v0.3.6

svlens v0.3.6 release notes

Release-pipeline patch over v0.3.5. No source-code changes vs. v0.3.5;
the v0.3.5 binary surface ships verbatim. This release exists to fix
two release-infrastructure issues that v0.3.5 surfaced:

1. softprops/action-gh-release@v2 was still on Node.js 20, so
   v0.3.5's release-artifacts run produced new deprecation
   annotations even though the prior Node 24 migration had cleared
   actions/upload-artifact and codecov/codecov-action. v0.3.6
   bumps softprops to v3, which defaults to Node 24, and
   eliminates the last Node 20 surface in our workflows ahead of the
   2026-06-02 hosted-runner cutover.

2. GitHub Releases body was effectively empty. v0.3.5 used
   generate_release_notes: true, which only summarizes PR-merged
   commits since the last tag. svlens lands changes via direct
   main push (no PR), so the auto-generated body for v0.3.5 was
   one line linking back to v0.2.5. v0.3.6 switches to
   body_path: docs/releases/${{ github.ref_name }}.md so the
   release page now publishes the full hand-written release notes
   we commit alongside the version bump. The v0.3.5 release page
   was also retroactively backfilled via gh release edit so the
   existing tag is not silently behind the new convention.

What's in v0.3.6

• All of v0.3.5 (see v0.3.5) — same binary, same tests,
  same schema.
• release.yml now uses softprops/action-gh-release@v3 and
  body_path: docs/releases/${{ github.ref_name }}.md for tag-push
  release publication.

YAML schema additions

None. Identical to v0.3.5.

Test count

make test reports 571/571 passing — same as v0.3.5. Smoke
suites unchanged. Verified by CI on the v0.3.6 push to main before
the v0.3.6 tag.

Migration notes

No public API or schema changes vs. v0.3.5. If you maintain a fork
that copies release.yml, mirror the two softprops/action-gh-release
inputs change to keep the GitHub Releases page useful.

If you tag a release without a corresponding
docs/releases/v<tag>.md, the new body_path will be missing and
the release attach step will fail loudly rather than publish an empty
release body — this is the intended forcing function so future
release notes never get skipped.

Known follow-ups

Same list as v0.3.4 and v0.3.5; none of
those items closed in this patch.

Recommended validation

make test
ctest --test-dir build --output-on-failure

Optional, requires network and ~2 GiB scratch:

make bench

v0.3.5

svlens v0.3.5 release notes

Patch follow-up to v0.3.4. v0.3.4's release commit (c2d0ca3) shipped
a correct CMakeLists.txt bump and release notes but missed the
hardcoded v0.3.3 literals in three contract test scripts
(test_help_contract.sh, test_integration.sh,
test_svlens_integration.sh), so the v0.3.4 push CI was red even
though every other check passed. ad92523 corrected the test scripts
and the next CI run was green.

v0.3.5 republishes the v0.3.4 surface with the test-script fix folded
in, so a fresh build / install from a tagged v0.3.5 commit boots
cleanly without an out-of-tree fix-up commit. The new bump itself
also rolls the v0.3.4 -> v0.3.5 literal through the same three
contract test scripts, so this release is internally consistent on
its own commit.

What's in v0.3.5

• All v0.3.4 changes (see v0.3.4 release notes):
  • Adversarial-YAML / encoding edge-case coverage.
  • Column propagation for source-text observations.
  • Cross-scanner scopePath consistency lock-in.
  • Example yaml reach-through.
  • Parallel-ctest isolation.
  • bench/opentitan/ reproducible benchmark target + make bench.
  • GitHub Actions Node 24 migration ahead of the 2026-06-02 cutover.
• Contract test scripts now pin v0.3.5 literals so a fresh
  make test against the v0.3.5 binary passes its own
  banner / version assertions.

YAML schema additions

None vs. v0.3.4 (which had none vs. v0.3.3).

Test count

make test reports 571/571 passing on a Linux Ubuntu hosted
runner per CI run 25042715901 against this surface. Smoke jobs
report 14/14 (macos-offline), 9/9 (preinstalled-offline), and 6/6
(portable, both ubuntu and macos).

Migration notes

If you have already pulled v0.3.4 + ad92523, you are already on
the v0.3.5 surface; the bump only exists to give the "contract tests
pinned to the released version" claim a single, internally consistent
reference point. No public API changes vs. v0.3.4.

Known follow-ups

Same list as v0.3.4; none of those items closed in this
patch.

Recommended validation

make test
ctest --test-dir build --output-on-failure

Optional, requires network and ~2 GiB scratch:

make bench