[p4suta-release-plz]

🤖 New release

• windows-spawn: 0.1.0 -> 0.2.0 (⚠ API breaking changes)

⚠ windows-spawn breaking changes

--- failure enum_missing: pub enum removed or renamed ---

Description:
A publicly-visible enum cannot be imported by its prior path. A `pub use` may have been removed, or the enum itself may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_missing.ron

Failed in:
  enum windows_spawn::DropPolicy, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\options.rs:18
  enum windows_spawn::FontDisable, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\mitigation.rs:79

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  MitigationPolicy::font_disable, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\mitigation.rs:299
  SpawnOptions::mitigation, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\options.rs:174
  SpawnOptions::pseudoconsole, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\options.rs:181
  SpawnOptions::creation_flags, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\options.rs:188
  SpawnOptions::drop_policy, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\options.rs:195
  SuspendedChild::primary_thread_handle, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\child.rs:281

--- failure method_requires_different_generic_type_params: method now requires a different number of generic type parameters ---

Description:
A method now requires a different number of generic type parameters than it used to. Uses of this method that supplied the previous number of generic types will be broken.
        ref: https://doc.rust-lang.org/reference/items/generics.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/method_requires_different_generic_type_params.ron

Failed in:
  windows_spawn::Job::assign takes 1 generic types instead of 0, in C:\Users\runneradmin\AppData\Local\Temp\.tmpxW7F0k\windows-spawn\src\handles.rs:239

--- failure struct_missing: pub struct removed or renamed ---

Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_missing.ron

Failed in:
  struct windows_spawn::CreationFlags, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\options.rs:31

--- failure trait_method_added: pub trait method added ---

Description:
A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_method_added.ron

Failed in:
  trait method windows_spawn::AsPseudoConsole::as_pseudo_console in file C:\Users\runneradmin\AppData\Local\Temp\.tmpxW7F0k\windows-spawn\src\handles.rs:329

--- failure trait_method_missing: pub trait method removed or renamed ---

Description:
A trait method is no longer callable, and may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-item-signature
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_method_missing.ron

Failed in:
  method raw_pseudoconsole of trait AsPseudoConsole, previously in file C:\Users\runneradmin\AppData\Local\Temp\.tmp8IpVto\windows-spawn\src\handles.rs:214

--- failure trait_unsafe_removed: pub unsafe trait became safe ---

Description:
A formerly-unsafe public trait became safe, so it is no longer allowed to be implemented with an `unsafe impl` block.
        ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_unsafe_removed.ron

Failed in:
  trait windows_spawn::AsPseudoConsole in file C:\Users\runneradmin\AppData\Local\Temp\.tmpxW7F0k\windows-spawn\src\handles.rs:327

Changelog

0.2.0 - 2026-10-26

Added

• [breaking] design the 0.2 API and prove the spawn decisions (#33)
• render the command line for launch brokers (#17)

Other

• (deps) update dependency ubuntu to v26 (#61)
• qualify heavy checks only for releases (#65)
• update Windows runners to 2025 (#62)
• (deps) update all non-major dependencies (#60)
• (deps) update dtolnay/rust-toolchain digest to 683b588 (#59)
• verify Context7 library ownership (#58)
• (ci) use purpose-scoped Doppler credentials (#55)
• (deps) update all non-major dependencies (#30)
• select checks and preserve Rust 1.84 compatibility (#54)
• remove generated development metadata (#51)
• target hosted assurance at native safety boundaries (#49)
• (deps) lock file maintenance (#47)
• record the reason for the Rust 1.84 MSRV (#46)
• [breaking] require Rust 1.84 and let lint exceptions expire (#43)
• cut the nightly deep verification to about an hour (#41)
• (deps) lock file maintenance (#31)
• stress, fuzz, and run the spawn where bounded tests stop (#39)
• make spawn state and handle types explicit (#36)
• add the required aggregate job (#29)
• release only from a signed tag and an approved deployment (#27)
• (deps) move dependency updates from Dependabot to Renovate (#25)
• enforce the repository laws mechanically (#24)
• inject Win32 failures to cover every error path (#23)
• run mutation testing on rust-mutants (#22)
• drain ConPTY output continuously and ban time in code (#21)
• prove lifecycle properties by events, not time (#20)
• make all prose terse and one sentence per line (#18)

The 0.2 API follows std::process and places each choice on the type that owns it, as ADR 0015 records; docs/migration-0.2.md maps every 0.1 item.

Added

• Command::own_process_tree, which makes Child::kill, dropping the Child, and output collection end the child's whole process tree.
• Child::wait_tree, which waits until every process of an owned tree has exited.
• Command::console with ConsoleMode, Command::priority with PriorityClass, and one Command setter for each creation flag.
• SpawnError, which keeps whether input was rejected, which Windows operation failed in which phase, and which releases failed; windows_spawn::Result.
• BorrowedPseudoConsole with borrow_raw, for a raw HPCON.
• From<ChildStdin>, From<ChildStdout>, From<ChildStderr>, From<io::Stdout>, and From<io::Stderr> for Stdio; Write for &ChildStdin; AsRawHandle for the handle types.
• ValidationError::CommandLineTooLong and ValidationError::PseudoConsoleWithConsoleMode, which reject a spawn before CreateProcessW runs.
• Formal verification in layers, as ADR 0014 records.
  Kani proves the decision cores, and Lean and Verus prove that the C runtime parsers read back every encoded command line.
  Models in TLA+, Quint, Alloy, and Prolog check output draining, the child lifecycle, the handle transfer, and the program search.
  cargo xtask proofs runs them, and Windows tests replay the models' vectors and traces through the crate.
• Seeded random command lines and environments that Windows tests pass through the crate into children, and cargo xtask verifier, which runs the Windows tests under appverif.exe.

Changed

• Fallible calls return SpawnError instead of io::Error; it converts into io::Error, keeping the code Windows reported.
• Every spawn creates its process suspended and resumes it only after releasing the attribute list and the transferred duplicates.
  A release that fails terminates the process before it runs.
• Child::kill returns Ok once the process has exited, as std::process::Child::kill does.
• The mitigation, console, and creation-flag choices moved from SpawnOptions to Command; SpawnOptions lends only Jobs, an alternate parent, and a pseudoconsole.
• AsPseudoConsole is a safe trait returning a BorrowedPseudoConsole, and SpawnOptions::pseudo_console replaces SpawnOptions::pseudoconsole.
• MitigationPolicy::dep, dep_atl_thunk, and sehop take Dep, AtlThunkEmulation, and Sehop; FontDisable and font_disable are NonSystemFonts and non_system_fonts.
• SuspendedChild::primary_thread_handle is main_thread_handle.
• Job::assign takes any process handle.
• Debug prints a Command as std does.
• SuspendedChild::id is const, like Child::id, and returns the identifier recorded at creation, so it cannot panic.
• The MSRV is Rust 1.84, as ADR 0018 records.
• Command::own_process_tree, console, priority, mitigation, and the creation-flag setters are const fn.

Removed

• DropPolicy, replaced by Command::own_process_tree.
• CreationFlags and SpawnOptions::creation_flags, replaced by the Command setters.

Fixed

• Command::to_command_line accepts a PATH set from a handle when a later operation replaces or removes it, as a spawn does.
• An attribute-list size beyond one allocation returns an error instead of panicking.

---

This PR was generated with release-plz.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 361b79d2-20bb-49bb-865b-fe1fe1344557

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}