Skip to content

docs: record 4.0.1 and 4.0.2, and prepare the 4.0.3 release - #79

Merged
kurok merged 1 commit into
mainfrom
release/v4.0.3
Sep 18, 2026
Merged

kurok merged 1 commit into
mainfrom
release/v4.0.3

Conversation

@kurok

@kurok kurok commented Sep 18, 2026

Copy link
Copy Markdown

Prepares the v4.0.3 release, and repairs a CHANGELOG that had drifted from the tags.

The drift

The CHANGELOG had no 4.0.1 or 4.0.2 sections at all — both shipped in July and were recorded only on the releases page. Worse, the [Unreleased] block still described the warm-restart registration race (#67), which had already gone out in 4.0.2. The file claimed as unreleased something that had been in users' hands for two months.

This adds both missing sections (moving the #67 entry into 4.0.2, where it shipped) and writes 4.0.3.

What is in 4.0.3

Eight commits since v4.0.2, all patch-level — no input, output or behaviour change:

Fixed default actions/runner → 2.337.0 (#70, #75)
Security Dependabot + code-scanning sweep (#74) — js-yaml 3.14.2→3.15.1 and least-privilege workflow permissions; undici 6.28.0 (#71); brace-expansion (#72)
Documentation security policy (#73)
Internal dev-dep bumps browserslist (#77), js-yaml (#78)

Also needs doing at tag time

The moving v4 tag is stale. It points at c5db9f0 — the v4.0.0 docs commit — so it is three commits behind even the v4.0.0 release, and misses 4.0.1 and 4.0.2 entirely. Anyone pinning @v4 has been running v4.0.0 code without the warm-restart user-data fix (#66), the registration-race fix (#67) or the mode: stop fix (#69).

That contradicts this file's own stated rule: "The moving major tag (e.g. v4) always points at the latest release in that major line." I will move v4 to the v4.0.3 tag once this merges.

Verification

  • npm ci clean, npm run lint clean, npm test — 245 passing
  • npm run package — rebuilt dist/ is byte-identical to what is committed, so this release ships no bundle change

The CHANGELOG had no 4.0.1 or 4.0.2 sections: both shipped in July but only
the releases page recorded them, and the [Unreleased] block still described
#67 — which had already gone out in 4.0.2. So the file said the opposite of
what the tags said.

This adds the two missing sections (moving the #67 entry into 4.0.2 where it
belongs) and writes 4.0.3 for the eight commits since: two runner-version
bumps, the Dependabot/code-scanning sweep in #74, three dependency bumps and
the security policy. All patch-level — no input, output or behaviour change.

dist/ is unchanged: verified by rebuilding with `npm run package` against a
clean `npm ci`, byte-identical to what is committed. 245 tests pass, lint
clean.

Signed-off-by: kurok <22548029+kurok@users.noreply.github.com>
@kurok
kurok merged commit ef48110 into main Sep 18, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant