jchultarsky/mirador v1.22.2

1.22.2 - 2026-10-22

on GitHub

Release Notes

Changed

• The manifest no longer sets homepage, which named the same URL as
  repository. Cargo from Rust 1.100 warns about the pair
  (cargo::redundant_homepage) on every build, which is how it was found:
  by the NetBSD package building on a beta toolchain (#309). crates.io
  still links the repository, and the release plan dist produces is
  unchanged.

Security

• webpki-roots 1.0.10, for RUSTSEC-2026-0381: 1.0.9 still trusted
  emSign ECC Root CA - G3, through which certificate paths could pass
  distrusted emSign intermediates whose private keys are now known. These
  are the roots every fetch mirador makes is checked against. Reported by
  @0323pin (#313).
• rustls 0.23.46 and rustls-webpki 0.103.16, for RUSTSEC-2026-0346
  to 0349 and RUSTSEC-2026-0382, published alongside it. The last is the
  same distrusted-intermediate problem from the verifier's side. Of the
  four in rustls, the Brotli certificate decompression one needs a
  feature mirador does not build with; the bump is taken whole rather than
  argued advisory by advisory.

Install mirador 1.22.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/jchultarsky/mirador/releases/download/v1.22.2/mirador-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/jchultarsky/mirador/releases/download/v1.22.2/mirador-installer.ps1 | iex"

Download mirador 1.22.2

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo jchultarsky/mirador

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>