Skip to content

docs: update changelog since v1.0.0 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
berisher merged 4 commits into from
Mar 31, 2026
Merged

docs: update changelog since v1.0.0 #22

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fc7f695
docs: update changelog since v1.0.0
berisher Mar 31, 2026
4f5ed82
docs: split changelog into 1.0.0 and 1.0.1
berisher Mar 31, 2026
01210bd
Update CHANGELOG.md
berisher Mar 31, 2026
4921b84
Update CHANGELOG.md
berisher Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 24 additions & 4 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,30 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]
## [1.0.1] - 2026-03-31

### Added
- Release workflow provenance generation for future attested releases
- Local-binary installation support in the GitHub Action smoke path
- `--allow-persistent-ids` and corresponding generator support for opt-in `PERSID`/`BINPERSID` coverage
- Rust and Python size-budget support that keeps generated pickles within a requested byte limit

### Changed
- GitHub Action entrypoints now require explicit version selection outside immutable release tags, support safer argument handling, and validate installation inputs more strictly
- Release, CI, smoke, and fuzz workflows now pin critical actions, validate their inputs, and test the candidate build instead of implicitly trusting the latest published release
- Generator contracts now normalize opcode ranges, derive deterministic per-sample batch seeds, auto-reset between calls, and apply opcode budgets to the full emitted pickle instead of only the random body
- Python bindings and examples now follow the same generation and budget semantics as the Rust CLI
- Standard library target discovery now stores unambiguous `module<TAB>member` entries and avoids importing package trees while building the shipped catalog
- Packaging docs and metadata now reference the published crate name and Python 3.11 minor-version support correctly

### Fixed
- Python validation once again enforces the whole-file `STOP` boundary and matches the standalone validator, fuzz target, and CI harness behavior
- Stack simulation and validation now handle protocol 0/1 cleanup, MARK-aware collection operations, memo aliasing, `BUILD` identity preservation, `READONLY_BUFFER`, long sign extension, and `INT` bool decoding correctly
- Unsafe mutator handling now re-simulates post-emission rewrites, rejects unsupported rewrites, gates unsafe mutators behind `--unsafe-mutations`, and makes type-confusion rewrites protocol-aware
- Python examples no longer ship broken harness syntax, noisy parser-error logging, or sample flows that encourage unsandboxed `pickle.loads()` on generated data
- Cargo packaging metadata no longer blocks publish due to invalid keyword counts or ambiguous install instructions

## [1.0.0] - 2025-12-23

### Added
- GitHub Actions CI/CD workflows for automated testing
Expand Down Expand Up @@ -57,6 +80,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- CODE_OF_CONDUCT.md
- CONTRIBUTING.md
- Basic documentation

[Unreleased]: https://github.com/cisco-ai-defense/pickle-fuzzer/compare/v0.1.0...HEAD
[0.1.0]: https://github.com/cisco-ai-defense/pickle-fuzzer/releases/tag/v0.1.0
Loading