syswatch

Security

• Recordings from R and --record, S snapshots and the config are now created readable only by your user, with files at 0600 and directories at 0700. Recordings and snapshots contain every visible process's full command line, and earlier versions created them under your umask, which usually let other users read them. syswatch narrows its sessions, ring and snapshots directories to 0700 the next time it writes to each one. To protect files an earlier version wrote right away, run chmod -R go= ~/.local/share/syswatch on Linux or chmod -R go= ~/Library/Application\ Support/syswatch on macOS, and check any copies you keep elsewhere.
• S always creates a new snapshot file and never opens an existing entry at the same name. The config is saved through a temporary file and a rename.
• Startup no longer reads other processes' environment variables. A full sysinfo refresh at startup read /proc/<pid>/environ for every readable process and kept the values in memory, though syswatch never showed them.
• zstd's decoders for pre-1.0 formats are no longer built into syswatch. No version of syswatch wrote those formats.

Changed

• The minimum supported Rust is now 1.89. Cargo.toml declares it, and CI builds on it.
• Updated dependencies, which clears the published advisories against anyhow, tokio, zstd, zstd-safe and zstd-sys. Removed tokio, which nothing used.
• The published crate leaves out the demo GIFs. It is 259 KB, down from 6.1 MB.

Fixed

• The Homebrew tap formula's test expected syswatch --help to exit 1. It exits 0.
• Dense no longer crashes in a terminal 3 to 8 rows tall, or on a key press in one, which used to leave the terminal in raw mode (#39).
• --record now flushes its current chunk and exits cleanly on SIGTERM (systemctl stop) and SIGHUP, not only on Ctrl-C, and still ignores SIGHUP under nohup (#41).

Release process

• A release now stops before it builds anything unless its tag matches Cargo.toml, this file has a section for it, the commit is on main, and CI's Linux, macOS, release-guard, cargo-deny and MSRV jobs passed on that commit. Windows CI still runs, but doesn't hold a release.
• scripts/release.sh X.Y.Z "summary" makes the release commit and its tag.
• A failed release can run again against the same tag: gh workflow run release.yml --ref main -f tag=vX.Y.Z. A version that is already on crates.io counts as published.
• A tag with a hyphen, such as v0.15.0-rc.1, makes a GitHub pre-release. It never goes to crates.io and never becomes the latest release. Only the newest release updates the Homebrew tap.
• Releases carry SHA256SUMS, and take their notes from this file.
• Workflows are read-only by default, with every action pinned to a commit. CI adds cargo-deny, an MSRV build and nextest, and Dependabot opens grouped updates weekly. The Nix build has its own workflow and a flake.lock.