Skip to content

Release endpoint-libs 3.0.1 with secret-safe WebSocket logs - #47

Merged
pathscale merged 5 commits into
masterfrom
fix/redact-ws-debug-secrets
Sep 13, 2026
Merged

pathscale merged 5 commits into
masterfrom
fix/redact-ws-debug-secrets

Conversation

@pathscale

@pathscale pathscale commented Sep 13, 2026

Copy link
Copy Markdown
Owner

This prepares endpoint-libs 3.0.1; crates.io already contains 3.0.0, so the corrected artifact needs a new patch version.

WebSocket transport logging exposed complete request and response bodies, authentication protocol headers, public error parameters, and handshake URIs. This keeps useful request metadata while logging only method, sequence, byte counts, status, and parameter counts; unexpected frames are also reported by kind without formatting their payload.

The repository now follows the fleet no-lockfile policy. The stale npm lockfile is removed and generated lockfiles are ignored. The remaining package.json and tsconfig.json were not an active JavaScript surface: they existed only for a Cloudflare Containers example whose Worker source and Wrangler config are already absent. That dead toolchain and its stale README instructions are removed; endpoint-libs remains a Rust workspace and has no Cloudflare Workers dependency. The unrelated root Dockerfile that tried to build a nonexistent library binary is also removed. The disabled, never-working Docker/Fly bundle is removed as well: it disagreed on ports and certificate handling, referenced a removed feature, and had no live deployment target. The functional local ws_echo_server example remains. Release tooling now allows the repository’s actual default master branch.

Validation:

  • cargo fmt --check
  • cargo clippy --all-targets --all-features -- -D warnings
  • cargo test --all-features (106 unit, 5 transport integration, 0 failed; 2 doctests ignored)
  • scripts/check-chain.sh --quick (the only reported inconsistency is an unrelated local EndpointValidator worktree resolving two endpoint-libs copies; remote EndpointValidator PR 6 does not contain that dependency state)
  • local example build: cargo build --release --example ws_echo_server --features ws
  • release-script shell syntax and default-branch configuration
  • no tracked Cargo lockfile or JavaScript package surface remains

No crate release or deployment is included. After owner review and merge, the existing release script must be run with --skip-bump so it publishes the reviewed 3.0.1 manifest instead of advancing to 3.0.2.

@pathscale pathscale changed the title fix(ws): redact credentials and message bodies from logs Release endpoint-libs 3.0.1 with secret-safe WebSocket logs Sep 13, 2026
@pathscale
pathscale merged commit 9b2cec2 into master Sep 13, 2026
4 checks passed
@pathscale
pathscale deleted the fix/redact-ws-debug-secrets branch September 13, 2026 07:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant