diff --git a/CHANGELOG.md b/CHANGELOG.md index a97e48b2..adf76ecd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,5 @@ ### 1.6.0 ### +* :rotating_light: **Security advisory:** an unauthenticated peer could make a TCP or TLS server unavailable. Affects 0.9.0 through 1.5.0. See [GHSA-x8fh-359r-wgxm](https://github.com/stepfunc/rodbus/security/advisories/GHSA-x8fh-359r-wgxm), [#213](https://github.com/stepfunc/rodbus/pull/213) and [#214](https://github.com/stepfunc/rodbus/pull/214). * :shield: **Hardened against panics.** Lints deny common sources of panics, and CI proves that parsing, answering requests and formatting replies can't panic for any input. * :bell: **License update.** The license now prohibits using the library to build or test other implementations of the protocol, including by mining it with AI tools or using it as an oracle, and reserves AI training. See [#224](https://github.com/stepfunc/rodbus/pull/224). * :bell: **`MinTlsVersion` is a minimum.** `V1_2` now allows TLS 1.3, and `V1_3` no longer allows TLS 1.2. See [#212](https://github.com/stepfunc/rodbus/pull/212). diff --git a/Cargo.lock b/Cargo.lock index fcc236de..e2a74dfd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1113,7 +1113,7 @@ dependencies = [ [[package]] name = "rodbus" -version = "1.6.0-RC2" +version = "1.6.0" dependencies = [ "crc", "no-panic", @@ -1133,7 +1133,7 @@ dependencies = [ [[package]] name = "rodbus-bindings" -version = "1.6.0-RC2" +version = "1.6.0" dependencies = [ "oo-bindgen", "rodbus-schema", @@ -1155,7 +1155,7 @@ dependencies = [ [[package]] name = "rodbus-ffi" -version = "1.6.0-RC2" +version = "1.6.0" dependencies = [ "lazy_static", "num_cpus", @@ -1173,14 +1173,14 @@ dependencies = [ [[package]] name = "rodbus-ffi-c" -version = "1.6.0-RC2" +version = "1.6.0" dependencies = [ "rodbus-ffi", ] [[package]] name = "rodbus-ffi-java" -version = "1.6.0-RC2" +version = "1.6.0" dependencies = [ "jni", "oo-bindgen", @@ -1190,7 +1190,7 @@ dependencies = [ [[package]] name = "rodbus-schema" -version = "1.6.0-RC2" +version = "1.6.0" dependencies = [ "oo-bindgen", "sfio-tokio-ffi", diff --git a/SECURITY.md b/SECURITY.md index 11469e51..4c1ec71d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -39,7 +39,7 @@ To stay up to date: ## How the Library Is Hardened -The [security page](https://docs.stepfunc.io/rodbus/1.6.0-RC2/guide/docs/security) of the guide +The [security page](https://docs.stepfunc.io/rodbus/1.6.0/guide/docs/security) of the guide describes the engineering measures: memory safety, the lints that restrict sources of panics, the link-time proof that framing, request validation and the parsing of response values can't panic, bounded resources, protocol validation and the TLS trust model, and what they don't cover. diff --git a/ffi/bindings/c/CMakeLists.txt b/ffi/bindings/c/CMakeLists.txt index 457ba9bc..874503f5 100644 --- a/ffi/bindings/c/CMakeLists.txt +++ b/ffi/bindings/c/CMakeLists.txt @@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.12) project(rodbus_c LANGUAGES C CXX) -set(RODBUS_BACKUP_VERSION "1.6.0-RC2") +set(RODBUS_BACKUP_VERSION "1.6.0") # Determine the architecture if(WIN32 AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|amd64|AMD64" AND CMAKE_SIZEOF_VOID_P EQUAL 8) diff --git a/ffi/bindings/dotnet/examples/client/client.csproj b/ffi/bindings/dotnet/examples/client/client.csproj index 183ef3fc..aca745d1 100644 --- a/ffi/bindings/dotnet/examples/client/client.csproj +++ b/ffi/bindings/dotnet/examples/client/client.csproj @@ -14,7 +14,7 @@ - + diff --git a/ffi/bindings/dotnet/examples/server/server.csproj b/ffi/bindings/dotnet/examples/server/server.csproj index 183ef3fc..aca745d1 100644 --- a/ffi/bindings/dotnet/examples/server/server.csproj +++ b/ffi/bindings/dotnet/examples/server/server.csproj @@ -14,7 +14,7 @@ - + diff --git a/ffi/bindings/java/examples/pom.xml b/ffi/bindings/java/examples/pom.xml index d00a5912..41c94a67 100644 --- a/ffi/bindings/java/examples/pom.xml +++ b/ffi/bindings/java/examples/pom.xml @@ -16,7 +16,7 @@ io.stepfunc rodbus - 1.6.0-RC2 + 1.6.0 diff --git a/ffi/bindings/java/rodbus-tests/pom.xml b/ffi/bindings/java/rodbus-tests/pom.xml index bb0185b7..35c12e55 100644 --- a/ffi/bindings/java/rodbus-tests/pom.xml +++ b/ffi/bindings/java/rodbus-tests/pom.xml @@ -26,7 +26,7 @@ io.stepfunc rodbus - 1.6.0-RC2 + 1.6.0 org.junit.jupiter diff --git a/ffi/rodbus-bindings/Cargo.toml b/ffi/rodbus-bindings/Cargo.toml index 10fa0006..e3128046 100644 --- a/ffi/rodbus-bindings/Cargo.toml +++ b/ffi/rodbus-bindings/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rodbus-bindings" -version = "1.6.0-RC2" +version = "1.6.0" description = "application to generate bindings for Rodbus" readme = "../README.md" diff --git a/ffi/rodbus-ffi-c/Cargo.toml b/ffi/rodbus-ffi-c/Cargo.toml index fe0d6352..ad131d7b 100644 --- a/ffi/rodbus-ffi-c/Cargo.toml +++ b/ffi/rodbus-ffi-c/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rodbus-ffi-c" -version = "1.6.0-RC2" +version = "1.6.0" description = "C library (rodbus_ffi) for the Rodbus C, C++ and .NET bindings" readme = "../README.md" diff --git a/ffi/rodbus-ffi-java/Cargo.toml b/ffi/rodbus-ffi-java/Cargo.toml index d9758bc3..fd4d03de 100644 --- a/ffi/rodbus-ffi-java/Cargo.toml +++ b/ffi/rodbus-ffi-java/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rodbus-ffi-java" -version = "1.6.0-RC2" +version = "1.6.0" authors = ["Step Function I/O LLC "] edition = "2021" build = "build.rs" diff --git a/ffi/rodbus-ffi/Cargo.toml b/ffi/rodbus-ffi/Cargo.toml index 471d859b..88df0d1c 100644 --- a/ffi/rodbus-ffi/Cargo.toml +++ b/ffi/rodbus-ffi/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rodbus-ffi" -version = "1.6.0-RC2" +version = "1.6.0" authors = ["Step Function I/O LLC "] edition = "2021" description = "FFI for Rodbus" diff --git a/ffi/rodbus-schema/Cargo.toml b/ffi/rodbus-schema/Cargo.toml index fa4810d7..4a8bc922 100644 --- a/ffi/rodbus-schema/Cargo.toml +++ b/ffi/rodbus-schema/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "rodbus-schema" # this is the version that all the FFI libraries get, since it's in their schema -version = "1.6.0-RC2" +version = "1.6.0" description = "oobindgen schema for Rodbus" readme = "../README.md" diff --git a/guide/sitedata.json b/guide/sitedata.json index fe645fb7..73edd083 100644 --- a/guide/sitedata.json +++ b/guide/sitedata.json @@ -1,4 +1,4 @@ { - "version": "1.6.0-RC2", + "version": "1.6.0", "github_url": "https://github.com/stepfunc/rodbus" } \ No newline at end of file diff --git a/rodbus/Cargo.toml b/rodbus/Cargo.toml index 54d3c6bb..86e62423 100644 --- a/rodbus/Cargo.toml +++ b/rodbus/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rodbus" -version = "1.6.0-RC2" +version = "1.6.0" description = "A high-performance async implementation of the Modbus protocol using tokio" readme = "README.md" diff --git a/rodbus/README.md b/rodbus/README.md index 53e4c282..90258977 100644 --- a/rodbus/README.md +++ b/rodbus/README.md @@ -19,7 +19,7 @@ A high-performance implementation of the [Modbus](http://modbus.org/) protocol u Written in safe Rust, with sources of panics restricted by lints, and framing, request validation, the parsing of response values, answering requests and formatting what is sent proven panic-free at link time. See the -[security page](https://docs.stepfunc.io/rodbus/1.6.0-RC2/guide/docs/security) of the guide for +[security page](https://docs.stepfunc.io/rodbus/1.6.0/guide/docs/security) of the guide for what is enforced and proven, and what isn't covered. # Supported Modes