From ee7f831d3290b7b0893848b63f54d835035699d7 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Tue, 13 Oct 2026 08:32:21 +0100 Subject: [PATCH] release: 3.0.2 Security and robustness fixes from the 2026-10-12 audit (audits/20261012-2201-securityAudit.md). --- docs/guide/nexus-guide.pdf | Bin 4084082 -> 4084082 bytes docs/guide/nexus-guide.tex | 2 +- rust/Cargo.lock | 4 ++-- rust/Cargo.toml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/guide/nexus-guide.pdf b/docs/guide/nexus-guide.pdf index ac5df9dc2f9bc334678809f431e5c19f503fee4a..c95e899d224c38f2acffdecaa1be7b5c325cf1ad 100644 GIT binary patch delta 4840 zcmajiXFSz$`v-86?bv%{?{#nvM^?r$qhlS%-YF|v=Fb*6NU~>A_TGDhBBRWV$U0;c ziV*JKeLwj>{6BcVuIs_|eSJUAuGe+^`W*ilRHsRP3kJ=U@?fNYX+=&0K#BDKkt{BG z66_c66hl*gQ$NW)tpj>zd|{{e(>&PtT3~$0unTSP9j1Exgo#wz>9Y5@OXqXj2ZlA# zt?Ri9T{8fEA0TAHwF@ULLA{n*_xo1lWP1MlWLm!Z-?woU{alEDYw^;dvGm8}{$R-t z!{R@mKj!>6xqACr;rUoOAg5bFjZ%D$g`n@IY@*+ME+Ficv}own3J_+FZLsJIJ^p^Ov++P|3-l_5d!(qb9;-ruy?> z8U=z+@msNYn(vrr+aO`TT=BY_?D}1(gb3co2gTUFjWE~dq?{f<0;;MOZtBlXcmn#P zd)8DZpF*{1qe{r{hzTX+q<60so15LitaXz;nX*g8(nNgQRy{$_{QyRyJGYBFjWiW> zLPNFQ=k8Fo8A-BD0B&lFb-Bj|blW^_=SN9|hx;Pvbai6iUD$-?HX%#evuo>kZc3(v zaKGV90`Wbc7Z$VCKxf{Bu@@!BR3~wAhU~!DTHfjUckcreDwm@%M(8sBvd{Ix214k$ zSo@!da87A%|E_azPhL*sp*APA-&7F?KjosDI6!d3fl8KqnniNwK*iQ;-IvVg<^#T)4xKG8)1Y65uu3B{M zJR1*ea(=*Tlm?_YwLCr$o7u9;Q^{GhzN@C5B+;L6cz!DMfH%h@Zrqon;nSDRV5Pqt zvwHo7m1fZ?s;mQn3^F)U2ViQrFE8DprD|-*-L&=4=R1OKDhCt!Jlp4?aDAdT={+%{ zdcPHigeIj0)|10KKHE+E&$4B+s2{di;SlL1TUCQA)}(;L@1h0D`*<}U$SY5+2O78p zO!Q{-5DJB^WD1>gLkI1{Z}lbo>aPW^20Ab$#L4G|=UKwVONi%|q<@<+Z*hI(v)1@W%&%o2$M_5oRe!++(pj?p%j!J>9Dl z2tlP;Sp&E?+XznDDCk=woe%CE-&4q2I_bVOrTX_e*Y>I0ObHp^XywS?wOKNvYbRfp zor`UhJ`PjXf5}G03*%rb-@#e`mI|IIsrRkz*MndN zUvv+L^F}H`6`QMz=&CTUUncpB68^pWzOhhoe$$3;Ru?U48%0!vU2VM}sJ_8J8+zGK z=IrU@>*wQa?-8v)9j`!*54r^+0Nn-=f`~xGAQBKMhzvvyq5wfalpre5f8W!9XhC!! zdJqGM5yS*y2C;xxL2Mv)5C`ZEh!eyG;s)`6ctLz1evkl25F`W=28n<~L1G|rkOW8) z1O-Wfq(L$u7zhrM1<8RBAbHSTkOD{%q|~ZFt=uAb8zCbF&-^2&%=y2rl^LNdLZJbb zlZL`H;4%nJd88CLAP+~VO3O=YNXx?1HITAUWiG}4cO=vMu?W{~8EGl0|Lq7sd?Coo z+9hb@=w!Ka%jTegam=DRtbLJ5FQeAUGQ-{cIN0f9nz&^~UfK|XFEy60lrJ*1Nyf?U zuDFMADTL4^t;HTeC-5=*UKERv|Cg8uH7RN}uUrACgt3qJb}9TBc zDiY;zGRo;aV)tV{Ih%0ABRg5p;BLWUt+hu4tx&A=Ndb#d3A?OXY|v`q%(B4Aw~Hdp zR}XIh>dK-;u|4G3Ic;N3Wu!$}^f>BCMySRL(W4lFM{$hL!#a&u40h@k0>2q&`w+We zdHq;xqE#ZO`u=zkER)Cq{VadE@?vwpt9y|zlX1qS^m%wGEaL|bXnmJxV>^sgiAm|_ z>>v4V(?)d||DaFsJN{pKMG~sWcPC2(-BZL@P`qg9ZA&|5O*_$~0a@)q=A^-Z1$+hj zTLQ&n4y)F)M@vYa(|(w9D{l@q=rmgv!F=LS?yi*@g{^z;KSM$QKq)TImz0XS_hVVI zV#A8`Df?7W0#wmdzFxPtRcVySp4Z(TSwn~ok|Ib&y~xn^5Q7t?zfmt#Db`c*vr`Gb z_BAA?{rj3eB;jhUNjkcc^w)yMmU~@PBeZA-Ml490|KET_8&J||FA{@39ZaM#JBEtl zn2S@lm||4itphO1ol%!*x+nO1fZ843AT*td5Je((RK|>XPxBn%K%?c{cY($98WOrk z>Du*c&h|-TF>h(cU=G=ufBML6c+e$n;G{wmz!Re0mq6~M1V^l`BE)53lv*P&?M8HUbke2vbACc5Eby~7w5)nJP z8T=7&jS)rHL0Sg+?)NJ%P>~k_O`3llQ;GRer245*26ok&Ra4r6i43guYP{%2@Bc3c zFXLJAp5D)>>V2epJO`B2xQ>aEpi4kC|{C@iLf#toX&_;ip6j;W(@gFAr# z&pvBr<)}~Em6~ku%<{JC-4E!fU64BIy^xuE@}{)7Ie1k1w6}7Y)t9x}V$S59%a&fQ z;@I`nL2|CjRsg*9>vvp;J5xL}uz4@ec|63`Nj*w**-$e(BWyd0)jZ?xusQaad!BYO zu<}#md-B%cj5aSLXKs4TdMTafq3zk@8s=v6?{h_k$di?z38VX(U zqbF1y?VKyc?O2p&LgByC+|IwL+p?;${5A@>?eJ4vPGyv?-oJHWxw8v-V0`voGrz>u z^W4j=>72@F3%#!MoZQP4Cb$_@uK3Yui05JTJZzo>lJRtYWrHqrb>2z_rmE0{S=Tkf zqA3^N@Q>M?in$b-_*zfdf7}!mG0vFoTy0zy1-_fx45x4$-S}-?0zaM|&I%|^LDZ+* z+I!oP*zldke{$bW#co=GoBhAz9WJr99)XJWLyhY)lJcGx-vsKE7>ZsM*1E#*jq3(=ft#T5gQ)yErT|NGpIX+C zs;Z+@7iUOia?~aJxm;y2+a|@QL1j@<3-ksaI}zvh8p(d^aepD;_7aJSa`a+H+xL&g zbIu8jd8JooA9p?6YV0-JfC)N(wy5dZof}XJVGrz#Z#gyw4lw7AE27d73P@pXMiD?zF0T|MD(YD*ia(3Ecz&^Z zX=;0s?=stK?cKFiuvEF4H1jB4b|;FmGJM30*BO4}U#mGdUeVy#4u=ed`PW?q^gUN)& zMx+t94+g6~=Xd^`)%!$u+v+%gM zg>Say^f(Z7*agRBxE=E4MVMmhx1*M35zgYhZN_p|$S30#64*-b#kdKT@8)jEYTmu+ z#1d-gpXoyzxSaq{HY=tiQ7Gm=uo$?&=OX{ycEZ| z)6=Vh<`B>97VGYzqr;pHGva0)Quhd5q2?A*1z<)fUV1Of?N`-C+*oq#2dSHm4h{LT zThc5un2|35aM$X_(y7LYNRs7>efQqYM`$zuOMjcy# z#m_)jxSV}=ug~PI?#w{>@MFV~p}m>41Tn4_d~S+Ui=UH>vsqj0yN@3aU)*drZ9nxP zr?j|P)h}0cx|;0WFu(Ej%s*54;aPZvLj$u}1h3h>kXjWZR(oU)Qh-9CB@yXKVH75u*fI?jd|(N`t{fh{T>QGxd+PbcoUj@~$!s@nl?2 zYt}|4Jk%{VU^{K-K*(X`{5ZEEi&)N(GRz z1#kJfZmNBWwnyITV}5;+0% zl&+pKGpaH(mci<|tdP7-XU&5tLO?vDCd^`m@=>hpPOPV1Ai8piAbQGWw}%)uPgMeS z+U*~Kw-OH93A#7_K6II7j)(2Xk?Ki?>p;3ICi?E^70TDNKStm+X7rp#ZJ$O`5sP2# z>W*_n5oR_1wzXDpzJPDt=FMzQ`XjG7VxMiKfI8zVEf_Idqc1&eC38zB23XpuhgYz$ zD|mSHCBlBb1z;Vent`d?^&~ftXczO0P5J4 z{f0sO8VH=!W?s zBUU}<%+bZiJ`qOo2{EzpLYB-lBUA5Yr1(3zgKTi7@Vt0J-F&=oD1=FvjafXBr?wHf zsg5kzQ`H8G&AW^b@rjB|>8W7p@+s27Ob%PVV+b-@XA?R$Ofcqa2|dr_Os`2n>b8VPI*kuT;A{`4~h zDW%Os@YFs)5hp5gj@J?+Z8%$L=!1IVS1A&^dU9>v(+71AwnX#P61=#DEa2S?1T&V* z5hNo|9bZf6sa)lCt|@KUEKjT4cbhc6w;2}r!Uha^m1*J<^5XnCcA`Q~rsibtrQnE|8fTVOI z{r=zg;=BDWerM)l=A1cm@jP>sbAfdPs!)bti%2B;tzuKg8ABcbg!rld9@Ny?;p}8@ zW(!8|u>Ka^HNEpG-muz9emp0tYG0W%t?R$qPk{h+9P|kk#zWcC7zQ5$??*{6n;YDuhqE;%YYhCu-o=oxw)Vmg%g(A%5 z=7$%j7Y;8+(z`Fl0eTKyLhg*7UVOfE6=%LtE42TQuL(Q*F>i=_S@(#iOJy^eWbGa0 z4EZu{`O&DwxnqsqrBLrI)cy45-}{eA%CaSh6%BRnt*=Q4Op)bbMf~)=ViR2)Hna4- zsA#_5zDb!&SC>t0LYkFG4gI%+W!`=w7wHm|03~iZGpo z69hbF6_;G;@Q*E0n-O73ab5Gn`(1i~Pl`W7i?wOb1amYmzjc$U*I;VoGp~v3M!7v} z{&MTfcUrZ4UB{V6+QhRDGv)U$&D7Li8vbskB;g{MsJUYI!6cgX%jTjh?Vpb^n<|!G z5|}D}nqu9BMqu!-6y62~tHpcC%9_2IWY}7OiD^pn^dm)^2~Mz)Fa0pHCoO?_42KvK zWwg%B~{^P}*(M=R0j z(=hLggvajXPJV?pZ$9f7A%-Ku9*uh9GQzA>z6AV43<7dq1o0~nCQg5qqbVmLE8AYy zgX;VVc~>&7k01svZ4Np=9%YGgvc3wFeKZ!sQ!sZ+sYi-h0F z4-{1(v#MqE1m$ovclgFE$7C4%$Jb$4BW)6|dDA9~H}np7=Zu{OwvN7Kr-reQegCXs|&XfYmm+_y*Iy@qf5*ysMp|44Zl+igxW2)`;6aU2=ORfCqdx zA(g?mCS24VO5+N>k*CK&>V(aJo2&*mIT*C^T+Y@EkKbY-Ilr5?m*ZZgYR{-^0LSPj zN86z$&%WfbDt3$6cM3@}&gm%=wtmiWI1hQ=wp{X`>^Q!D`r7}-0|IK^V*GkE$uOb@*j@b`ikH?{04VGIa&b=t#!&rKaWPJG_CmbSF)Z68kjx zAJIs(dEQa8CD-b(mf8W`bFL4*9iC=i;;zl2S!uo`{H73tpz4jN^?sn^iY}ll4c6W= znsM~x>_BYwdz)~+FiGLKwsA^ZZ&R;go<-)d6rEX?+5-C&!}@Qy;i<17fb3Z=P+4>-hFk;ou=VowJkHv@e!=Hs@m(8S8Ib+1%{_nu4{NJ zf_`N|nf2L!oF`~}R=%x@J@4S5^y0fVk~OrtQ2@T1R#Nl^->cu_Vdl%~&@R6IT3TOY z)H28}d-YGFY(w^ligtffd#b$NZK>1XX}qz@#H)YDnwR%mHb$l!rk3*Y%UJtO-lJpg z?Td6{ODSlWOZMy6=>!UNNqO!zJpKo*)D!l+V1wPWzpk8Mwz?q?=#4KYHh1`dba6H} zwI@ytKYL_jbQ93%=71BrtqK$4)RASsY^ozi`oaxPpkK_Q{UGcg(F|7CTL#ASF%o{0-8 ziNll?#D$)TNhpd7!<3a26(tmvhQSboU_4QGi6m2ZJn|)pQm<=$@}|acD>ko6qOpn`C=}wSUp?Lo10}bEL1=J zLCC_R1xA;Jo;QIVx(rd|?IU=m1XKv>;Ce#ruN76Vn0QgzZkFkL`!|1Oe_VJ2i*a#C z^u_hC^oB=9BEa)UNhPYC4Vt_GeDipK9z1~_d1P)3ye)+t?_|Qml4u%~bBi|I@e&z= z5V#zPLtn{?=#l1~--KQ!FAoq8aOqk!R?U8U^!8Qq+5qQki|<9@sfiN>+CS-o=+=^G z?qZZ199ArDjUY9h{Ti^NEKKvx@htyhb6OW2RnlwNdh*2c5<3xrx`7BY;ID*uw=twf zhhLD_-|U#etpO=`=!rUMUNIhWx^qI|T-B74BCzuj7QYp}Z63d4k54@xN?PX~@;nY# z{$>$V3NP`usU9kvKkO-lzs9LW5Ts`PhFhz zVGPe_=4NJ@d#~HA>nXki{vsdY#yC@*2LD*R2xUl^{g59SjmgE@RhE_OiDdAZL)!ec z+J7CW)#J(F)pZswi~b`?3qkuAZqMN@R8VWp!L1E-etm=oOQy6 z+GQ}D1WPR3aUrav)q(`aS)ojRO8Wk}6(p!7@ibp5{h+uC{K9_>UhNnbZ0%5a{0|D$ z6=j`vw|1Ru0ySIcKk;$l|MXdzSy$Nu84#bt;^IgdF%WM-5_UndmmdiuyNLAtbT!Ke z@ZF=y^AY$&gJ~rIhVvAI`wN4$fFYmrg)pxxVo_piNI~(bo%-0w47yDpRrn}QI_i^A zA&8*U6?FOqtb?!*$-&UE3MTz*RzBE=px`o0#iRQEz;X=!ZZxi*{WOs}tvorAhbl(V zpNZlmIx7TM`tdlcJUJ5T?3Bw-yiAU~Xny&TcHNXHvJ((~uvT`FrZ0=F-50FD?eARV zE4h?