release 0.3.2 (#11)

* failure events arrive natively, and a wake can no longer be lost

events() streams refusals without a poll: the EventNotifier parks in
wait_for_event and the engine wakes it for installs and refused
reloads alike; failure_poll parses, warns, and does nothing. On the
way, the suite caught a wake that could be LOST: the notifier thread
read its baseline generation on its own first instruction, so an
install racing the thread's birth folded into the baseline and was
never reported — the baseline now reads on the caller's thread under
the registration lock, in both notifiers. Wheels build on engine 0.8
and the 0.8 store crates with the dev-only patch block gone, and CI
runs only where review happens: on the pull request.

* release dynamic-config-py and dynamic-config-py-remote 0.3.1

* the conformance pin names a tag that exists

The job pinned the engine tarball at v0.7.1 — written before the
release, which then shipped as v0.8.0 because semver said so. The
published wheel agrees with all twenty v0.8.0 cases, verified before
this push.

* the engine floor is 0.9

The wheels embed the engine rather than depending on a published version
of it, so the Python surface is unchanged and what travels is the
engine's own 0.9: resolution is this crate's now, with the fold behind a
swappable engine and figment optional. Three of its fixes reach a Python
caller without any of them being visible in this repository — a load with
one layer no longer folds it, a value nested past sixty-four levels reads
as a string rather than overflowing the stack, and a variable whose name
is not ASCII no longer aborts a load that reads the environment.

Also here: the security sweep's ledger tidy-up, and the shared ci-local
gate no longer failing on a containers recipe this repository has never
had.

* release dynamic-config-py and dynamic-config-py-remote 0.3.2

Author: ctolon

.github/workflows/security.yml

@@ -51,6 +51,17 @@ jobs:
           # duplicate-dependency policy in deny.toml is enforced somewhere
           # rather than assumed to be enforced somewhere else.
           command: check
+          # An exception that no longer matches anything is a decision about
+          # a dependency that left, still being carried as though it were
+          # current — and the reason beside it is then documentation of
+          # something untrue. This is the only way that drift is visible
+          # without somebody going and looking, so it fails the job.
+          arguments: --all-features
+          # After the subcommand, not before it: the action puts
+          # `arguments` ahead of `check`, where a lint level is not a
+          # flag cargo-deny takes — it exits on the usage message
+          # rather than on anything it found.
+          command-arguments: -D advisory-not-detected
 
   unsafe:
     name: no unsafe code

CONTRIBUTING.md

@@ -108,7 +108,8 @@ Changing any of these is fine — arguing for it is the price:
 - **The core crate's MSRV is 1.71**, and every feature that raises it says so in
   the README table. Features that raise it are verified against real toolchains
   in CI, not trusted from a manifest — `age` declares 1.74 and needs 1.85.
-- **No mandatory dependency** beyond `figment`, `serde` and `arc-swap`.
+- **No mandatory dependency** beyond `serde`, `arc-swap` and the engine's
+  default resolution backend.
 
 ## Style