From 506f6576b461357efdbd0e06e986133143237f12 Mon Sep 17 00:00:00 2001 From: Mofei Zhu Date: Tue, 20 Oct 2026 18:49:39 +0300 Subject: [PATCH 1/6] Prepare 1.0.0: bump the version and state the 1.0 compatibility rules --- AGENTS.md | 4 ++-- CHANGELOG.md | 13 +++++++------ CONTRIBUTING.md | 10 +++++++--- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 8 ++++---- 6 files changed, 22 insertions(+), 17 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c99ce88..6bd8b4d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -192,8 +192,8 @@ same for the completion scripts. ## Compatibility and the changelog Command names, flags, the two output modes and the exit codes are promises; -the Mapbox APIs' own response bodies are not. The rules are in -[CONTRIBUTING.md](CONTRIBUTING.md#compatibility). +the Mapbox APIs' own response bodies, and commands marked beta, are not. The +rules are in [CONTRIBUTING.md](CONTRIBUTING.md#compatibility). [CHANGELOG.md](CHANGELOG.md) is written by hand, newest first, because the commit subject rarely explains why a change matters. A user-visible change diff --git a/CHANGELOG.md b/CHANGELOG.md index 11c1878..71fed6e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,13 @@ What changed, and what it means for scripts that already use this tool. Newest first, written by hand — the commit subject rarely explains why a change matters. -Versions follow [semantic versioning](https://semver.org/). Pre-1.0 rule: -while the version starts with `0.`, a breaking change raises the minor -number (`0.1.0` → `0.2.0`); everything else raises the patch. What counts as -breaking is [written down in CONTRIBUTING.md](CONTRIBUTING.md#compatibility) — briefly, -command names, flags, the two output modes and the exit codes are promises; -the Mapbox APIs' own response bodies are not. +Versions follow [semantic versioning](https://semver.org/): a breaking +change raises the major number (`1.0.0` → `2.0.0`), a new feature the minor, +and a fix the patch. Before 1.0, a breaking change raised the minor number +instead. What counts as breaking is [written down in +CONTRIBUTING.md](CONTRIBUTING.md#compatibility) — briefly, command names, +flags, the two output modes and the exit codes are promises; the Mapbox APIs' +own response bodies, and commands marked beta, are not. Cutting a release adds a `## - ` heading below `## Unreleased`, which stays in place so the next change has somewhere to go. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ebb0b81..6eaf3ff 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -93,13 +93,17 @@ and data-flow diagram (OAuth login, credential storage, API requests). ## Compatibility -While this is `0.x`, a breaking change bumps the minor version -(`0.1.5` → `0.2.0`); everything else bumps the patch. From 1.0 on, plain -[semver](https://semver.org/). Breaking: a command/flag removed, renamed, +Versions follow [semver](https://semver.org/): a breaking change bumps the +major version (`1.4.2` → `2.0.0`), a new feature the minor, and a fix the +patch. Breaking: a command/flag removed, renamed, or given a new default; an exit code or stdout/stderr change; a `--schema` field removed or repurposed. Not breaking: new commands, new API response fields, new `--schema` fields, and any wording. +A command marked beta, such as `mapbox workflow`, is outside this promise +until the label is removed: it says so in its help and on every run, and it +may change or be removed in any release. + Deprecated commands and endpoints print a warning before the request goes out, and are marked `[deprecated]` in `--help` and `--schema`. diff --git a/Cargo.lock b/Cargo.lock index dce78d6..d793bcd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -784,7 +784,7 @@ checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f" [[package]] name = "mapbox-cli" -version = "0.3.0" +version = "1.0.0" dependencies = [ "anyhow", "base64 0.22.1", diff --git a/Cargo.toml b/Cargo.toml index 51cfd7e..3d747ca 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "mapbox-cli" -version = "0.3.0" +version = "1.0.0" edition = "2021" description = "A command-line interface for Mapbox APIs, with commands generated at build time from OpenAPI specs." repository = "https://github.com/mapbox/mapbox-cli" diff --git a/README.md b/README.md index 18edc2c..8dc1f0b 100644 --- a/README.md +++ b/README.md @@ -80,11 +80,11 @@ taking the newest, with or without the leading `v`, so the version `mapbox --version` prints can be pasted straight in: ```sh -curl -fsSL https://cli.mapbox.com/install.sh | MAPBOX_CLI_VERSION=0.3.0 sh +curl -fsSL https://cli.mapbox.com/install.sh | MAPBOX_CLI_VERSION=1.0.0 sh ``` ```powershell -$env:MAPBOX_CLI_VERSION = '0.3.0'; irm https://cli.mapbox.com/install.ps1 | iex +$env:MAPBOX_CLI_VERSION = '1.0.0'; irm https://cli.mapbox.com/install.ps1 | iex ``` Both scripts put the install directory on your `PATH`: `install.sh` adds a @@ -139,7 +139,7 @@ Six targets are published: `aarch64-apple-darwin`, `x86_64-apple-darwin`, then extract: ```sh -version=v0.3.0 +version=v1.0.0 file=mapbox-${version}-aarch64-apple-darwin.tar.gz curl -fsSLO "https://cli.mapbox.com/${version}/${file}" @@ -154,7 +154,7 @@ On Windows the archive is a `.zip`, and PowerShell can read the manifest directly: ```powershell -$version = 'v0.3.0' +$version = 'v1.0.0' $target = 'x86_64-pc-windows-msvc' $manifest = Invoke-RestMethod "https://cli.mapbox.com/$version/manifest.json" From 980ab3de05541757f6ed253f3de6e2f91024be74 Mon Sep 17 00:00:00 2001 From: Mofei Zhu Date: Wed, 21 Oct 2026 11:45:03 +0300 Subject: [PATCH 2/6] Drop an unsupported claim from the Arm64 Windows changelog entry --- CHANGELOG.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 71fed6e..23822bb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -331,13 +331,12 @@ that may never merge. They are not releases and are not listed here. only part of this that makes a request — the same precedent `auth whoami --verify` sets. -- A native `aarch64-pc-windows-msvc` build. Windows on Arm ran the x64 build - under emulation before this — including inside a VM on Apple Silicon, the - larger of the two populations this serves — which `install.ps1` already - said out loud and now no longer has reason to. `install.ps1` already asked - the manifest for this target before falling back to the x64 one, and - `.cargo/config.toml` already named it, so publishing the artifact was the - whole client-side change. +- A native `aarch64-pc-windows-msvc` build. Windows on Arm, including in a + VM on Apple Silicon, ran the x64 build under emulation before this, which + `install.ps1` already said out loud and now no longer has reason to. + `install.ps1` already asked the manifest for this target before falling + back to the x64 one, and `.cargo/config.toml` already named it, so + publishing the artifact was the whole client-side change. - `install.sh`/`install.ps1` now document a convention for `MAPBOX_CLI_INSTALL_SOURCE` when a coding agent invokes the installer on someone's behalf: `agent-` From ccd5482e9642a1c2383ecfb0a34b59b2e7123355 Mon Sep 17 00:00:00 2001 From: Mofei Zhu Date: Wed, 21 Oct 2026 11:46:40 +0300 Subject: [PATCH 3/6] Fail the tests when the version has no dated changelog heading --- CHANGELOG.md | 2 ++ tests/changelog.rs | 45 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 tests/changelog.rs diff --git a/CHANGELOG.md b/CHANGELOG.md index 23822bb..75ec6db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,8 @@ own response bodies, and commands marked beta, are not. Cutting a release adds a `## - ` heading below `## Unreleased`, which stays in place so the next change has somewhere to go. +`tests/changelog.rs` fails while `Cargo.toml` names a version with no such +heading. Dev-channel builds (`v0.1.3-dev.`) are published straight from a branch that may never merge. They are not releases and are not listed here. diff --git a/tests/changelog.rs b/tests/changelog.rs new file mode 100644 index 0000000..adf010e --- /dev/null +++ b/tests/changelog.rs @@ -0,0 +1,45 @@ +//! Holds CHANGELOG.md to the version in `Cargo.toml`. +//! +//! A release bumps the version and moves the `## Unreleased` entries under a +//! `## - ` heading in the same commit. Nothing in the release +//! pipeline reads the changelog, so a tag cut from a commit that bumped the +//! version but skipped the heading would ship with every entry still under +//! Unreleased. Between releases the version names the last one, whose heading +//! is already there, so this only bites on the commit that bumps it. + +/// The heading's date is checked for shape only. Whether it is the day the +/// release actually went out is not something a test can know. +fn is_iso_date(text: &str) -> bool { + let bytes = text.as_bytes(); + bytes.len() == 10 + && bytes.iter().enumerate().all(|(i, b)| match i { + 4 | 7 => *b == b'-', + _ => b.is_ascii_digit(), + }) +} + +#[test] +fn the_current_version_has_a_dated_changelog_heading() { + let version = env!