What's new in v0.34.1
v0.34.1 changes no product code. It moves the dependencies to their current releases, and the binary detects, scores and reports exactly as v0.34.0 did.
Dependency updates
serde_json 1.0.154, uuid 1.29.0, skrifa 0.49.0, lru 0.19.0, toml 1.1.8, opentelemetry-proto 0.33.1, rustls 0.23.46, webpki-roots 1.0.11, thiserror 2.0.21, sha2 0.11.1, arc-swap 1.9.3 and libc 0.2.191, plus proptest 1.12.0 and tokio 1.54.1 for the tests. krilla still draws the disclosure PDF with skrifa 0.42.1 and ratatui still uses lru 0.18, so both crates now ship in two versions.
Upgrade impact
- Nothing moves at runtime. No finding appears, disappears or changes signature, and acknowledgments keep matching.
- No configuration key is added or removed, no route, metric or wire format changes, the public API of
perf-sentinel-coredoes not change shape, the disclosure schema stays v1.8, the embedded reference data keeps its vintages, and MSRV stays 1.99.1.
Full detail in CHANGELOG.md.
Verifying this release
# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
--repo Institut-du-Numerique-Responsable/perf-sentinel
# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
--attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
--expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.34.1" \
--expected-issuer "https://token.actions.githubusercontent.com" \
--verify-binary ./perf-sentinel-linux-amd64gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.