Skip to content

chore(release): prepare AeroFTP 4.2.5 - #1401

Merged
axpnet merged 5 commits into
mainfrom
codex/release-425-final-integration
Oct 28, 2026
Merged

axpnet merged 5 commits into
mainfrom
codex/release-425-final-integration

Conversation

@axpnet

@axpnet axpnet commented Oct 27, 2026 •

Copy link
Copy Markdown
Member

Release preparation for AeroFTP 4.2.5 on top of current main.

  • Consumes the published AeroVault 0.6.8 library (exclusive temporary vault files, preserved Unix permissions).
  • CHANGELOG and AppStream: record the security changes merged for 4.2.5 (credential ownership, Filen share links, peer-l0 lockfile, S3 endpoint and multipart, Internxt staging) and move the release date to 2026-10-28.
  • CHANGELOG Security: pre-tag commit audit PASS.

Full local release gate on 1616b53 (this head adds only the CHANGELOG audit line): 7871 Rust tests and 2782 frontend tests pass, Clippy --all-features --tests -D warnings for the library and the CLI, ci:pre-push (fmt, typecheck, i18n 47/47 with 0 placeholders, default Clippy, cargo audit) clean. The tag follows only after main CI is green on Linux, Windows and macOS.

Summary by CodeRabbit

  • Security
    • Improved protection for vault replacement, file permissions, and credential isolation on shared devices.
    • Strengthened safeguards for remote downloads, S3 operations, and signed requests to configured service endpoints.
    • Disabled Filen share-link creation until per-share encryption is available.
    • Improved privacy for decrypted Internxt downloads by keeping temporary files private.
  • Documentation
    • Updated the 4.2.5 release date to October 28, 2026, and expanded the security notes.

Session: L1 01a17776
Signed-off-by: axpnet <45786925+axpnet@users.noreply.github.com>
Session: L1 01a17776
Signed-off-by: axpnet <45786925+axpnet@users.noreply.github.com>
Session: L1 016retSy
Signed-off-by: axpnet <45786925+axpnet@users.noreply.github.com>
CHANGELOG and AppStream list the credential ownership, Filen share-link, peer lockfile, S3 endpoint, S3 multipart and Internxt staging fixes merged for 4.2.5, and the release date moves to 2026-10-28, the earliest publication day.

Session: L1 016retSy
Signed-off-by: axpnet <45786925+axpnet@users.noreply.github.com>
The pre-tag commit audit passed on the release candidate 1616b53: lane review of every commit since 4.2.4, a delta counter-review with exact-head evidence, and the full local gate (7871 Rust and 2782 frontend tests, all-features Clippy for the library and the CLI, complete locales, clean dependency audit). Deferred items are tracked for 4.2.6.

Session: L1 016retSy
Signed-off-by: axpnet <45786925+axpnet@users.noreply.github.com>
@snyk-io

snyk-io Bot commented Oct 27, 2026

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 5ad3be2c-b7b4-44e3-b586-934cc7c061ce
Commits

Reviewing files that changed from the base of the PR and between 1dcb419 and 60c440e.

Files ignored due to path filters: 1
  • src-tauri/Cargo.lock is excluded by !**/*.lock
Files selected for processing: 3
  • CHANGELOG.md
  • app.aeroftp.AeroFTP.metainfo.xml
  • src-tauri/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Recent review details
Context from checks skipped due to timeout: 19
  • GitHub Check: Socket Security: Pull Request Alerts
  • GitHub Check: build-and-release (windows-latest, windows)
  • GitHub Check: build-and-release (macos-15, macos, x64)
  • GitHub Check: build-and-release (macos-15, macos, aarch64)
  • GitHub Check: build-and-release (ubuntu-22.04, linux)
  • GitHub Check: linux-validate
  • GitHub Check: check + clippy + mock suite
  • GitHub Check: smoke (macos-latest, ./target/release/aeroftp-cli)
  • GitHub Check: smoke (windows-2022, ./target/release/aeroftp-cli.exe)
  • GitHub Check: The module compiles as its own crate (ubuntu-24.04)
  • GitHub Check: The module compiles as its own crate (macos-15)
  • GitHub Check: smoke (ubuntu-latest, ./target/release/aeroftp-cli)
  • GitHub Check: The module compiles as its own crate (windows-latest)
  • GitHub Check: Format, audit & unit tests
  • GitHub Check: Check sign-off
  • GitHub Check: clippy + unit suite (proton-native)
  • GitHub Check: SFTP rsync fixture + live test (key-auth)
  • GitHub Check: Windows cross-OS build + native unit tests
  • GitHub Check: SFTP password-only fixture + fallback contract
Additional context used
LanguageTool
CHANGELOG.md

[grammar] ~54-~54: Ensure spelling is correct
Context: ...cy owner, OAuth and Jottacloud tokens), Filen share links, S3 request authority and e...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

[grammar] ~59-~59: Ensure spelling is correct
Context: ...luding imports and exports (#1394). - **Filen share-link creation is disabled until p...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

Additional comments: 4
src-tauri/Cargo.toml: 1

272-272: LGTM!

CHANGELOG.md: 2

8-8: LGTM!

54-63: LGTM!

app.aeroftp.AeroFTP.metainfo.xml: 1

149-149: LGTM!

Also applies to: 157-157

Walkthrough

The AeroFTP 4.2.5 release date and notes are updated. The changelog records security audit results, and the AeroVault dependency requirement changes from 0.6.7 to 0.6.8.

Changes: Release preparation

Layer / File(s) Summary
Dependency and release notes
src-tauri/Cargo.toml, CHANGELOG.md, app.aeroftp.AeroFTP.metainfo.xml
The AeroVault requirement changes to 0.6.8. The release date changes to October 28, 2026, and release notes add security audit results and related protections.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Possibly related issues

  • axpdev-lab/aeroftp#1318 — Tracks the 4.2.5 release that this pull request prepares.

Possibly related PRs

  • axpdev-lab/aeroftp#1391 — Both pull requests update AeroFTP 4.2.5 release metadata and the AeroVault dependency.
  • axpdev-lab/aeroftp#1367 — This pull request records audit changes that include safe download targets and multipart-copy limits.
  • axpdev-lab/aeroftp#1395 — This pull request records the disabled Filen share-link creation change in release notes.
Merge Risk: Minimal · up to 60c44

The dependency and release metadata updates are ready to merge subject to normal checks.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title "chore(release): prepare AeroFTP 4.2.5" names the main change: preparing the 4.2.5 release. The changeset updates the CHANGELOG and AppStream metainfo with 4.2.5 security entries and the rel…
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title "chore(release): prepare AeroFTP 4.2.5" names the main change: preparing the 4.2.5 release. The changeset updates the CHANGELOG and AppStream metainfo with 4.2.5 security entries and the release date (2026-10-27 to 2026-10-28), and bumps the aerovault dependency from 0.6.7 to 0.6.8 in src-tauri/Cargo.toml. The title is concise, specific, and follows a conventional-commit style. It does not mention the dependency bump or the security notes, but it does not need to cover every detail.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedcargo/​aerovault@​0.6.7 ⏵ 0.6.8841009310070

View full report

@axpnet
axpnet merged commit 764bd0b into main Oct 28, 2026
29 checks passed
@axpnet
axpnet deleted the codex/release-425-final-integration branch October 28, 2026 01:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant