Repository navigation
docs: backfill CHANGELOG for codegen releases (CR-315) - #248
Merged
Merged
Conversation
The CHANGELOG had no 1.6.2 or 1.6.3 section: 1.7.0 sat directly above 1.6.1, although the release note policy at the top of the file asks for a section per released version. This adds both, from the tags (`git log` and `git diff` between v1.6.1, v1.6.2, v1.6.3) and the GitHub release notes and the published advisory GHSA-5www-2x9c-mgr6: - 1.6.3 (2026-10-23): the security fix merged from a private fork (commit 0418898, "Codegen can emit C++ calls and type names taken from the input script", high, CWE-94, affected pineforge-codegen 0.6.4 up to 1.6.3 and @pineforge/codegen-pyodide 0.7.0 up to 1.6.3), stated as the advisory states it and without a reproduction recipe; and #237, #238, #239, #240 (CI, npm publishing environment, documentation). - 1.6.2 (2026-10-21): the pf-cpp-allowlist checker (#210), the LIBC_RESERVED_NAMES reserved-name change in the emitter, the licensor entity written as PINEFORGE LLC (#234), and the CI changes #212, #214, #215, #216, #217, #221, #223, #225, #233, #236. Additions only (0 lines removed): no sentence is replaced. No file other than CHANGELOG.md changes. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…ses scripts (REV P2) (CR-315) REV-CX's read of the CR-315 backfill (reports/verdict-cr315.md) found that the 1.6.3 Compatibility bullet understated the fix. Checked against `git diff v1.6.2 v1.6.3` of pineforge_codegen/ before writing it: - visit_call.py / visit_expr.py: an unknown call or a member read on a builtin-backed receiver no longer reaches the emitted C++ as text; it ends with "<name>(...) is not implemented in PineForge runtime."; - parser.py: a string, number or operator in a type position or inside <...> raises a located ParseError; - support_checker.py: array.new / array.from with an undeclared element type is refused with the same "not implemented" message; - types.py: the default of an enum-typed element is na<double>() (a name that is not a declared user type falls back to its slot's default); visit_expr.py: format, currency and order values are typed std::string. So a script that compiled under 1.6.2 can fail under 1.6.3, which the bullet now says. Also (REV P3): the pf-cpp-allowlist entry carries the advisory's own caveat (a denylist with known false positives, not proof that a unit is safe), and the Security entry states that release images before 1.6.3 contain an affected codegen and the 1.6.3 image the fixed one. Replaces text added by the previous commit of this change (d009aee), not on main. CHANGELOG.md only. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
luisleo526
added a commit
that referenced
this pull request
Oct 25, 2026
Brings the branch up to date with codegen main (CHANGELOG backfill, #248). The merge is clean: CHANGELOG.md auto-merged and keeps both the main entries and the Unreleased note for strategy.account_currency (#227). Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
This was referenced Oct 26, 2026
luisleo526
added a commit
that referenced
this pull request
Oct 26, 2026
## What Replaces the three-bullet `## Unreleased` block of `CHANGELOG.md` with the full planned-1.8.0 entry and its migration notes. `CHANGELOG.md` is the only file changed (+54/-10). Documentation only. ## Why The release workflow creates the GitHub release with a fixed install line and no migration notes; the notes users read are this file. They must be on main before the release dispatch. The heading stays `## Unreleased` until the `v1.8.0` tag exists, as the file's own release note policy says; a separate docs-only commit dates it after the tag. ## Content - Compatibility and migration: exact pairing with engine `v1.8.0`; regenerate strategy C++ and relink; the new `color` input type with its unsigned packed `0xAARRGGBB` default that hosts must preserve; the `strategy.account_currency` emitted-C++ change (intended to change only for scripts that read it; not a byte comparison against 1.7.0); CRLF and lone CR line endings accepted. - The four pull requests merged after `v1.7.0`: #251 (#231), #250 (#227), #252 (#230), #248 (CHANGELOG backfill, no behaviour change). - One sentence about pineforge-hpo accepting color inputs from its 1.8.0 release; true of hpo main today, re-checked against hpo's 1.8.0 entry before the release. ## Checks - Read as a committed diff by an independent reviewer: GO. The four commits since `v1.7.0` are the four bullets. - The `color.red` value `4294063685` (`0xFFF23645`) was recomputed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Supersedes #256 (same change; the commit message no longer carries an internal tracking id).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release-notes backfill (CR-315): CHANGELOG entries for codegen releases that shipped without notes, incl. the Security section for GHSA-5www-2x9c-mgr6 (matches the published advisory: id, severity, CWE-94, ranges, patched 1.6.3). REV-CX GO after one compatibility-text edit. Docs only (CHANGELOG.md).
🤖 Generated with Claude Code