diff --git a/CHANGELOG.md b/CHANGELOG.md index 92e926f..e671ae7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,47 @@ binary wire format may change in breaking ways across `0.x` minor versions. See ## [Unreleased] +## [1.0.2] — 2026-08-19 + +Security patch. **No wire-format change and no public API change** — every 1.0.1 envelope decodes +identically; a drop-in over 1.0.1. + +### Security + +- **`System.Security.Cryptography.Xml` 8.0.3 → 8.0.4.** 8.0.3 is affected by five published + HIGH-severity advisories, all first patched in 8.0.4: + [GHSA-23rf-6693-g89p](https://github.com/advisories/GHSA-23rf-6693-g89p) (CVE-2026-50648), + [GHSA-8q5v-6pqq-x66h](https://github.com/advisories/GHSA-8q5v-6pqq-x66h) (CVE-2026-50525), + [GHSA-cvvh-rhrc-wg4q](https://github.com/advisories/GHSA-cvvh-rhrc-wg4q) (CVE-2026-47302), + [GHSA-g8r8-53c2-pm3f](https://github.com/advisories/GHSA-g8r8-53c2-pm3f) (CVE-2026-47304) and + [GHSA-mmjf-rqrv-855v](https://github.com/advisories/GHSA-mmjf-rqrv-855v) (CVE-2026-50527). + + `PostQuantum.DataProtection` 1.0.1 declares this as a **direct** dependency, and `.Aws`, + `.AzureKeyVault`, `.Cli`, `.Fips`, `.OpenTelemetry`, `.Redis` and `.Testing` all depend on the + core package, so all eight published packages resolved the vulnerable version. Upgrading is + recommended for every consumer. + + 8.0.4 stays inside the 8.0.x line and ships `lib/net8.0`, so the `net8.0;net9.0;net10.0` target + set is unchanged. Note the 10.x line is only patched in **10.0.10** — 10.0.9 is still affected. + +### Fixed + +- **CI restore no longer fails on `NU1903`.** The vulnerability above was raised as an error by + `NuGetAudit`, so `build-and-test` failed at the restore step on every main commit from + 2026-06-04 onward — including the commits tagged `Release 1.0.0` and `Release 1.0.1`. The build + now proceeds to test and coverage. + +### Changed + +- **ML-KEM-dependent tests skip on hosts without the primitive**, via a new `PqcFact` / + `PqcTheory` attribute, rather than failing with `PlatformNotSupportedException`. macOS has no + .NET 10 ML-KEM backend; 56 tests across 18 classes are affected, and the remaining 43 still run + there. +- **The Linux CI lane installs OpenSSL 3.5+ from conda-forge**, so the ML-KEM suite actually + executes on Linux rather than skipping — it reports 108 passed, 0 skipped. A zero-skip gate on + the Linux and Windows lanes now fails the build if any PQ test is skipped, so a silently-skipped + crypto suite can no longer look like a passing one. + ## [1.0.1] — 2026-06-30 Patch: robustness + hygiene fixes from an external code review. **No wire-format change** — every diff --git a/README.md b/README.md index 96d8d0f..90417e4 100644 --- a/README.md +++ b/README.md @@ -312,7 +312,7 @@ run; a standalone SharpFuzz harness in `fuzz/` is set up for AFL-driven explorat ## Project status -`1.0.1` — **stable release.** The public API and the binary envelope/keypair formats are +`1.0.2` — **stable release.** The public API and the binary envelope/keypair formats are frozen at version 1 (decoders reject unknown versions and modes); SemVer is in force. Depends on the stable `PostQuantum.KeyManagement 1.0.0`. diff --git a/src/PostQuantum.DataProtection.Aws/PostQuantum.DataProtection.Aws.csproj b/src/PostQuantum.DataProtection.Aws/PostQuantum.DataProtection.Aws.csproj index b57f0c6..5c5ce2b 100644 --- a/src/PostQuantum.DataProtection.Aws/PostQuantum.DataProtection.Aws.csproj +++ b/src/PostQuantum.DataProtection.Aws/PostQuantum.DataProtection.Aws.csproj @@ -11,7 +11,7 @@ PostQuantum.DataProtection.Aws - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark diff --git a/src/PostQuantum.DataProtection.AzureKeyVault/PostQuantum.DataProtection.AzureKeyVault.csproj b/src/PostQuantum.DataProtection.AzureKeyVault/PostQuantum.DataProtection.AzureKeyVault.csproj index ca0c37d..b915f05 100644 --- a/src/PostQuantum.DataProtection.AzureKeyVault/PostQuantum.DataProtection.AzureKeyVault.csproj +++ b/src/PostQuantum.DataProtection.AzureKeyVault/PostQuantum.DataProtection.AzureKeyVault.csproj @@ -12,7 +12,7 @@ PostQuantum.DataProtection.AzureKeyVault - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark diff --git a/src/PostQuantum.DataProtection.Fips/PostQuantum.DataProtection.Fips.csproj b/src/PostQuantum.DataProtection.Fips/PostQuantum.DataProtection.Fips.csproj index 5758ad4..ffdec88 100644 --- a/src/PostQuantum.DataProtection.Fips/PostQuantum.DataProtection.Fips.csproj +++ b/src/PostQuantum.DataProtection.Fips/PostQuantum.DataProtection.Fips.csproj @@ -11,7 +11,7 @@ PostQuantum.DataProtection.Fips - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark diff --git a/src/PostQuantum.DataProtection.OpenTelemetry/PostQuantum.DataProtection.OpenTelemetry.csproj b/src/PostQuantum.DataProtection.OpenTelemetry/PostQuantum.DataProtection.OpenTelemetry.csproj index 63ecd4d..7c39a2c 100644 --- a/src/PostQuantum.DataProtection.OpenTelemetry/PostQuantum.DataProtection.OpenTelemetry.csproj +++ b/src/PostQuantum.DataProtection.OpenTelemetry/PostQuantum.DataProtection.OpenTelemetry.csproj @@ -11,7 +11,7 @@ PostQuantum.DataProtection.OpenTelemetry - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark diff --git a/src/PostQuantum.DataProtection.Redis/PostQuantum.DataProtection.Redis.csproj b/src/PostQuantum.DataProtection.Redis/PostQuantum.DataProtection.Redis.csproj index 2154329..d3ddb7c 100644 --- a/src/PostQuantum.DataProtection.Redis/PostQuantum.DataProtection.Redis.csproj +++ b/src/PostQuantum.DataProtection.Redis/PostQuantum.DataProtection.Redis.csproj @@ -11,7 +11,7 @@ PostQuantum.DataProtection.Redis - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark diff --git a/src/PostQuantum.DataProtection.Testing/PostQuantum.DataProtection.Testing.csproj b/src/PostQuantum.DataProtection.Testing/PostQuantum.DataProtection.Testing.csproj index 8ab2401..22bd2c3 100644 --- a/src/PostQuantum.DataProtection.Testing/PostQuantum.DataProtection.Testing.csproj +++ b/src/PostQuantum.DataProtection.Testing/PostQuantum.DataProtection.Testing.csproj @@ -11,7 +11,7 @@ PostQuantum.DataProtection.Testing - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark diff --git a/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj b/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj index 9e56bdf..9efa197 100644 --- a/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj +++ b/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj @@ -23,13 +23,13 @@ PostQuantum.DataProtection - 1.0.1 + 1.0.2 1.0.0.0 - 1.0.1.0 + 1.0.2.0 Paul Clark Systems Librarian PostQuantum.DataProtection diff --git a/tools/PostQuantum.DataProtection.Cli/PostQuantum.DataProtection.Cli.csproj b/tools/PostQuantum.DataProtection.Cli/PostQuantum.DataProtection.Cli.csproj index 6dff344..559d111 100644 --- a/tools/PostQuantum.DataProtection.Cli/PostQuantum.DataProtection.Cli.csproj +++ b/tools/PostQuantum.DataProtection.Cli/PostQuantum.DataProtection.Cli.csproj @@ -16,7 +16,7 @@ PostQuantum.DataProtection.Cli - 1.0.1 + 1.0.2 0.1.0.0 0.1.0.7 Paul Clark