[jamesyong-42]

Ships 0.13.2, the security patch for 0.13.1's prebuilt daemons. It carries the three PRs merged since 0.13.1:

• chore(deps): ctutils 0.4.5 for RUSTSEC-2026-0385 #69 moved Cargo.lock to ctutils 0.4.5 for RUSTSEC-2026-0385.
• test(soak): the Windows handle rate is per session churned; the retained handle is recorded as open #70 fixed the lifecycle soak's Windows handle metric and recorded the retained Windows handle as open.
• chore(deps): tokio 1.53.3 for RUSTSEC-2026-0386 and zod 4.6.7 for GHSA-mrhx-c7xc-m3w5 #71 moved Cargo.lock to tokio 1.53.3 for RUSTSEC-2026-0386, and the dev-only zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5.

Why now. 0.13.1's prebuilt ghosttead daemons on npm embed ctutils 0.4.3 and tokio 1.52.3. Both advisories entered their databases on 2026-10-23, after 0.13.1's audits had passed. 0.13.2's daemons build against ctutils 0.4.5 and tokio 1.53.3. The crates carry no lockfile, so crates.io consumers resolve their own versions.

The commits in this PR

• 827478b chore(audit): one dated comment line under RUSTSEC-2026-0192's ignore. The ignore said to revisit by 2026-10-23, and the re-read found that fontdb 0.24.0 drops ttf-parser. The ignore stays: it is an unmaintained notice with no patched version. Moving ghosttea-text to fontdb 0.24 is its own lane after this release.
• 8263cf0 release: 0.13.2: a pure bump made the way ccfb3e4 and 1541256 were. It is 45 replacements in 20 manifests, Cargo.lock moves only the 11 workspace versions, and it touches 1541256's 28 files. CHANGELOG.md gains the dated 0.13.2 section:
  • Fixed: RUSTSEC-2026-0385 and RUSTSEC-2026-0386, each by id;
  • Validation: the soak metric;
  • zod gets no line, because nothing shipped changes.
• 22e25cd release: pin 0.13.2 Apple native artifact: the rebuilt artifact.

It is a patch. No public declaration, wire shape or default changes. The daemons move two dependencies, and the rest is a test, docs, one audit-config comment and dev tooling.

The Apple native artifact is rebuilt. Cargo.lock is one of its source inputs. #69, #71 and the bump moved the native source digest from the pinned 0.13.1 artifact's fa08d019… to 0c9f828e…, so check:apple-native-artifact requires a new publication.

• Run 40047394201 built the candidate from 8263cf0. It ran the complete GhostteaKit SwiftPM suite, linked every public product against the candidate, and published ghosttea-apple-native-21a593e3611b (checksum 41e7a5ec…) through the release environment.
• The pin commit records it: the lock equals the served JSON, shasum -a 256 equals swift package compute-checksum, and the tree's digest equals the served sourceDigest.

A full release. Like every release, 0.13.2 publishes all 10 npm packages and 7 Rust crates under one shared version, and npm's latest moves to 0.13.2.

Checks

• Desktop gates 40052699512 and iOS release hardening 40052701856 on the head.
• This PR's own checks run again on the head. audit-published runs check:apple-native-artifact:release and links every public product against the published artifact.
• The artifact run's candidate job is the Swift compile proof. The iOS hardening workflow checks manifests, the BOM and resources; it does not compile Swift.
• Local checks:
  • cargo audit is clean, and npm audit at high is 0 (3 moderates, all dev tooling);
  • check:apple-native-artifact and check:swiftpm:manifests pass on the pinned tree;
  • the iOS BOM, release-resources and App Store checks pass;
  • the release-notes, release-channel and npm-publisher tests pass 31/31;
  • node scripts/release-notes.mjs 0.13.2 renders Fixed with both advisory ids, and Validation.
• Both audits ran in each push command, and each push ran only because both exited 0.
• ci:desktop did not run locally. This Mac had no build window, so the compile and test proof is CI's.

After the merge, James signs and pushes v0.13.2 on the merge commit, as with 0.13.1 (ee3b721e).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}