From 23203f235cc414c4ffe0fd3941030eb0c9f9943f Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Tue, 3 Nov 2026 00:41:40 +0000 Subject: [PATCH] Clarify credential redaction and tool registration in release notes --- docs/releases/v0.8.0.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/releases/v0.8.0.md b/docs/releases/v0.8.0.md index f3c9d53..4c4187a 100644 --- a/docs/releases/v0.8.0.md +++ b/docs/releases/v0.8.0.md @@ -24,8 +24,8 @@ continue to have separate outcomes. never published; published versions and their contents remain immutable. - Records preserve exact endpoint and path bytes. Ordinary UTF-8 evidence uses record format 1; format 2 preserves other bytes. Recovery diagnostics redact - credentials, while private records and typed evidence can contain sensitive - endpoints. Operators control record retention and removal. + HTTP(S) URL userinfo, while private records and typed evidence can contain + sensitive endpoints. Operators control record retention and removal. ## Consumer tools and compatibility @@ -36,7 +36,8 @@ storage failure is reported separately and does not change the publication result. Applications handling results should inspect `RecordError` when a saved recovery handoff matters. -Consumers using a module-selected CLI can run it with `go tool releasekit`. +Consumers with the CLI registered as a Go tool in their module can run it with +`go tool releasekit`. The maintained multi-module launcher and Woodpecker examples use the selected module's tool version. Register the CLI before generating a vendor tree when using a vendored tool. Older recovery CLIs that only support record format 1