[chaliy]

What changed

Prepare Fetchkit 0.6.0 with published Markkit >=0.1.1, Tokio >=1.54.1, the patched PDF/TLS graph, and locked Cargo publishing. Release tags target the exact triggering commit. Preserve and document the document conversion, HTML processing, and agent discovery changes accumulated on main since 0.5.0.

Why

A root-only Markkit git patch does not protect packaged downstream consumers. The release also removes the Tokio AsyncFd unsoundness reported in RUSTSEC-2026-0386. Public API changes already on main require a minor release rather than 0.5.1.

Before / After

• Before: Markkit 0.1.0 through a workspace git override; Tokio 1.52.3. Published consumers cannot inherit the override.
• After: registry Markkit minimum 0.1.1 and Tokio minimum 1.54.1; lock includes rustls-webpki 0.103.16, webpki-roots/root-certs 1.0.10, pdf-inspector 0.1.8 and lopdf 0.42.0.
• Fresh RustSec database 84d943a6deeb8cc6c6f632531aaf4f1c62275239: zero vulnerability/unsound findings; existing unmaintained notices remain for dlopen_derive and ttf-parser. No direct AsyncFd call was found in Fetchkit; exploit reachability was not established.
• The PDF regression verifies normal return for a 10,000-level nested object. Packaged-consumer verification and full quality gates are recorded below before merge.

Risk

Medium: the release includes previously merged public API changes. Exhaustive FetchOptions literals need new fields or Default; construct DefaultFetcher with new()/default(); enable docs-office explicitly for PPTX/XLSB. See CHANGELOG.md and docs/security.md. Existing downstream locks still require updates for transitive TLS dependencies. The default HTTP client uses platform trust; OS CA package maintenance remains an operator responsibility. No Python/npm release is configured or added.

Validation

• cargo fmt --all -- --check; workspace/all-target Clippy with warnings denied.
• Workspace tests and rustdoc with warnings denied; release build of library/CLI.
• All functional core features (docs-all,docs-office,bot-auth,render-rakers): tests and Clippy passed. The external live-tests suite is not enabled by that deterministic matrix.
• CLI public-network tests: 2/2; native help/version/llmtxt and hardened MCP initialization/tool listing passed.
• Normalized .crate built and exercised by an independent consumer: HTML, registry Markkit DOCX, and deeply nested PDF. Package and fresh-consumer audits: zero vulnerabilities.
• No-default-features check; local/upstream OKF checks; repository Python script tests; actionlint passed.
• Existing CPython 3.12 ARM64 binding wheel built and installed into an isolated environment; the nine existing Python example checks passed. Python publication remains out of scope.
• Exact-head GitHub CI must pass before merge.

Checklist

• Unit tests are passed
• Smoke tests are passed
• Documentation is updated
• Knowledge is up to date and not in conflict