*nf9`c{8PIoZ3xjc!Idf2Nz^1EfP0jM%bWcm7K2qb5luz6rBJD$sAttjOlt6d zb9}_){MPo~6q+73>DHVEUs){AWx)y$g~@l~rX$nVyK+1hYeAk*Qcg?O3!cm#Q=xN! ziS5V|6*wxE#2_vEtm<9mngiNQ#jWv$Xv2>It2Zq_-**H<7oy>`!-g)%N;>FtbS+(# zp5mlUpCRc6RP@^s^!UUCMK$P9cooJl28?7@`Y1jjEuYZ+x(gUZz}I1t*2xdm&=eYL z8RqHI8}((n3F zy;sSWhlMhm2G{*7ypZhnKU&O4WLwgRu@I%f^~`xwgXKExH8wr8buUujcAn?gH~He8 z%)9W^tEg>Q-2)10;BbF_9h+f@7LJtdz)yq2KFa2!&W-2p37&_J(t}^6_d{Ek2V}1!*qaSfT{@^YLmUQg zRt(@C?@HJ1)?c8H?oJ+}0Ori&vV*zu$g3-9KAB?(N>{)`Z**#Vb0J@Lj%W^g*T&D> zL8jW_OLaR~zm8x2FAPFwUl+Tl6cJo@0_;y&QF6XZ{C2yh`75HsVHy&rmmr2gg;s`{FlO z+b<;Ex$xZGq`G_PuGlH;Yn9cnM4#=+P827jSVPFq?yW>dzRU?XC6fAOj+JQBFSSu6 zF+_OL_FrssQpU<*sDZk&QfROO-{NJx`d*w`>rotinOBw^l0#4CN)bK4#pE2mm@BcD zqqbMrZ&OrrRQwzcl$1Gd>Y;gQ=5@;%8Wx1S;^=A-IH}pgylyw@5ic;1!0YYK%_z$x35tQWh7>M(){FrpR9FnA6w=F>MCPls<8b zDyW?ic=|`nrfFA@uuJemt^2Oc&Js4%U||u^T;r#$Yy_@>f`N3s^P30gt=76lC&$8- z40X7&Y2C!)pHY+Z2t$;2gU!KiEJHwxpsDL(vwDQIp!Mn0+uvA=(*4$@Z9SA1>VRZYc+p^<@)QfT{J2d2WrqY@ul!K4_yW}x97!G3%k z8BSlzsCFX4LQqx4aobGiWZN)Tev?1|VLX>vuHPWAIrzN#P%ks|@?!ERB9IQxI4XD2 zW0@K~D^>U0NFd#{8991*hGnmVO`k=fUVi#V6Hb8uEOx6;Gioz$)88*kqptb3D9qc4 z`|{qt-_>BZ88=ix`dKoz?E87z?pS&L8o8`#T%Fl)|Fxn0%dsMImEGpx-@2ILhRUqe zcC&rRN-z}Vn%$T;&2=uLeKuEi+-m@zEw?o(9pU{(CG#>TBV&ZW<&CV7 zo^?Xwe$#iaU*%!9i}SnxF0>f6yk9SngwC|TZE`I2dpb|Ce|Jv6sI^$`K>a~Mrn~$O zm=P$Bfy{^=1SJhH(0dK;`WygEuGbd^sGg?``##1C3f#Ur+*KXt!zGniVfLHM^8tO) z`x%JfR%Go;<~-juW~!i84SOJqSacS%fMfGYt|7mQ?$xA1ZGKgzuEG1_Jcw=_-Pmb_?=>MZvcjbl=_2o=1m1#urj26K1iM=UgLU@1#1gYZ@*jsbUR@74!EE#B-1L+Vs7~ zn-`io7i80sf52h+ggcltzF7yic>p&*zS#n|n@bhptQio2(3BVmWx@LvZ=CF#gf|i2 zT!;%tX!JK}$a(p{h&QgwVhTkAl8K^AAwgL&u@JiZ)mh2T1nk0;2keuQGlYGH7|s4t z?e;4@jJ!l&=zV-6?u!UE77KYX4te6A3gqUp>^_5pm)vS*Sq=8_HdX`y@wg%wfIes3 z#Knq7J(h738IIU`yQR3FGvBFdX%(-7Djbv0?Eh+(g_Kn*CeMYymHGh+Vi(;)p3{CR zET1L=O9Q-tK`ixjP6}#<96O6=3<0qGVV)V%zGKNBB^^>w#1{5JfOUmxL-Gg(_feza zGa1Bc12gV_gRAuyudF_#B2g$9_y{}#Pwn!|qu8|6NAbhFsB*cvkDl?SV}*I)7 z5}enor>Z(QVa<_QWR&h?Pu`G+HIvn0QM${hG!jv|dyBS&@*H`D*yAXfaIq1ENm+6) z5QQ}l8`5wer466xfg^@_%ExTX7hcK7Or6r+Q!cJ!o9KTl?)6BY&XeuBV~2XpF62$!&B1-#3oW}M8o3J2v17E* z(;rK(WSAXXwOYGS(yr$?F9`Ew(5{h2IQZ0k%vK{6tl488$*8Vh#=^ IEoI{W0L=w5QUCw| diff --git a/docs/guide/nexus-guide.tex b/docs/guide/nexus-guide.tex index 153e0c7..fa5e7b4 100644 --- a/docs/guide/nexus-guide.tex +++ b/docs/guide/nexus-guide.tex @@ -35,7 +35,7 @@ \node[inner sep=0pt, draw=white!25!ink, line width=0.6pt, rounded corners=4pt] {\includegraphics[width=166mm]{img/ssh.png}}; \end{tikzpicture}}; \node[anchor=south east, text=white!55!ink, font=\footnotesize, align=right] - at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 3.0.1\\October 2026\\dixon.cx}; + at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 3.0.2\\October 2026\\dixon.cx}; }\null \cleardoublepage diff --git a/rust/Cargo.lock b/rust/Cargo.lock index 816d2d7..b17e8c8 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -3711,7 +3711,7 @@ dependencies = [ [[package]] name = "nexus" -version = "3.0.1" +version = "3.0.2" dependencies = [ "alacritty_terminal", "arboard", @@ -3736,7 +3736,7 @@ dependencies = [ [[package]] name = "nexus-core" -version = "3.0.1" +version = "3.0.2" dependencies = [ "aes-gcm 0.10.3", "argon2 0.5.3", diff --git a/rust/Cargo.toml b/rust/Cargo.toml index 5100c07..eaf8804 100644 --- a/rust/Cargo.toml +++ b/rust/Cargo.toml @@ -4,7 +4,7 @@ members = ["core", "app"] exclude = ["fuzz"] [workspace.package] -version = "3.0.1" +version = "3.0.2" edition = "2024" [profile.dev.package."*"]