From 6eff82b64ff332da40b2996ed7be72f520d6f6bf Mon Sep 17 00:00:00 2001 From: fastrevmd-lab <82611597+fastrevmd-lab@users.noreply.github.com> Date: Tue, 6 Oct 2026 21:34:53 -0400 Subject: [PATCH 1/3] packaging: add homepage, repository, documentation, changelog and issues links to published package metadata Co-Authored-By: Claude Sonnet 5 --- rustez-py/Cargo.toml | 2 ++ rustez-py/pyproject.toml | 7 +++++++ rustez/CHANGELOG.md | 6 ++++++ rustez/Cargo.toml | 2 ++ 4 files changed, 17 insertions(+) diff --git a/rustez-py/Cargo.toml b/rustez-py/Cargo.toml index bba7d23..97c4079 100644 --- a/rustez-py/Cargo.toml +++ b/rustez-py/Cargo.toml @@ -6,6 +6,8 @@ authors = ["fastrevmd-lab"] description = "Python bindings for rustEZ — pip install rustez" license = "MIT" repository = "https://github.com/mechubsec/rustez" +homepage = "https://github.com/mechubsec/rustez" +documentation = "https://github.com/mechubsec/rustez#readme" # published to PyPI via maturin, not crates.io. publish = false diff --git a/rustez-py/pyproject.toml b/rustez-py/pyproject.toml index 065668b..ddbb26a 100644 --- a/rustez-py/pyproject.toml +++ b/rustez-py/pyproject.toml @@ -10,6 +10,13 @@ requires-python = ">=3.9" license = "MIT" dependencies = ["lxml>=4.9.0"] +[project.urls] +Homepage = "https://github.com/mechubsec/rustez" +Repository = "https://github.com/mechubsec/rustez" +Documentation = "https://github.com/mechubsec/rustez#readme" +Changelog = "https://github.com/mechubsec/rustez/blob/main/rustez/CHANGELOG.md" +Issues = "https://github.com/mechubsec/rustez/issues" + [tool.maturin] python-source = "python" module-name = "rustez._rustez_native" diff --git a/rustez/CHANGELOG.md b/rustez/CHANGELOG.md index 6d5a35e..8a0d90f 100644 --- a/rustez/CHANGELOG.md +++ b/rustez/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added + +- **Package metadata links.** The PyPI package and both publishable crates + now carry homepage, repository, documentation, changelog and issues URLs, + so their package pages link back to the project. + ## [0.19.0] — 2026-09-30 ### Changed diff --git a/rustez/Cargo.toml b/rustez/Cargo.toml index cdd85f0..2eb3fba 100644 --- a/rustez/Cargo.toml +++ b/rustez/Cargo.toml @@ -6,6 +6,8 @@ authors = ["fastrevmd-lab"] description = "A Rust replacement for Juniper PyEZ — async-first Junos automation built on rustnetconf" license = "MIT" repository = "https://github.com/mechubsec/rustez" +homepage = "https://github.com/mechubsec/rustez" +documentation = "https://github.com/mechubsec/rustez#readme" keywords = ["junos", "juniper", "netconf", "network", "automation"] categories = ["network-programming"] rust-version = "1.86" From 6f5cd829a32a9c17e95b7fdfb85c9c1160291da4 Mon Sep 17 00:00:00 2001 From: fastrevmd-lab <82611597+fastrevmd-lab@users.noreply.github.com> Date: Tue, 6 Oct 2026 21:59:09 -0400 Subject: [PATCH 2/3] ci: pin two more MSRV-incompatible transitive dependencies Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ae62167..75f3646 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -91,11 +91,22 @@ jobs: # below that unsatisfiable. Confirmed against unmodified `main`, which # fails identically at its own declared MSRV. # + # `rustnetconf` 0.18.1 tightened its own `russh` requirement to + # `>=0.63.2, <0.64`, and `russh` 0.63.2+ declares `rust-version = 1.89`. + # rustez's `rustnetconf = "0.18"` lets a fresh resolve pick up 0.18.1, so + # pin back to 0.18.0, whose `russh = "^0.62"` is satisfiable at 1.86. + # That still resolves `russh` 0.62.7's own transitive `ctutils` to 0.4.3, + # which independently declared `rust-version = 1.87`; pin it to 0.4.2 + # (rust-version 1.85) as well. + # # Pinning the last compatible release keeps this job measuring *our* floor - # rather than the registry's. Drop the pin when it is no longer needed; the + # rather than the registry's. Drop a pin when it is no longer needed; the # failure names the crate and the version it wants, which is the diagnosis. - name: Pin dependencies that dropped support for the declared MSRV - run: cargo update -p aes --precise 0.9.2 + run: | + cargo update -p aes --precise 0.9.2 + cargo update -p rustnetconf --precise 0.18.0 + cargo update -p ctutils --precise 0.4.2 - name: cargo check at the declared MSRV run: cargo +1.86.0 check -p rustez From 26775851deb66299df7bd43795d412c06555fc19 Mon Sep 17 00:00:00 2001 From: fastrevmd-lab <82611597+fastrevmd-lab@users.noreply.github.com> Date: Tue, 6 Oct 2026 22:46:03 -0400 Subject: [PATCH 3/3] review: drop CI pin that reintroduces vulnerable rustnetconf, fix docs link Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 15 ++------------- rustez/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 75f3646..ae62167 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -91,22 +91,11 @@ jobs: # below that unsatisfiable. Confirmed against unmodified `main`, which # fails identically at its own declared MSRV. # - # `rustnetconf` 0.18.1 tightened its own `russh` requirement to - # `>=0.63.2, <0.64`, and `russh` 0.63.2+ declares `rust-version = 1.89`. - # rustez's `rustnetconf = "0.18"` lets a fresh resolve pick up 0.18.1, so - # pin back to 0.18.0, whose `russh = "^0.62"` is satisfiable at 1.86. - # That still resolves `russh` 0.62.7's own transitive `ctutils` to 0.4.3, - # which independently declared `rust-version = 1.87`; pin it to 0.4.2 - # (rust-version 1.85) as well. - # # Pinning the last compatible release keeps this job measuring *our* floor - # rather than the registry's. Drop a pin when it is no longer needed; the + # rather than the registry's. Drop the pin when it is no longer needed; the # failure names the crate and the version it wants, which is the diagnosis. - name: Pin dependencies that dropped support for the declared MSRV - run: | - cargo update -p aes --precise 0.9.2 - cargo update -p rustnetconf --precise 0.18.0 - cargo update -p ctutils --precise 0.4.2 + run: cargo update -p aes --precise 0.9.2 - name: cargo check at the declared MSRV run: cargo +1.86.0 check -p rustez diff --git a/rustez/Cargo.toml b/rustez/Cargo.toml index 2eb3fba..7754b0f 100644 --- a/rustez/Cargo.toml +++ b/rustez/Cargo.toml @@ -7,7 +7,7 @@ description = "A Rust replacement for Juniper PyEZ — async-first Junos automat license = "MIT" repository = "https://github.com/mechubsec/rustez" homepage = "https://github.com/mechubsec/rustez" -documentation = "https://github.com/mechubsec/rustez#readme" +documentation = "https://docs.rs/rustez" keywords = ["junos", "juniper", "netconf", "network", "automation"] categories = ["network-programming"] rust-version = "1.86"