Skip to content

chore(release): prepare 0.88.0 #391

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fylorn merged 1 commit into from
Nov 1, 2026
Merged

chore(release): prepare 0.88.0 #391

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 22 additions & 22 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ categories = ["network-programming", "web-programming::http-server"]

# 二进制走 CalVer，crate 走 SemVer —— 两者是两回事，卖给不同的人。
# 这里是 crate 的版本。
version = "0.87.1"
version = "0.88.0"

[workspace.dependencies]
# ── 内部 crate ───────────────────────────────────────────
Expand Down
15 changes: 15 additions & 0 deletions release-notes/0.88.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
This release expands outbound privacy filtering to UUIDs, wallet secrets, trading credentials and blockchain account identifiers. The built-in catalog grows from 120 to 131 rules, with 102 enabled by default.

**Upgrade notes**

- The control-plane protocol stays at 58 and the request-store schema stays at 28. Existing configurations remain valid.
- The 11 new rules default to placeholder replacement. In `observe` mode they only record findings; in `enforce` mode they replace matching text unless a rule has been disabled or set to record only.
- UUIDs include ordinary order and trace IDs, and compact 32-character hexadecimal values also include MD5-shaped identifiers. The raw 64-character hex rule covers both wallet private keys and indistinguishable transaction hashes. Existing installations using `enforce` will therefore hide more identifiers after upgrading.

**Wallet material.** Adds raw EVM/TRON private-key shapes, verified Solana Ed25519 keypairs in Base58 or pasted byte-array form, Sui Bech32 private keys, Stellar secret seeds and XRP family seeds. Expands BIP32 / SLIP-0132 extended private keys to all ten supported versions and validates their private payloads. Existing BIP39 recovery-phrase, WIF and PEM rules remain available.

**Trading credentials.** Named fields and authentication headers protect opaque keys, secrets, passphrases, signing memos, OTPs and signatures used by major exchanges, Polymarket CLOB/Builder/Relayer and predict.fun. These rules use context rather than assuming a fixed key length or alphabet. Short and symbol-first passphrases, numeric credentials, escaped JSON fields, recovery arrays, YAML recovery blocks, keystores and known RPC URL credentials are covered.

**Account privacy and reporting.** Blockchain addresses and extended public keys have a separate privacy rule. UUIDs, raw hashes and public accounts do not by themselves trigger credential-exfiltration blocking. Findings for wallet secrets and the new credential-field rules are fully masked. Saved-secret priority, per-rule actions, exceptions, reversible and streamed restoration, and scan-cache equivalence are preserved.

Filtering keeps the existing protocol and JSON boundaries. Keypair arrays are protected when pasted as text; actual JSON numeric values and protocol metadata retain their existing treatment. Coverage and limits are listed in the [blockchain redaction reference](https://github.com/ThinkWatchProject/ThinkWatch-Core/blob/v0.88.0/docs/security/blockchain-redaction.zh-CN.md).
Loading