Files

T

docs: 0.8.0 release polish — README, guide, changelog

Companion to the feat(async) commit. Brings every cross-referencing
doc up to v0.8 currency, replaces marketing-flavored copy with plain
prose, and replaces toy benchmark problems with relatable ones that
include actual run output and interpretive narrative.

- README: collapses the four-bullet "Read the user guide / API
  reference / Tested with N tests / Hot paths optimized" list into
  a single Docs links line.
- README: replaces the Schaffer-N1 toy problem with a PickACar
  multi-objective design problem — three decision variables
  (displacement, weight, drag), four objectives (price, 0-60,
  fuel, noise), and *nonlinear* cost relationships so the Pareto
  front is a real surface, not a 1D sweep. Includes actual NSGA-III
  run output (representative slice across the 100-car front) and
  a narrative explaining what each row tells you and why hand-
  picking would miss the interesting tradeoffs.
- README: removes rustdoc-style hidden `#` setup lines from code
  blocks. The README is rendered as plain markdown on GitHub /
  crates.io, where those lines are visible garbage instead of
  hidden setup. Code blocks are now self-contained.
- Guide quickstart (getting-started.md): replaces Sphere ( Σ x² )
  with a least-squares LineFit example. Same shape (single-
  objective continuous), but recognizable framing. Includes
  actual CMA-ES output, residual table, and narrative comparing
  the answer to standard regression.
- Algorithm count audit: stale "35 algorithms" claim corrected to
  the actual 33 across README, src/lib.rs, introduction.md, and
  the comparison.md table cell.
- Async feature flag listed in the optional-features sections of
  README, src/lib.rs, getting-started.md.
- introduction.md, choosing-an-algorithm.md, comparison.md,
  stability.md, migration.md, cookbook/parallel.md,
  cookbook/custom-optimizer.md: cross-references updated to
  describe full async coverage and link the new cookbook recipe.
- stability.md: removes the speculative "Observer / Snapshot /
  Checkpoint planned" bullet (those didn't ship); documents the
  AsyncProblem / AsyncPartialProblem trait stability.
- migration.md: new "To 0.8" section with paths from 0.5.x and 0.7.x.
- CHANGELOG: 0.8.0 entry capturing the async feature plus the
  documentation / governance / CI catch-up.
- SECURITY.md: supported versions table reflects 0.8.x.

2026-05-06 11:51:13 -06:00

2.2 KiB

Raw Blame History

Security policy

Supported versions

Security fixes are applied to the latest released minor version on crates.io. Patch-level releases (0.x.y → 0.x.y+1) are issued as needed.

Version	Supported
0.8.x	✅
≤ 0.7.x	❌ (please upgrade)

heuropt is pre-1.0; the public API may change between minor versions. Once 1.0.0 ships, the support window will be at least the latest two minor versions.

Reporting a vulnerability

Please do not open a public GitHub issue for a security bug. Instead use one of these channels:

GitHub's private vulnerability reporting on the repository.
Email steve@waits.net with subject line [heuropt security] <short summary>.

Please include:

A description of the vulnerability and the affected versions.
The smallest reproducer you can produce — a cargo run --example repro is ideal.
Your assessment of impact and exploitability.
Any suggested mitigation if you have one.

What I will do

Acknowledge the report within 72 hours.
Confirm or refute reproducibility within 7 days.
Issue a fix in a patch release within 30 days for confirmed high-severity issues; less urgent issues may roll into the next minor release.
Credit the reporter in the CHANGELOG entry unless you ask otherwise.

What counts as a security issue

heuropt is a numerical library, not a network service or sandbox. The realistic security-relevant categories are:

Memory safety: any unsafe-code-related UB or unwinds-across-FFI bug. heuropt itself uses no unsafe; this category covers dependencies it transitively pulls in.
Denial of service: an input to a public API that causes unbounded memory growth, infinite loop, or panic outside its documented panic conditions. (Documented panics for invalid config are not bugs.)
Supply-chain compromise: a published heuropt crate that doesn't match the source on the tagged commit.

Functional correctness bugs (an algorithm produces wrong hypervolumes, etc.) are tracked as ordinary issues, not security.