chore: release v1.24.0

[jdx]

🤖 New release: v1.24.0

This PR bumps the workspace to v1.24.0 and regenerates CHANGELOG entries, aube.usage.kdl, the CLI docs, and the benchmark results.

See the diff for the full set of changes, or the per-crate CHANGELOG.md files for the release notes that will ship.

---

Generated by the release-plz-pr workflow.

---

Note

Medium Risk
The tag bundles install integrity, trust-policy-on-lockfile-reuse, and OSV-on-add behavior; this PR is mostly versioning/docs but those areas are security-sensitive for consumers upgrading.

Overview
Release v1.24.0 — mechanical version bump from 1.23.0 to 1.24.0 across Cargo.toml, Cargo.lock, all workspace crate entries, aube.usage.kdl, docs/cli/*, and release.json (releasedAt updated).

Per-crate and root CHANGELOG sections are added for 1.24.0 (2026-06-23), recording what ships in this tag. Highlights from crates/aube/CHANGELOG.md:

Added: managed hardening config; install --dry-run resolution preview; SBOM tweaks (exclude peer-only, mark dev-only CycloneDX); view infers package name from manifest.

Fixed: persist computed tarball integrity on install; validate trust policy when reusing the lockfile; recursive run honors --no-bail; add OSV check for exact pins.

Several crates only note benchmark refresh (#922); resolver/store changelogs call out trust-policy and integrity fixes explicitly.

^{Reviewed by Cursor Bugbot for commit cfa8c94. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Version bump from 1.23.0 to 1.24.0 across the workspace: Cargo.toml workspace and internal crate version fields, aube.usage.kdl, CLI docs (docs/cli/commands.json, docs/cli/index.md), release.json (version + timestamp), and a new [1.24.0] changelog section in each of the 13 per-crate CHANGELOG.md files with feature, fix, and benchmark refresh notes.

Changes

v1.24.0 Release Bump

Layer / File(s)	Summary
Workspace and crate version fields Cargo.toml, aube.usage.kdl, docs/cli/commands.json, docs/cli/index.md, release.json	Bumps [workspace.package].version and all internal aube* crate version fields from 1.23.0 to 1.24.0; updates the CLI usage KDL version, CLI docs version string, and release.json version + releasedAt timestamp to 2026-06-23T17:50:23Z.
Per-crate changelog entries for 1.24.0 crates/aube/CHANGELOG.md, crates/aube-codes/CHANGELOG.md, crates/aube-linker/CHANGELOG.md, crates/aube-lockfile/CHANGELOG.md, crates/aube-manifest/CHANGELOG.md, crates/aube-registry/CHANGELOG.md, crates/aube-resolver/CHANGELOG.md, crates/aube-runtime/CHANGELOG.md, crates/aube-scripts/CHANGELOG.md, crates/aube-settings/CHANGELOG.md, crates/aube-store/CHANGELOG.md, crates/aube-util/CHANGELOG.md, crates/aube-workspace/CHANGELOG.md	Inserts a [1.24.0] release section (dated 2026-06-23) with an Other bullet noting refreshed benchmarks for v1.23.0 (PR #922) into every crate's changelog. The main aube/CHANGELOG.md also includes Added entries for dry-run resolution preview, SBOM dev-only component marking, and inferring package name from manifest, plus Fixed entries for honoring recursive no-bail exits, validating trust policy on lockfile reuse, and checking exact pins with a versioned OSV gate. The aube-resolver/CHANGELOG.md includes a Fixed entry for validating trust policy on lockfile reuse.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• jdx/aube#909: Same release-version regeneration across the same files and fields, bumping to the next minor version with coordinated changelog updates.
• jdx/aube#894: Performs the same coordinated version bump pattern across Cargo.toml, aube.usage.kdl, docs/cli/*, release.json, and per-crate changelogs.
• jdx/aube#847: Identical release automation pattern bumping workspace/crate versions, CLI version strings, and changelog entries.

Poem

🐇 The rabbit hops with glee so bright,
Twenty-four's the version right,
Thirteen changelogs, dry-run's in sight,
Trust policies locked, SBOM's tight—
1.24.0 bounces into the night! 🌙

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore: release v1.24.0' clearly and concisely summarizes the main purpose of this release PR—bumping the version to v1.24.0 and regenerating associated files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This is an automated release-plz release PR that bumps the entire workspace from v1.23.0 to v1.24.0. All 13 crates, the lockfile, aube.usage.kdl, CLI docs, and release.json are updated consistently.

• Version bumps: Cargo.toml workspace version and all 13 internal crate version pins updated to 1.24.0; Cargo.lock reflects only internal crate changes with no external dependency drift.
• Changelogs: v1.24.0 sections added across all per-crate CHANGELOG.md files; the main aube crate changelog captures 5 new features (managed hardening config, SBOM improvements, dry-run resolution preview, view manifest inference) and 4 fixes (tarball integrity persistence, recursive no-bail exits, trust policy on lockfile reuse, OSV gate for exact pins).
• Docs & metadata: docs/cli/commands.json, docs/cli/index.md, and aube.usage.kdl all updated to 1.24.0; release.json timestamp updated to 2026-06-23T18:58:46Z.

Confidence Score: 5/5

Fully automated release-plz PR with no logic changes — safe to merge.

Every changed file is generated release metadata: version strings, changelogs, and docs. No Rust source code or configuration logic was modified. All 13 internal crate versions are in sync across Cargo.toml, Cargo.lock, aube.usage.kdl, docs/, and release.json.

No files require special attention.

Important Files Changed

Filename	Overview
Cargo.toml	Workspace version and all 13 internal crate version pins bumped from 1.23.0 to 1.24.0; no other changes.
Cargo.lock	All 13 internal aube crates updated from 1.23.0 to 1.24.0; no external dependency changes.
crates/aube/CHANGELOG.md	New v1.24.0 section added with 5 features (managed hardening config, SBOM improvements, dry-run, view inference) and 4 fixes (tarball integrity, no-bail exits, trust policy, OSV gate).
release.json	Version updated to 1.24.0 and releasedAt timestamp updated to 2026-06-23T18:58:46Z.
crates/aube-resolver/CHANGELOG.md	New v1.24.0 section added noting the trust policy validation fix on lockfile reuse and benchmark refresh.
crates/aube-store/CHANGELOG.md	New v1.24.0 section added noting the tarball integrity persistence fix and benchmark refresh.

_{Reviews (12): Last reviewed commit: "chore: release v1.24.0" | Re-trigger Greptile}

[github-actions]

Benchmark changes

Versions:

• aube: 1.23.0 -> 1.24.0

Public ratios: warm installs vs Bun 2x -> 1.9x; warm installs vs pnpm 5x -> 4x.

Benchmark	aube	bun	pnpm
Fresh install (warm cache)	669ms -> 780ms (+17%)	1669ms -> 1462ms (-12%)	3236ms -> 2964ms (-8%)
Fresh install (cold cache)	7592ms -> 16465ms (+117%)	5702ms -> 5832ms (+2%)	12623ms -> 11502ms (-9%)

cfa8c94 vs 7cad846 | aube/bun/pnpm | 3 scenarios | 3 runs | 500mbit/50ms | generated by Codex.