Merge pull request #676 from jmt-lab/release/0.21.0

Release 0.21.0

Author: jmt-lab

CHANGELOG.md

@@ -9,18 +9,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 [unreleased]: https://github.com/bottlerocket-os/twoliter/compare/v0.20.0...HEAD
 
-## [0.21.0-rc1] - 2026-06-17
+## [0.21.0] - 2026-06-19
 
 ### Added
 * Support for vendoring dependencies of rust packages ([#674])
 
+### Changed
+* pubsys/update-metadata: migrate from `chrono` to `jiff` for date/time handling ([#676])
+  * **Behavioral change:** RFC 3339 date strings now require zero-padded month and day (e.g. `2019-08-06T15:00:00Z`, not `2019-8-06T15:00:00Z`). Affects manifest deserialization in `update-metadata` and `--expiration-limit` / `--release-start-time` arguments to `pubsys`.
+  * **Behavioral change:** absolute timestamps and computed expirations are now bounded to the year ±9999 range supported by `jiff::Timestamp`. Offsets that would push past this bound (e.g. `"in 5000000 weeks"`) now return an error instead of being accepted. Production expiration policies (weeks/days) are unaffected.
+
 ### Build
 * Update coldsnap to 0.11 (#[675])
 * Update reqwest to 0.13 (#[675])
 * Update cargo dependencies (#[675])
+* Update `tough` to 0.23, `tough-kms` to 0.15, `tough-ssm` to 0.18, `tuftool` to 0.16 ([#676])
 
 [#674]: https://github.com/bottlerocket-os/twoliter/pull/674
 [#675]: https://github.com/bottlerocket-os/twoliter/pull/675
+[#676]: https://github.com/bottlerocket-os/twoliter/pull/676
 
 [0.21.0-rc1]: https://github.com/bottlerocket-os/twoliter/compare/v0.20.0...v0.21.0-rc1
 

Cargo.lock

@@ -81,7 +81,7 @@ testsys = { version = "0.1", path = "tools/testsys", artifact = [ "bin:testsys"
 testsys-config = { version = "0.1", path = "tools/testsys-config" }
 testsys-model = { version = "0.0.16", git = "https://github.com/bottlerocket-os/bottlerocket-test-system", tag = "v0.0.16" }
 
-twoliter = { version = "0.21.0-rc1", path = "twoliter", artifact = [ "bin:twoliter" ] }
+twoliter = { version = "0.21.0", path = "twoliter", artifact = [ "bin:twoliter" ] }
 twoliter-tool-advisory-checker = { version = "0.1", path = "twoliter/src/tool-crates/advisory-checker" }
 twoliter-tool-buildsys = { version = "0.1", path = "twoliter/src/tool-crates/buildsys" }
 twoliter-tool-embedded-bundle = { version = "0.1", path = "twoliter/src/tool-crates/embedded-bundle" }
@@ -117,7 +117,6 @@ bit_field = "0.10"
 bon = "3"
 bounded-integer = "0.5"
 bytes = "1"
-chrono = { version = "0.4", default-features = false }
 clap = "4"
 coldsnap = { version = "0.11", default-features = false }
 crc32fast = "1"
@@ -140,6 +139,7 @@ hex-literal = "1"
 home = "0.5"
 indicatif = "0.18"
 inotify = "0.11"
+jiff = { version = "0.2", features = ["serde"] }
 lazy_static = "1"
 libc = "0.2"
 log = "0.4"
@@ -183,11 +183,11 @@ tokio = "1"
 tokio-stream = "0.1"
 tokio-retry = "0.3"
 toml = "0.9"
-tough = "0.22"
-tough-kms = "0.14"
-tough-ssm = "0.17"
+tough = "0.23"
+tough-kms = "0.15"
+tough-ssm = "0.18"
 tracing = "0.1"
-tuftool = { version = "0.15", artifact = [ "bin:tuftool" ] }
+tuftool = { version = "0.16", artifact = [ "bin:tuftool" ] }
 uds = "0.4"
 unescape = "0.1"
 url = "2"

Cargo.toml

@@ -71,9 +71,6 @@ skip = [
     { name = "darling" },
     { name = "darling_core" },
     { name = "darling_macro" },
-    # tough has not been bumped to reqwest 0.13 yet, we have a tough release in near future
-    # that will fix this.
-    { name = "reqwest" },
 ]
 
 skip-tree = [

deny.toml

@@ -9,5 +9,5 @@ publish = false
 exclude = ["README.md"]
 
 [dependencies]
-chrono = { workspace = true, features = ["clock", "std"] }
+jiff = { workspace = true }
 snafu = { workspace = true, features = ["backtraces-impl-backtrace-crate"] }