chore(release): 0.12.1

[ndreno]

Closes the Unreleased section and bumps the workspace to 0.12.1.

Patch: one compiler fix, #233. 0.12.0's plugin configuration check (E1023) judged env:// and file:// references as the values they stand for, so a spec reading a ws-upstream URL from the environment stopped compiling. The artifact format is unchanged (still 7): 0.12.0 artifacts load as they are.

Same footprint as the 0.12.0 release: Cargo.toml (10 version fields), Cargo.lock (workspace crates only), CHANGELOG.md (section, headline, compare links). #232 is CI-only and has no user-facing entry.

After merge: tag v0.12.1 on the merge commit; the release workflow checks the tag against Cargo.toml and the changelog.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• deep-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: barbacane-dev/barbacane/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6e1d753d-2ad8-45d6-9a1b-b4d44c8a838a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nicorp-pr-reviewer]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Release Notes Clarity The release notes mention that a spec reading a plugin setting from the environment now compiles again, but do not clearly specify what the exact problem was or how it was fixed. This could make it harder for users to understand the impact of the change or to determine if their specific use case is affected. ## [0.12.1] - 2026-09-25 A spec that reads a plugin setting from the environment compiles again. 0.12.0 began validating plugin configuration at compile time (`E1023`) and judged `env://` and `file://` references as if they were the values they stand for, so a `ws-upstream` URL given as `env://NAME` was refused. No artifact change: 0.12.0 artifacts load as they are. ### Fixed - **compiler**: a plugin configuration value given as a runtime reference (`env://`, `file://`) is no longer refused by `E1023` for not looking like the value it stands for. The value is resolved when the gateway loads the artifact, so its content cannot be checked at compile time. A `ws-upstream` dispatch reading its `url` from `env://` failed the compile against the plugin's `^wss?://` pattern; an `http-upstream` one passed only because `env://NAME` happens to be a valid URI. A reference is still refused where the schema admits no string: a number or an object, or an `enum` or `const` of numbers. `vault://`, `aws-sm://` and `k8s://` get no exemption, since the gateway refuses them at startup. Version Consistency The version bump in Cargo.toml updates all workspace crates to 0.12.1, which is correct for a release. However, the change does not include any validation or checks to ensure that all crates are consistently updated to the same version, potentially leading to version mismatches in the future. version = "0.12.1" edition = "2021" # Minimum supported Rust version, set by the dependency floor: wasmtime 47 # requires rustc 1.94. Enforced by the `msrv` CI job. rust-version = "1.94" license = "AGPL-3.0-only" repository = "https://github.com/barbacane-dev/Barbacane" homepage = "https://github.com/barbacane-dev/Barbacane" keywords = ["api-gateway", "openapi", "wasm", "proxy", "middleware"] categories = ["web-programming::http-server", "network-programming"] [workspace.dependencies] # Serialization serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yaml = "0.9" # Async runtime # Narrowed from "full": only the features the workspace actually uses (rt + # multi/current-thread runtimes, macros, timers, sync primitives, net, async IO, # fs, and signal for graceful shutdown). Dependencies request their own tokio # features independently, so this does not affect them. tokio = { version = "1", features = [ "rt-multi-thread", "macros", "time", "sync", "net", "io-util", "fs", "signal", ] } # HTTP hyper = { version = "1", features = ["server", "http1", "http2"] } hyper-util = { version = "0.1", features = ["tokio", "server-auto", "server-graceful"] } http-body-util = "0.1" http = "1" bytes = "1.11.1" # WebSocket tokio-tungstenite = { version = "0.28", features = ["rustls-tls-webpki-roots"] } # CLI clap = { version = "4", features = ["derive", "env"] } # Error handling thiserror = "2" anyhow = "1" # Crypto sha2 = "0.10" hmac = "0.12" hex = "0.4" ring = "0.17" # Archive flate2 = "1" tar = "0.4" # HTTP client reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "gzip", "stream", "blocking"] } # NATS client async-nats = "0.47" # Kafka client rskafka = "0.6" ldap3 = { version = "0.12", default-features = false, features = ["tls-rustls-aws-lc-rs"] } # TLS rustls = { version = "0.23", features = ["aws-lc-rs"] } tokio-rustls = "0.26" rustls-pemfile = "2" rcgen = "0.13" # Sync primitives parking_lot = "0.12" # JSON Schema validation jsonschema = "0.26" # SecLang/CRS engine (ADR-0031), published as `barbacane-waf`. parapet = { package = "barbacane-waf", version = "0.1.1", features = ["serde"] } # WASM runtime wasmtime = { version = "47", features = ["cranelift", "pooling-allocator"] } wasmtime-wasi = { version = "47" } # Plugin manifest toml = "0.8" semver = "1" regex-lite = "0.1" # Concurrency dashmap = "6" futures-util = "0.3" # Random rand = "0.9" # Encoding base64-simd = "0.8" # Logging & Telemetry tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["json", "env-filter", "fmt"] } tracing-opentelemetry = "0.33" opentelemetry = "0.32" opentelemetry_sdk = { version = "0.32", features = ["rt-tokio"] } opentelemetry-otlp = { version = "0.32", features = ["http-proto", "grpc-tonic"] } prometheus-client = "0.22" uuid = { version = "1", features = ["v4", "v7", "serde"] } # Web framework (control plane) axum = { version = "0.8", features = ["multipart"] } tower = { version = "0.5", features = ["util"] } tower-http = { version = "0.6", features = ["trace", "cors", "set-header"] } # Database (control plane) sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "uuid", "chrono", "json"] } chrono = { version = "0.4", features = ["serde", "clock"] } base64 = "0.22" tempfile = "3" notify = "7" # Proc macros syn = { version = "2", features = ["full", "parsing"] } quote = "1" proc-macro2 = "1" # Benchmarking criterion = { version = "0.5", features = ["html_reports"] } wat = "1" # CLI testing assert_cmd = "2" predicates = "3" # Workspace crates (version required for crates.io publishing) barbacane-sigv4 = { path = "crates/barbacane-sigv4", version = "0.12.1" } barbacane-compiler = { path = "crates/barbacane-compiler", version = "0.12.1" } barbacane-plugin-sdk = { path = "crates/barbacane-plugin-sdk", version = "0.12.1" } barbacane-plugin-macros = { path = "crates/barbacane-plugin-macros", version = "0.12.1" } barbacane-wasm = { path = "crates/barbacane-wasm", version = "0.12.1" } barbacane-telemetry = { path = "crates/barbacane-telemetry", version = "0.12.1" } barbacane-test = { path = "crates/barbacane-test", version = "0.12.1" } barbacane = { path = "crates/barbacane", version = "0.12.1" } barbacane-control = { path = "crates/barbacane-control", version = "0.12.1" }