From 64bc0d6346ac56e5640dbf6031ffcc7d5d500aba Mon Sep 17 00:00:00 2001 From: y_takino <36617106+tappe9@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:06:01 +0900 Subject: [PATCH 1/4] docs: refresh security support policy --- SECURITY.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index cd7b5a0..de7673d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,12 @@ ZstdScope parses untrusted binary input, so parser safety is a core project requ ## Supported versions -ZstdScope is currently pre-release and has no supported published version yet. This section will be updated when releases begin. +ZstdScope is pre-1.0. Only the latest published pre-1.0 release receives security fixes. Older pre-1.0 releases become unsupported when a newer release is published. + +| Release | Security fixes | +| --- | --- | +| Latest published pre-1.0 release | Yes | +| Older pre-1.0 releases | No | ## Reporting a vulnerability @@ -38,7 +43,9 @@ Security-sensitive parser properties include: ## Fuzzing -Fuzz testing is planned as part of the parser's quality strategy. The baseline invariant is: +Fuzz testing is available as a manual developer workflow through `cargo-fuzz`; see [FUZZING.md](FUZZING.md). It is intentionally not part of normal pull-request CI. + +The baseline invariant is: ```text any byte sequence -> successful inspection or typed error, never panic From 1147799bb1a82594801f2ff6e017face2e68e95f Mon Sep 17 00:00:00 2001 From: y_takino <36617106+tappe9@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:06:17 +0900 Subject: [PATCH 2/4] docs: refresh roadmap after v0.1.0 --- ROADMAP.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/ROADMAP.md b/ROADMAP.md index 93c29fd..b2cead8 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -4,7 +4,7 @@ This roadmap is directional. Milestones may change as implementation and specifi ## v0.1 — Structural inspector MVP -Status: **implemented; final integration review tracked in #14.** +Status: **completed and released as v0.1.0.** Goal: provide a safe Pure Rust parser for top-level Zstandard structure plus a usable CLI. @@ -44,13 +44,19 @@ The parser's malformed-input safety invariant is covered by targeted boundary an ## v0.2 — Inspector ergonomics and robustness -Candidate scope: +Status: **in progress on `main`; not yet released.** + +Already implemented on `main` after v0.1.0: -- richer field-level spans for hex-view mapping; - configurable parser resource limits; +- a manual `cargo-fuzz` target with structural model-invariant checks on successful parses. + +Remaining candidate scope: + +- richer field-level spans for hex-view mapping; - more detailed diagnostics; - streaming or file-backed inspection API for very large files; -- initial fuzzing in continuous integration or OSS-Fuzz-compatible structure; +- scheduled or continuous fuzzing automation; - JSON schema documentation; - CLI output refinements. @@ -112,4 +118,4 @@ Potential criteria: ## Guiding rule -Prefer small, independently useful milestones. Do not turn ZstdScope into a decompressor merely because deeper inspection eventually requires understanding decoder structures. +Prefer small, independently useful milestones. Do not turn ZstdScope into a decompressor merely because deeper inspection eventually requires understanding decoder structures cleanly. From 28ba7aba200a924f7c599c94106fc244ebcae0c2 Mon Sep 17 00:00:00 2001 From: y_takino <36617106+tappe9@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:06:38 +0900 Subject: [PATCH 3/4] docs: mark v0.1 review as historical --- docs/V0.1-INTEGRATION-REVIEW.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/V0.1-INTEGRATION-REVIEW.md b/docs/V0.1-INTEGRATION-REVIEW.md index b966dcb..a4ae370 100644 --- a/docs/V0.1-INTEGRATION-REVIEW.md +++ b/docs/V0.1-INTEGRATION-REVIEW.md @@ -1,5 +1,7 @@ # v0.1 Integration Review +> **Historical record:** This document captures the pre-v0.1.0 release-readiness review. v0.1.0 has since been published. Future-tense release statements below are retained as historical context; current release and support status is documented in `README.md`, `README.ja.md`, `ROADMAP.md`, and `SECURITY.md`. + This document records the v0.1 Structural Inspector integration review and the release-blocker remediation that followed the repository-wide code review in Issue #31. Original Issue #14 review base: `dd1968620e076d770e727e52e8c9b5f0ec641ff4`. From bb07f43a423b29aa2a2ab9d394c75785fff3833e Mon Sep 17 00:00:00 2001 From: y_takino <36617106+tappe9@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:07:19 +0900 Subject: [PATCH 4/4] docs: keep roadmap diff focused --- ROADMAP.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ROADMAP.md b/ROADMAP.md index b2cead8..b8e033c 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -118,4 +118,4 @@ Potential criteria: ## Guiding rule -Prefer small, independently useful milestones. Do not turn ZstdScope into a decompressor merely because deeper inspection eventually requires understanding decoder structures cleanly. +Prefer small, independently useful milestones. Do not turn ZstdScope into a decompressor merely because deeper inspection eventually requires understanding decoder structures.