("CARGO_PKG_VERSION"); + let path = concat!(env!("CARGO_MANIFEST_DIR"), "/CHANGELOG.md"); + let changelog = std::fs::read_to_string(path).expect("read CHANGELOG.md"); + let prefix = format!("## {version} - "); + let found = changelog + .lines() + .filter_map(|line| line.strip_prefix(&prefix)) + .any(is_iso_date); + assert!( + found, + "Cargo.toml says {version}, but CHANGELOG.md has no `## {version} - YYYY-MM-DD` \ + heading. A version bump moves the Unreleased entries under that heading in the \ + same commit." + ); +} + +#[test] +fn is_iso_date_takes_only_that_shape() { + assert!(is_iso_date("2026-09-22")); + assert!(!is_iso_date("")); + assert!(!is_iso_date("2026-9-22")); + assert!(!is_iso_date("2026-09-22 (yanked)")); +} From 38c8567e1466a86f0acdd0d5566d550d0adc280a Mon Sep 17 00:00:00 2001 From: Mofei Zhu Date: Wed, 21 Oct 2026 11:52:56 +0300 Subject: [PATCH 4/6] Add the 1.0.0 changelog heading --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 75ec6db..0b70450 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,8 @@ that may never merge. They are not releases and are not listed here. ## Unreleased +## 1.0.0 - 2026-10-21 + - New `mapbox report ""` sends feedback about the CLI itself to the Mapbox CLI team, with the CLI's version and OS appended. It is filed under Mapbox's account, not yours. It is sent with the CLI's own token, From 5efcc36dd9f2d9eba3ff0b7f3a4e36076761ca84 Mon Sep 17 00:00:00 2001 From: Mofei Zhu Date: Wed, 21 Oct 2026 19:57:36 +0300 Subject: [PATCH 5/6] Drop the beta example from CONTRIBUTING and note #106's advisory fix --- CHANGELOG.md | 9 +++++++++ CONTRIBUTING.md | 6 +++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b70450..ba2a465 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -350,6 +350,15 @@ that may never merge. They are not releases and are not listed here. which would have collapsed `agent/claude-code` into `agentclaude-code` and lost the separator. Comment-only: neither installer's behavior changed. +- `rustls-webpki` moved to 0.103.16 and `webpki-roots` to 1.0.10, fixing + [RUSTSEC-2026-0382](https://rustsec.org/advisories/RUSTSEC-2026-0382) and + [RUSTSEC-2026-0381](https://rustsec.org/advisories/RUSTSEC-2026-0381) + (CVE-2026-111943): certificate verification could accept a path through + distrusted emSign intermediates, whose private keys are now public. Both + are reached through `reqwest`, so every HTTPS request this CLI makes used + the affected versions; nothing in the crate itself had to change. Fixed in + [mapbox/mapbox-cli#106](https://github.com/mapbox/mapbox-cli/pull/106). + ## 0.3.0 - 2026-09-22 ### Added diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6eaf3ff..4e69488 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -100,9 +100,9 @@ or given a new default; an exit code or stdout/stderr change; a `--schema` field removed or repurposed. Not breaking: new commands, new API response fields, new `--schema` fields, and any wording. -A command marked beta, such as `mapbox workflow`, is outside this promise -until the label is removed: it says so in its help and on every run, and it -may change or be removed in any release. +A command marked beta is outside this promise until the label is removed: +it says so in its help and on every run, and it may change or be removed in +any release. Deprecated commands and endpoints print a warning before the request goes out, and are marked `[deprecated]` in `--help` and `--schema`. From 4e5d1665ea8e9a7168735c54bd23ce9fed9eadb7 Mon Sep 17 00:00:00 2001 From: Mofei Zhu Date: Wed, 21 Oct 2026 20:01:00 +0300 Subject: [PATCH 6/6] Date the 1.0.0 changelog heading for the tag day --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ba2a465..1c3b761 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,7 +22,7 @@ that may never merge. They are not releases and are not listed here. ## Unreleased -## 1.0.0 - 2026-10-21 +## 1.0.0 - 2026-10-22 - New `mapbox report ""` sends feedback about the CLI itself to the Mapbox CLI team, with the CLI's version and OS appended. It is filed