { version = "0.3.2", path = "crates/memf-format" } +memf-strings = { version = "0.2.3", path = "crates/memf-strings" } memf-symbols = { version = "0.2.4", path = "crates/memf-symbols" } -memf-core = { version = "0.2.5", path = "crates/memf-core" } +memf-core = { version = "0.2.6", path = "crates/memf-core" } memf-linux = { version = "0.3.3", path = "crates/memf-linux" } memf-session = { version = "0.3.3", path = "crates/memf-session" } -memf-windows = { version = "0.4.4", path = "crates/memf-windows" } +memf-windows = { version = "0.5.0", path = "crates/memf-windows" } memf-correlate = { version = "0.3.1", path = "crates/memf-correlate" } memf-carve = { version = "0.1.5", path = "crates/memf-carve" } # Fleet carving contract + single-pass sweep engine. diff --git a/crates/memf-core/Cargo.toml b/crates/memf-core/Cargo.toml index 7a61369..ff82f42 100644 --- a/crates/memf-core/Cargo.toml +++ b/crates/memf-core/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "memf-core" -version = "0.2.5" +version = "0.2.6" description = "Virtual address translation and kernel object reading for memory forensics" edition.workspace = true rust-version.workspace = true diff --git a/crates/memf-format/Cargo.toml b/crates/memf-format/Cargo.toml index ae2af4b..2f21e37 100644 --- a/crates/memf-format/Cargo.toml +++ b/crates/memf-format/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "memf-format" -version = "0.3.1" +version = "0.3.2" description = "Physical memory dump format parsers for the memf forensics framework" edition.workspace = true rust-version.workspace = true diff --git a/crates/memf-strings/Cargo.toml b/crates/memf-strings/Cargo.toml index e587208..05b0fe4 100644 --- a/crates/memf-strings/Cargo.toml +++ b/crates/memf-strings/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "memf-strings" -version = "0.2.2" +version = "0.2.3" description = "String extraction, classification, and YARA-X scanning for memory forensics" edition.workspace = true rust-version = "1.88" diff --git a/crates/memf-windows/Cargo.toml b/crates/memf-windows/Cargo.toml index e00a877..4cf7b6e 100644 --- a/crates/memf-windows/Cargo.toml +++ b/crates/memf-windows/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "memf-windows" -version = "0.4.4" +version = "0.5.0" description = "Windows kernel memory forensic walkers (processes, threads, drivers, DLLs)" edition.workspace = true rust-version = "1.88"