Skip to content

Prepare v3.6.1 release#331

Merged
AndreyVMarkelov merged 1 commit into
masterfrom
release/v3.6.1
Jul 6, 2026
Merged

Prepare v3.6.1 release#331
AndreyVMarkelov merged 1 commit into
masterfrom
release/v3.6.1

Conversation

@AndreyVMarkelov

@AndreyVMarkelov AndreyVMarkelov commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Prepares the v3.6.1 release by recording all changes since v3.6.0 in the CHANGELOG. No code changes.

Changes covered by this release:

Added

  • Global --timeout flag to bound Dropbox network operations.
  • context.Context threaded through all Dropbox API calls (cancellation + deadlines).

Changed

  • put preserves the source file's modification time as ClientModified.
  • Retry loop respects context cancellation during backoff and never retries context errors.

Infrastructure

  • OSSF Scorecard scanning, golangci-lint, go.sum cache paths.
  • SBOM, Cosign signatures, SLSA provenance on release artifacts.
  • Race detector, workflow linting, CodeQL scanning; read-only workflow permissions.
  • Non-constant OAuth2 state (resolves CodeQL go/constant-oauth2-state).

Release steps after merge

  1. Merge this PR to master.
  2. Tag v3.6.1 on the merge commit and push the tag to trigger the Release workflow.

Record the --timeout flag, context propagation, upload mtime
preservation, retry cancellation, and supply-chain/CI hardening
under a new v3.6.1 section.
@AndreyVMarkelov AndreyVMarkelov merged commit 76ed914 into master Jul 6, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant