CI: Fuegt automatisiertes Nightly-Release hinzu und behebt Zeitzone bei geplanten Workflows

- Neuer Workflow "nightly-pr.yaml": Erstellt und merged taeglich automatisch einen Pull Request von dev nach nightly (09:00 Uhr Europe/Berlin); legt den nightly-Branch bei Bedarf initial von dev an. - Neuer Workflow "nightly.yaml": Baut und veroeffentlicht Pakete bei Aenderungen auf nightly in den nightly-Kanal der Paket-Registry (Debian/RPM/Arch); erstellt bewusst kein Gitea-Release. - CRON_TZ=Europe/Berlin in security-scan.yaml und trufflehog-scan.yaml ergaenzt: Gitea Actions interpretiert schedule-Cron sonst in der lokalen Zeitzone des Gitea-Servers statt in der beabsichtigten Zeitzone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
CI: Renovate-Schedule von wöchentlich auf täglich verkürzt
2026-09-21 00:23:05 +02:00 · 2026-09-20 23:36:46 +02:00 · 2026-09-20 23:27:01 +02:00 · 2026-09-20 23:17:57 +02:00 · 2026-09-20 10:07:59 +00:00 · 2026-09-20 09:02:04 +00:00
23 changed files with 464 additions and 733 deletions
@@ -10,6 +10,3 @@ git-fetch-with-cli = true

 [target.aarch64-unknown-linux-gnu]
 linker = "aarch64-linux-gnu-gcc"
-
-[target.i686-unknown-linux-gnu]
-linker = "i686-linux-gnu-gcc"
@@ -24,16 +24,14 @@ jobs:
          components: clippy, rustfmt
          cache: false

+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
+        uses: Swatinem/rust-cache@v2

      - name: Formatierung automatisch beheben
        run: cargo fmt
@@ -47,16 +47,14 @@ jobs:
          toolchain: stable
          cache: false

+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
+        uses: Swatinem/rust-cache@v2

      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
        run: rm -rf target/debian target/generate-rpm target/arch
@@ -64,7 +62,7 @@ jobs:
      - name: Install Cross-Compilation Toolchains (apt)
        run: |
          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
+          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
@@ -75,12 +73,11 @@ jobs:
        with:
          path: |
            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
-            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}

      - name: Add Rust Cross-Compilation Targets
        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
-        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+        run: rustup target add aarch64-unknown-linux-gnu

      - name: PATH um Cargo-bin-Verzeichnis ergänzen
        run: |
@@ -111,7 +108,6 @@ jobs:
        run: |
          cargo build --release --target x86_64-unknown-linux-gnu
          cargo build --release --target aarch64-unknown-linux-gnu
-          cargo build --release --target i686-unknown-linux-gnu

      - name: Determine Build Number
        id: build_num
@@ -130,20 +126,17 @@ jobs:
        run: |
          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
-          cargo deb --target i686-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build

      - name: Build Fedora / RPM Packages (.rpm)
        run: |
          mkdir -p target/generate-rpm
          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
-          cargo generate-rpm --target i686-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm

      - name: Build Arch Linux Packages (.pkg.tar.zst)
        run: |
          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
-          python3 scripts/package-arch.py --target i686-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"

      - name: Publish Packages to Gitea Package Registry
        env:
@@ -0,0 +1,91 @@
+name: Nightly Auto-Merge (Dev → Nightly)
+
+on:
+  schedule:
+    # Gitea Actions interpretiert 'schedule'-Cron standardmaessig in der lokalen
+    # Zeitzone des Gitea-Servers (anders als GitHub Actions, das immer UTC nutzt).
+    # Das CRON_TZ-Praefix ist eine Gitea-Erweiterung und legt die Zeitzone explizit
+    # und DST-sicher fest, unabhaengig von der Server-Konfiguration.
+    - cron: "CRON_TZ=Europe/Berlin 0 9 * * *"
+  workflow_dispatch:
+
+jobs:
+  merge-dev-into-nightly:
+    name: Erstelle & merge automatisch PR von dev nach nightly
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+
+      - name: Stelle sicher, dass der nightly-Branch existiert
+        run: |
+          git fetch origin dev
+          if git ls-remote --exit-code --heads origin nightly > /dev/null 2>&1; then
+            echo "nightly-Branch existiert bereits."
+          else
+            echo "nightly-Branch existiert noch nicht, erstelle ihn initial von dev..."
+            git push origin origin/dev:refs/heads/nightly
+          fi
+
+      - name: Prüfe auf Unterschiede zwischen dev und nightly
+        id: diff
+        run: |
+          git fetch origin nightly
+          if git diff --quiet origin/nightly origin/dev; then
+            echo "Keine Unterschiede zwischen dev und nightly, überspringe."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Prüfe auf bereits offenen PR nach nightly
+        id: check_pr
+        if: steps.diff.outputs.has_changes == 'true'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          OPEN_PRS=$(curl -s -H "Authorization: token ${TOKEN}" "${GITEA_URL}/api/v1/repos/${REPO}/pulls?state=open&limit=50")
+          PR_NUMBER=$(echo "$OPEN_PRS" | jq -r '[.[] | select(.base.ref == "nightly" and .head.ref == "dev")][0].number // empty')
+          echo "Bereits offener dev→nightly PR: ${PR_NUMBER:-keiner}"
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Erstelle PR (dev -> nightly)
+        id: create_pr
+        if: steps.diff.outputs.has_changes == 'true' && steps.check_pr.outputs.pr_number == ''
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          DATE="$(date -u +%Y-%m-%d)"
+          PAYLOAD=$(jq -n --arg title "Nightly-Build: Merge dev in nightly (${DATE})" --arg head "dev" --arg base "nightly" \
+            '{title: $title, head: $head, base: $base}')
+          RESP=$(curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls")
+          PR_NUMBER=$(echo "$RESP" | jq -r '.number')
+          echo "PR #${PR_NUMBER} erstellt."
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Merge PR automatisch
+        if: steps.diff.outputs.has_changes == 'true'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+          PR_NUMBER: ${{ steps.create_pr.outputs.pr_number || steps.check_pr.outputs.pr_number }}
+        run: |
+          echo "Merge PR #${PR_NUMBER} automatisch (dev -> nightly)..."
+          curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do": "merge"}' \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/merge"
+          echo "PR #${PR_NUMBER} erfolgreich gemerged."
@@ -0,0 +1,166 @@
+name: Nightly Build & Publish
+
+on:
+  push:
+    branches:
+      - nightly
+
+jobs:
+  detect-changes:
+    name: Erkenne relevante Code-Änderungen
+    runs-on: ubuntu-latest
+    outputs:
+      code_changed: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Prüfe auf Änderungen am Programmcode
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'src/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'scripts/**'
+              - '.cargo/**'
+              - '.gitea/workflows/nightly.yaml'
+
+  build-and-publish:
+    name: Build & Publish Packages (Nightly)
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache: false
+
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
+        run: |
+          mkdir -p ~/.cargo/bin
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/bin/cargo-binstall
+            ~/.cargo/bin/cargo-deb
+            ~/.cargo/bin/cargo-generate-rpm
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
+
+      - name: Run Tests
+        run: |
+          cargo test
+
+      - name: Build Release Binaries
+        run: |
+          cargo build --release --target x86_64-unknown-linux-gnu
+          cargo build --release --target aarch64-unknown-linux-gnu
+
+      - name: Determine Build Number
+        id: build_num
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          BUILD_NUM=$(python3 scripts/get-build-number.py)
+          echo "build_number=${BUILD_NUM}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUM}" >> $GITHUB_ENV
+          echo "Ermittelte Build-Nummer: ${BUILD_NUM}"
+
+      - name: Build Debian Packages (.deb)
+        run: |
+          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+
+      - name: Build Fedora / RPM Packages (.rpm)
+        run: |
+          mkdir -p target/generate-rpm
+          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+
+      - name: Build Arch Linux Packages (.pkg.tar.zst)
+        run: |
+          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+
+      - name: Publish Packages to Gitea Package Registry
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          echo "Veröffentliche Debian-Paket (Distribution: nightly, Component: main)..."
+          for deb in target/debian/*.deb; do
+            [ -f "$deb" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$deb" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/debian/pool/nightly/main/upload"
+          done
+
+          echo "Veröffentliche Fedora/RPM-Paket (Gruppe: nightly)..."
+          for rpm in target/generate-rpm/*.rpm; do
+            [ -f "$rpm" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$rpm" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/rpm/nightly/upload"
+          done
+
+          echo "Veröffentliche Arch Linux-Paket (Repository: nightly)..."
+          for pkg in target/arch/*.pkg.tar.zst; do
+            [ -f "$pkg" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$pkg" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/arch/nightly"
+          done
@@ -9,7 +9,7 @@ jobs:
  renovate:
    name: Dependency-Updates prüfen & Pull Requests erstellen
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:44.82.0
+    container: ghcr.io/renovatebot/renovate:44.103.6
    steps:
      - name: Renovate ausführen
        run: renovate
@@ -8,7 +8,7 @@ on:
      - dev
  pull_request:
  schedule:
-    - cron: "0 5 * * 1"
+    - cron: "CRON_TZ=Europe/Berlin 0 5 * * 1"
  workflow_dispatch:

 jobs:
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    env:
      TRIVY_VERSION: "0.74.0"
-      OSV_SCANNER_VERSION: "2.5.1"
+      OSV_SCANNER_VERSION: "2.6.0"
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
@@ -47,16 +47,14 @@ jobs:
          toolchain: stable
          cache: false

+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
+        uses: Swatinem/rust-cache@v2

      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
        run: rm -rf target/debian target/generate-rpm target/arch
@@ -64,7 +62,7 @@ jobs:
      - name: Install Cross-Compilation Toolchains (apt)
        run: |
          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
+          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
@@ -75,12 +73,11 @@ jobs:
        with:
          path: |
            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
-            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}

      - name: Add Rust Cross-Compilation Targets
        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
-        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+        run: rustup target add aarch64-unknown-linux-gnu

      - name: PATH um Cargo-bin-Verzeichnis ergänzen
        run: |
@@ -111,7 +108,6 @@ jobs:
        run: |
          cargo build --release --target x86_64-unknown-linux-gnu
          cargo build --release --target aarch64-unknown-linux-gnu
-          cargo build --release --target i686-unknown-linux-gnu

      - name: Determine Build Number
        id: build_num
@@ -130,20 +126,17 @@ jobs:
        run: |
          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
-          cargo deb --target i686-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build

      - name: Build Fedora / RPM Packages (.rpm)
        run: |
          mkdir -p target/generate-rpm
          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
-          cargo generate-rpm --target i686-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm

      - name: Build Arch Linux Packages (.pkg.tar.zst)
        run: |
          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
-          python3 scripts/package-arch.py --target i686-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"

      - name: Publish Packages to Gitea Package Registry
        env:
@@ -4,7 +4,7 @@ on:
  push:
  pull_request:
  schedule:
-    - cron: "0 6 * * 1"
+    - cron: "CRON_TZ=Europe/Berlin 0 6 * * 1"
  workflow_dispatch:

 jobs:
@@ -12,7 +12,7 @@ jobs:
    name: TruffleHog
    runs-on: ubuntu-latest
    env:
-      TRUFFLEHOG_VERSION: "3.97.4"
+      TRUFFLEHOG_VERSION: "3.97.5"
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
@@ -8,6 +8,7 @@ on:
      - reopened
    branches:
      - testing
+      - dev

 jobs:
  test:
@@ -23,16 +24,14 @@ jobs:
          toolchain: stable
          cache: false

+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
+        uses: Swatinem/rust-cache@v2

      - name: Run Tests
        run: cargo test
@@ -19,7 +19,7 @@ Die Orchestrierung dieser drei Schritte liegt in `src/resolver.rs`; `src/main.rs
 Zur Laufzeit werden folgende System-Tools benötigt: `ip` (iproute2), `ping` (iputils), `nmap`, `sudo` (nur für Schritt 3, falls nicht schon root). Diese sind in den Paketierungs-Metadaten (`Cargo.toml`, siehe §3.2) als Abhängigkeiten hinterlegt.

 Das Projekt basiert auf einem generischen **Rust-Projekt-Template** für Linux-Anwendungen/CLI-Tools mit Fokus auf:
- Automatisierte Multi-Architektur-Kompilierung (`x86_64`, `aarch64`, `i686`).
+- Automatisierte Multi-Architektur-Kompilierung (`x86_64`, `aarch64`; `i686` derzeit ausgesetzt, siehe §5.2.1).
 - Native Paketierung für Debian (`.deb`), Fedora/RHEL (`.rpm`) und Arch Linux (`.pkg.tar.zst`).
 - Vollständig automatisierte CI/CD-Pipelines via Gitea Actions (kompatibel mit Forgejo / GitHub Actions).
 - Automatisierte Sicherheits-Scans (Schwachstellen, Secrets) und Dependency-Updates.
@@ -27,7 +27,7 @@ Das Projekt basiert auf einem generischen **Rust-Projekt-Template** für Linux-A
 ### Standards & Tech-Stack
 - **Sprache**: Rust (Edition 2024), Python 3 (für Hilfsskripte in `scripts/`).
 - **Rust Toolchain**: Stable.
- **Zielplattform**: Linux (GLIBC-basiert, Cross-Kompilierung für `x86_64-unknown-linux-gnu`, `aarch64-unknown-linux-gnu`, `i686-unknown-linux-gnu`).
+- **Zielplattform**: Linux (GLIBC-basiert, Cross-Kompilierung für `x86_64-unknown-linux-gnu`, `aarch64-unknown-linux-gnu`; `i686-unknown-linux-gnu` derzeit ausgesetzt, siehe §5.2.1).
 - **Sicherheits-Tooling**: Trivy, OSV-Scanner, TruffleHog (Secret-Scanning), Renovate (Dependency-Updates), Qodana (statische Codeanalyse).
 - **Lizenz**: GPL-3.0-or-later (sofern nicht im abgeleiteten Projekt anders definiert).

@@ -152,6 +152,23 @@ Alle Workflows liegen unter `.gitea/workflows/` und nutzen gecachte Abhängigkei
 - **`qodana.yaml`**: Konfiguration für JetBrains Qodana (statische Codeanalyse, Profil `qodana.starter`); wird über eine externe/IDE-seitige Qodana-CI-Integration ausgeführt, nicht über einen eigenen Gitea-Workflow in diesem Template.
 - **`renovate.yaml`** (Trigger: wöchentlich montags 04:00 UTC, `workflow_dispatch`): Führt Renovate (Container-Image, gepinnte Version) gegen die Gitea-Plattform aus und erstellt Pull Requests für veraltete Abhängigkeiten gemäß `renovate.json`.

+### 5.2.1 Bekannte Sicherheits-Workarounds (temporär, mit Revert-Bedingung)
+
+Workarounds für Schwachstellen in transitiven Abhängigkeiten, die nicht direkt
+per Versions-Bump behoben werden können (z. B. weil ein Zwischenpaket eine zu
+enge Versionsanforderung pinnt). Vor jedem Renovate-Merge/Dependency-Update
+prüfen, ob die Revert-Bedingung inzwischen erfüllt ist.
+
+| Advisory | Betroffenes Paket | Workaround | Wo dokumentiert | Revert-Bedingung |
+| :--- | :--- | :--- | :--- | :--- |
+| [RUSTSEC-2026-0253](https://rustsec.org/advisories/RUSTSEC-2026-0253.html) (Use-after-free in `LruCache::pop()`) | `lru` < 0.18.2, transitiv über `turso -> turso_core -> tantivy` | `fts`-Default-Feature von `turso` deaktiviert (`Cargo.toml`) — mac2ip nutzt keine Volltextsuche, dadurch entfällt `tantivy`/`lru` komplett aus dem Dependency-Baum | Kommentar direkt über der `turso`-Zeile in `Cargo.toml` | Sobald `cargo update -p lru --precise 0.18.2` erfolgreich ist (d. h. eine stabile `turso`-Version eine `tantivy`-Version mit `lru >= 0.18.2` zulässt): `turso`-Zeile zurück auf `turso = "0.7"` (oder aktueller) ändern, `cargo update -p turso`, und `cargo tree -i lru` zur Kontrolle. |
+
+### 5.2.2 Bekannte Build-Einschränkungen (temporär, mit Revert-Bedingung)
+
+| Einschränkung | Ursache | Workaround | Wo dokumentiert | Revert-Bedingung |
+| :--- | :--- | :--- | :--- | :--- |
+| Kein `i686-unknown-linux-gnu`-Build/-Paket mehr | `turso_sdk_kit` (Abhängigkeit von `turso`) fordert von `turso_core` unconditional das Feature `io_uring` an (nicht abschaltbar wie `fts`). Die `io-uring`-Crate (aktuell 0.7.15, neueste Version) liefert vorgefertigte FFI-Bindings nur für `x86_64`, `aarch64`, `riscv64`, `powerpc64`, `loongarch64` - **nicht** für `i686`. `--cfg=io_uring_skip_arch_check` würde auf i686 stillschweigend die x86_64-Bindings verwenden (falsche Struct-Layouts/Pointer-Breite -> potenzielle Speicherkorruption bei io_uring-Syscalls) und wurde deshalb bewusst NICHT verwendet. | `i686-unknown-linux-gnu` komplett aus den Build-Targets entfernt: `.cargo/config.toml` (Linker-Eintrag), `.gitea/workflows/main.yaml` + `testing.yaml` (Toolchain-Install, `rustup target add`, `cargo build`/`cargo deb`/`cargo generate-rpm`/`package-arch.py`-Aufrufe), `README.md`/`AGENTS.md` (Zielarchitektur-Angaben) | Diese Tabelle; `git log` nach "i686" für die genauen Commits | Sobald eine neue `io-uring`-Version vorgefertigte `i686`-Bindings mitbringt (`cargo info io-uring` prüfen) ODER eine neue `turso`-Version `io_uring` optional/abschaltbar macht: i686 wieder in allen oben genannten Dateien ergänzen und mit einem echten i686-Cross-Build verifizieren, bevor gemergt wird. |
+
 ### 5.3 Renovate-Konfiguration (`renovate.json`)
 - Basis-Branch für PRs: `dev`.
 - Gruppiert Updates nach `Gitea Actions`, `Cargo Dependencies` und `Docker-Images`.
@@ -56,12 +56,6 @@ dependencies = [
 "memchr",
 ]

-[[package]]
-name = "allocator-api2"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
-
 [[package]]
 name = "allocator-api2"
 version = "0.4.0"
@@ -184,17 +178,6 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bfdc70193dadb9d7287fa4b633f15f90c876915b31f6af17da307fc59c9859a8"

-[[package]]
-name = "async-trait"
-version = "0.1.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.5",
-]
-
 [[package]]
 name = "autocfg"
 version = "1.5.1"
@@ -233,7 +216,7 @@ dependencies = [
 "lazy_static",
 "lazycell",
 "log",
- "prettyplease 0.2.37",
+ "prettyplease",
 "proc-macro2",
 "quote",
 "regex",
@@ -249,15 +232,6 @@ version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"

-[[package]]
-name = "bitpacking"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96a7139abd3d9cebf8cd6f920a389cf3dc9576172e32f4563f188cae3c3eb019"
-dependencies = [
- "crunchy",
-]
-
 [[package]]
 name = "bitvec"
 version = "1.1.1"
@@ -270,29 +244,6 @@ dependencies = [
 "wyz",
 ]

-[[package]]
-name = "bon"
-version = "3.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60eafe0d77c3a2fc292c1d1346c3041b33c0a108085a2afabf672b70f69dbbc9"
-dependencies = [
- "bon-macros",
-]
-
-[[package]]
-name = "bon-macros"
-version = "3.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd0f9631d8aaaee112c41985d675ef269e02acbd4f33122836af4f0c5f699ff6"
-dependencies = [
- "darling",
- "ident_case",
- "prettyplease 0.3.0",
- "proc-macro2",
- "quote",
- "syn 3.0.5",
-]
-
 [[package]]
 name = "branches"
 version = "0.4.6"
@@ -347,17 +298,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
 dependencies = [
 "find-msvc-tools",
- "jobserver",
- "libc 0.2.189",
 "shlex 2.0.1",
 ]

-[[package]]
-name = "census"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f4c707c6a209cbe82d10abd08e1ea8995e9ea937d2550646e02798948992be0"
-
 [[package]]
 name = "cexpr"
 version = "0.6.0"
@@ -432,9 +375,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -442,9 +385,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
 "anstream",
 "anstyle",
@@ -454,9 +397,9 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
 "heck",
 "proc-macro2",
@@ -543,15 +486,6 @@ dependencies = [
 "rustc_version",
 ]

-[[package]]
-name = "crc32fast"
-version = "1.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.17"
@@ -561,16 +495,6 @@ dependencies = [
 "crossbeam-utils",
 ]

-[[package]]
-name = "crossbeam-deque"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-epoch"
 version = "0.9.21"
@@ -586,12 +510,6 @@ version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"

-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -612,54 +530,11 @@ dependencies = [
 "cipher",
 ]

-[[package]]
-name = "darling"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
-dependencies = [
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 3.0.5",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
-dependencies = [
- "darling_core",
- "quote",
- "syn 3.0.5",
-]
-
-[[package]]
-name = "datasketches"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c286de4e81ea2590afc24d754e0f83810c566f50a1388fa75ebd57928c0d9745"
-
 [[package]]
 name = "deranged"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "serde_core",
-]

 [[package]]
 name = "displaydoc"
@@ -672,12 +547,6 @@ dependencies = [
 "syn 3.0.5",
 ]

-[[package]]
-name = "downcast-rs"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
-
 [[package]]
 name = "either"
 version = "1.18.0"
@@ -710,17 +579,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"

-[[package]]
-name = "erased-serde"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
-dependencies = [
- "serde",
- "serde_core",
- "typeid",
-]
-
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -728,7 +586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc 0.2.189",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -759,12 +617,6 @@ dependencies = [
 "siphasher",
 ]

-[[package]]
-name = "fastdivide"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afc2bd4d5a73106dd53d10d73d3401c2f32730ba2c0b93ddb888a8983680471"
-
 [[package]]
 name = "fastrand"
 version = "2.5.0"
@@ -777,28 +629,6 @@ version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"

-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "fs4"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8640e34b88f7652208ce9e88b1a37a2ae95227d84abec377ccd3c5cfeb141ed4"
-dependencies = [
- "rustix 1.1.4",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -811,17 +641,6 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"

-[[package]]
-name = "futures-macro"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.5",
-]
-
 [[package]]
 name = "futures-task"
 version = "0.3.34"
@@ -835,7 +654,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
 "futures-core",
- "futures-macro",
 "futures-task",
 "pin-project-lite",
 "slab",
@@ -932,17 +750,6 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"

-[[package]]
-name = "hashbrown"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
-dependencies = [
- "allocator-api2 0.2.21",
- "equivalent",
- "foldhash",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
@@ -976,12 +783,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

-[[package]]
-name = "htmlescape"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9025058dae765dee5070ec375f591e2ba14638c63feff74f13805a72e523163"
-
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -1171,12 +972,6 @@ dependencies = [
 "zerovec",
 ]

-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
 [[package]]
 name = "indexmap"
 version = "2.14.2"
@@ -1184,7 +979,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown",
 ]

 [[package]]
@@ -1205,15 +1000,6 @@ dependencies = [
 "memoffset",
 ]

-[[package]]
-name = "inventory"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "io-uring"
 version = "0.7.15"
@@ -1255,16 +1041,6 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom 0.4.3",
- "libc 0.2.189",
-]
-
 [[package]]
 name = "js-sys"
 version = "0.3.105"
@@ -1288,12 +1064,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"

-[[package]]
-name = "levenshtein_automata"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c2cdeb66e45e9f36bfad5bbdb4d2384e70936afbee843c6f6543f0c551ebb25"
-
 [[package]]
 name = "libc"
 version = "0.2.189"
@@ -1407,29 +1177,13 @@ dependencies = [
 "tracing-subscriber",
 ]

-[[package]]
-name = "lru"
-version = "0.16.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
-dependencies = [
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "lz4_flex"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
-
 [[package]]
 name = "mac2ip"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
 "clap",
 "config-ctdra",
 "logger-ctdra",
- "program-ctdra",
 "serde",
 "serde_json",
 "sudo-ctdra",
@@ -1447,30 +1201,12 @@ dependencies = [
 "regex-automata",
 ]

-[[package]]
-name = "measure_time"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51c55d61e72fc3ab704396c5fa16f4c184db37978ae4e94ca8959693a235fc0e"
-dependencies = [
- "log",
-]
-
 [[package]]
 name = "memchr"
 version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

-[[package]]
-name = "memmap2"
-version = "0.9.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
-dependencies = [
- "libc 0.2.189",
-]
-
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -1528,12 +1264,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

-[[package]]
-name = "murmurhash32"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2195bf6aa996a481483b29d62a7663eed3fe39600c460e323f8ff41e90bdd89b"
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -1550,7 +1280,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -1608,36 +1338,12 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"

-[[package]]
-name = "oneshot"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "269bca4c2591a28585d6bf10d9ed0332b7d76900a1b02bec41bdc3a2cdcda107"
-
 [[package]]
 name = "opaque-debug"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"

-[[package]]
-name = "ordered-float"
-version = "5.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c7c9e0d9b23589f26070720bac724174bfec1083e82f7854cdd0267518343c0"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "ownedbytes"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fbd56f7631767e61784dc43f8580f403f4475bd4aaa4da003e6295e1bab4a7e"
-dependencies = [
- "stable_deref_trait",
-]
-
 [[package]]
 name = "owo-colors"
 version = "3.5.0"
@@ -1688,12 +1394,6 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"

-[[package]]
-name = "pkg-config"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
-
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -1756,16 +1456,6 @@ dependencies = [
 "syn 2.0.119",
 ]

-[[package]]
-name = "prettyplease"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
-dependencies = [
- "proc-macro2",
- "syn 3.0.5",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -1925,26 +1615,6 @@ dependencies = [
 "rustversion",
 ]

-[[package]]
-name = "rayon"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1993,16 +1663,6 @@ dependencies = [
 "byteorder",
 ]

-[[package]]
-name = "rust-stemmers"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e46a2036019fdb888131db7a4c847a1063a7493f971ed94ea82c67eada63ca54"
-dependencies = [
- "serde",
- "serde_derive",
-]
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -2057,7 +1717,7 @@ dependencies = [
 "errno",
 "libc 0.2.189",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -2214,15 +1874,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"

-[[package]]
-name = "sketches-ddsketch"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513c3f5f732bfd6fbb187619c2dfe9d2f25f1a2976f01d575f0fd329d565df56"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -2329,154 +1980,6 @@ dependencies = [
 "syn 2.0.119",
 ]

-[[package]]
-name = "tantivy"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "861facfabd71044968f364837f9a083b56464ba5a59079f88706ee5c451ca069"
-dependencies = [
- "aho-corasick",
- "arc-swap",
- "base64",
- "bitpacking",
- "bon",
- "byteorder",
- "census",
- "crc32fast",
- "crossbeam-channel",
- "datasketches",
- "downcast-rs",
- "fastdivide",
- "fnv",
- "fs4",
- "htmlescape",
- "itertools 0.14.0",
- "levenshtein_automata",
- "log",
- "lru",
- "lz4_flex",
- "measure_time",
- "memmap2",
- "once_cell",
- "oneshot",
- "rayon",
- "regex",
- "rust-stemmers",
- "rustc-hash 2.1.3",
- "serde",
- "serde_json",
- "sketches-ddsketch",
- "smallvec",
- "tantivy-bitpacker",
- "tantivy-columnar",
- "tantivy-common",
- "tantivy-fst",
- "tantivy-query-grammar",
- "tantivy-stacker",
- "tantivy-tokenizer-api",
- "tempfile",
- "thiserror",
- "time",
- "typetag",
- "uuid",
- "winapi",
-]
-
-[[package]]
-name = "tantivy-bitpacker"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fed3d674429bcd2de5d0a6d1aa5495fed8afd9c5ecce993019caf7615f53fa4"
-dependencies = [
- "bitpacking",
-]
-
-[[package]]
-name = "tantivy-columnar"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c57166f5bcfd478f370ab8445afb4678dce44801fa5ce5c451aaf8595583c5dc"
-dependencies = [
- "downcast-rs",
- "fastdivide",
- "itertools 0.14.0",
- "serde",
- "tantivy-bitpacker",
- "tantivy-common",
- "tantivy-sstable",
- "tantivy-stacker",
-]
-
-[[package]]
-name = "tantivy-common"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbf10915aa75da3c3b0d58b58853d2e889efbaf32d4982a4c3715dde6bba23e5"
-dependencies = [
- "async-trait",
- "byteorder",
- "ownedbytes",
- "serde",
- "time",
-]
-
-[[package]]
-name = "tantivy-fst"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d60769b80ad7953d8a7b2c70cdfe722bbcdcac6bccc8ac934c40c034d866fc18"
-dependencies = [
- "byteorder",
- "regex-syntax",
- "utf8-ranges",
-]
-
-[[package]]
-name = "tantivy-query-grammar"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfadb8526b6da90704feb293b0701a6aae62ea14983143344be2dc5ce30f1d82"
-dependencies = [
- "fnv",
- "nom",
- "ordered-float",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "tantivy-sstable"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a2cfc3ac5164cbadc28965ffb145a8f47582a60ae5897859ad8d4316596c606"
-dependencies = [
- "futures-util",
- "itertools 0.14.0",
- "tantivy-bitpacker",
- "tantivy-common",
- "tantivy-fst",
- "zstd",
-]
-
-[[package]]
-name = "tantivy-stacker"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cbb051742da9d53ca9e8fff43a9b10e319338b24e2c0e15d0372df19ffeb951"
-dependencies = [
- "murmurhash32",
- "tantivy-common",
-]
-
-[[package]]
-name = "tantivy-tokenizer-api"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac258c2c6390673f2685813afeeafcb8c4e0ee7de8dd3fc46838dcc37263f98"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "tap"
 version = "1.0.1"
@@ -2493,7 +1996,7 @@ dependencies = [
 "getrandom 0.4.3",
 "once_cell",
 "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -2731,7 +2234,7 @@ dependencies = [
 "aegis",
 "aes",
 "aes-gcm",
- "allocator-api2 0.4.0",
+ "allocator-api2",
 "antithesis_sdk",
 "arc-swap",
 "aristo",
@@ -2779,7 +2282,6 @@ dependencies = [
 "smallvec",
 "strum",
 "strum_macros",
- "tantivy",
 "tempfile",
 "thiserror",
 "tracing",
@@ -2909,42 +2411,12 @@ dependencies = [
 "rand 0.10.2",
 ]

-[[package]]
-name = "typeid"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
-
 [[package]]
 name = "typenum"
 version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"

-[[package]]
-name = "typetag"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c90e86058a30d42a1a928dfb4b49bb33c98c3a2b4909492e6b0881cd94798ec2"
-dependencies = [
- "erased-serde",
- "inventory",
- "once_cell",
- "serde",
- "typetag-impl",
-]
-
-[[package]]
-name = "typetag-impl"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f153acc4e99a5f2a5aefa09fb078be54e26271b2813f6041200b224c098d8328"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.5",
-]
-
 [[package]]
 name = "uncased"
 version = "0.9.10"
@@ -2982,12 +2454,6 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"

-[[package]]
-name = "utf8-ranges"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcfc827f90e53a02eaef5e535ee14266c1d569214c6aa70133a624d8a3164ba"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -3008,7 +2474,6 @@ checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
- "serde_core",
 "sha1_smol",
 "wasm-bindgen",
 ]
@@ -3097,28 +2562,6 @@ dependencies = [
 "rustix 0.38.44",
 ]

-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -3403,31 +2846,3 @@ name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
-
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "7.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-sys"
-version = "2.1.0+zstd.1.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
-dependencies = [
- "cc",
- "pkg-config",
-]
@@ -1,6 +1,6 @@
 [package]
 name = "mac2ip"
-version = "0.1.0"
+version = "1.0.0"
 edition = "2024"
 authors = ['DragonSlayer_14']
 readme = "README.md"
@@ -11,10 +11,22 @@ description = "Findet zuverlässig die aktuelle IP-Adresse zu einer MAC-Adresse
 [dependencies]
 config-ctdra = { version = "1.0.6", registry = "gitea" }
 logger-ctdra = { version = "1.0.5", registry = "gitea" }
-program-ctdra = { version = "1.0.1", registry = "gitea" }
 sudo-ctdra = { version = "1.0.1", registry = "gitea" }
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "process", "time"] }
-turso = "0.7"
+# WORKAROUND für RUSTSEC-2026-0253 (Use-after-free in lru < 0.18.2): das
+# Default-Feature "fts" zieht tantivy 0.26.2 -> lru "^0.16.3" (verwundbar) ein,
+# obwohl mac2ip keine Volltextsuche nutzt. "fts" bleibt deaktiviert, bis eine
+# stabile turso-Version tantivy>=eine lru>=0.18.2 zulassende Version pinnt.
+#
+# Revert, sobald behoben (z. B. Renovate-PR/manuelle Prüfung):
+# 1. `cargo update -p lru --precise 0.18.2` probieren - schlägt fehl, solange
+#    das o. g. Problem besteht (siehe Fehlermeldung mit dem Pfad turso ->
+#    turso_core -> tantivy -> lru "^0.16.3").
+# 2. Sobald das gelingt (oder eine neue stabile turso-Version das Problem
+#    upstream behebt): diese Zeile zurück zu `turso = "0.7"` (oder aktueller)
+#    ändern und `cargo update -p turso` laufen lassen.
+# 3. `cargo tree -i lru` zur Kontrolle - keine Version < 0.18.2 mehr vorhanden.
+turso = { version = "0.7", default-features = false, features = ["mimalloc"] }
 clap = { version = "4", features = ["derive", "env"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -20,7 +20,7 @@ Dazu wird ein 3-stufiger Algorithmus verwendet:
 - **Maschinenlesbare Ausgabe** über `--json` (unattended-Modus) — unterdrückt dabei alle sonstigen Log-Ausgaben.
 - **Vollständig über die Kommandozeile konfigurierbar**, mit Overlay-Kette CLI > Umgebungsvariable > Konfigurationsdatei > Standardwert.
 - **Funktioniert mit und ohne `sudo`** — Root-Rechte werden nur für den nmap-Schritt benötigt.
- **Rust Edition 2024**, Multi-Architektur-Kompilierung (`x86_64`, `aarch64`, `i686`), native Linux-Paketierung (`.deb`, `.rpm`, `.pkg.tar.zst`) und automatisierte CI/CD-Pipelines via Gitea Actions.
+- **Rust Edition 2024**, Multi-Architektur-Kompilierung (`x86_64`, `aarch64`), native Linux-Paketierung (`.deb`, `.rpm`, `.pkg.tar.zst`) und automatisierte CI/CD-Pipelines via Gitea Actions.

 ---

@@ -175,8 +175,8 @@ Im `--json`-Modus wird für Schritt 3 ausschließlich `sudo -n` (nicht-interakti
 - **Python 3** (für Hilfsskripte in `scripts/`)
 - Zur Laufzeit: `ip`, `ping`, `nmap`, `sudo` (siehe "Voraussetzungen" oben)
 - Für Cross-Compilation (optional):
-  - `rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu i686-unknown-linux-gnu`
-  - Cross-Toolchains: `gcc-aarch64-linux-gnu`, `gcc-i686-linux-gnu`
+  - `rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu`
+  - Cross-Toolchains: `gcc-aarch64-linux-gnu`
 - Für lokales Paketieren (optional):
  - `cargo install cargo-deb cargo-generate-rpm`

@@ -1,29 +1,59 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": [
+    "config:recommended"
+  ],
  "timezone": "Europe/Berlin",
-  "schedule": ["before 6am on monday"],
+  "schedule": [
+    "before 6am"
+  ],
  "baseBranchPatterns": [
    "dev"
  ],
  "packageRules": [
    {
-      "matchFileNames": [".gitea/workflows/**"],
+      "matchFileNames": [
+        ".gitea/workflows/**"
+      ],
      "groupName": "Gitea Actions",
      "separateMajorMinor": false,
      "separateMinorPatch": false
    },
    {
-      "matchManagers": ["cargo"],
+      "matchManagers": [
+        "cargo"
+      ],
      "groupName": "Cargo Dependencies",
      "separateMajorMinor": false,
      "separateMinorPatch": false
    },
    {
-      "matchManagers": ["dockerfile", "docker-compose"],
+      "matchManagers": [
+        "dockerfile",
+        "docker-compose"
+      ],
      "groupName": "Docker-Images",
      "separateMajorMinor": false,
      "separateMinorPatch": false
+    },
+    {
+      "description": "Patch-/Minor-/Digest-Updates automatisch mergen, sobald alle CI-Checks (inkl. Unit-Tests) erfolgreich sind - Major-Updates sind unten explizit ausgenommen (siehe nächste Regel).",
+      "matchUpdateTypes": [
+        "patch",
+        "minor",
+        "digest",
+        "lockFileMaintenance"
+      ],
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "Major-Updates immer manuell prüfen, da potenziell brechende Änderungen.",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false
    }
  ],
  "customManagers": [
@@ -68,7 +68,7 @@ impl Cache {
            Err(e) => {
                crate::log::warn(
                    "cache",
-                    &format!("Cache-Lesefehler (trusted_networks): {e}"),
+                    &format!("Cache read error (trusted_networks): {e}"),
                );
                false
            }
@@ -90,7 +90,7 @@ impl Cache {
        {
            crate::log::warn(
                "cache",
-                &format!("Cache-Schreibfehler (trusted_networks, ignoriert): {e}"),
+                &format!("Cache write error (trusted_networks, ignored): {e}"),
            );
        }
    }
@@ -108,7 +108,7 @@ impl Cache {
        {
            Ok(rows) => rows,
            Err(e) => {
-                crate::log::warn("cache", &format!("Cache-Lesefehler: {e}"));
+                crate::log::warn("cache", &format!("Cache read error: {e}"));
                return None;
            }
        };
@@ -126,7 +126,7 @@ impl Cache {
            }
            Ok(None) => None,
            Err(e) => {
-                crate::log::warn("cache", &format!("Cache-Lesefehler: {e}"));
+                crate::log::warn("cache", &format!("Cache read error: {e}"));
                None
            }
        }
@@ -145,7 +145,7 @@ impl Cache {
            )
            .await
        {
-            crate::log::warn("cache", &format!("Cache-Schreibfehler (ignoriert): {e}"));
+            crate::log::warn("cache", &format!("Cache write error (ignored): {e}"));
        }
    }
 }
@@ -157,19 +157,15 @@ pub fn is_expired(updated_at: i64, now: i64, ttl_seconds: u64) -> bool {

 fn ensure_cache_dir(dir: &Path) -> Result<(), String> {
    if !dir.exists() {
-        std::fs::create_dir_all(dir).map_err(|e| {
-            format!(
-                "Verzeichnis '{}' konnte nicht angelegt werden: {e}",
-                dir.display()
-            )
-        })?;
+        std::fs::create_dir_all(dir)
+            .map_err(|e| format!("could not create directory '{}': {e}", dir.display()))?;
        // create_dir_all() unterliegt dem Prozess-Umask; explizites chmod ist nötig, um
        // wirklich 0777 zu erreichen (Verzeichnis-Rechte steuern nicht die Umask neuer Dateien).
        // Wird nur beim Neuanlegen ausgeführt; bei existierenden Verzeichnissen würde ein
        // unprivilegierter Aufruf auf root-eigenen Pfaden mit EPERM fehlschlagen.
        #[cfg(unix)]
        std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o777))
-            .map_err(|e| format!("Verzeichnis-Rechte konnten nicht gesetzt werden: {e}"))?;
+            .map_err(|e| format!("could not set directory permissions: {e}"))?;
    }
    Ok(())
 }
@@ -191,7 +187,7 @@ pub async fn try_open_cache(db_path: &Path) -> Option<Cache> {
    if let Some(dir) = db_path.parent()
        && let Err(reason) = ensure_cache_dir(dir)
    {
-        crate::log::warn("cache", &format!("Cache deaktiviert: {reason}"));
+        crate::log::warn("cache", &format!("Cache disabled: {reason}"));
        return None;
    }

@@ -201,10 +197,7 @@ pub async fn try_open_cache(db_path: &Path) -> Option<Cache> {
    {
        Ok(db) => db,
        Err(e) => {
-            crate::log::warn(
-                "cache",
-                &format!("Cache-Datenbank konnte nicht geöffnet werden: {e}"),
-            );
+            crate::log::warn("cache", &format!("Could not open cache database: {e}"));
            return None;
        }
    };
@@ -212,17 +205,14 @@ pub async fn try_open_cache(db_path: &Path) -> Option<Cache> {
    let conn = match db.connect() {
        Ok(c) => c,
        Err(e) => {
-            crate::log::warn("cache", &format!("Cache-Verbindung fehlgeschlagen: {e}"));
+            crate::log::warn("cache", &format!("Cache connection failed: {e}"));
            return None;
        }
    };

    let cache = Cache { conn };
    if let Err(e) = cache.init_schema().await {
-        crate::log::warn(
-            "cache",
-            &format!("Cache-Schema konnte nicht initialisiert werden: {e}"),
-        );
+        crate::log::warn("cache", &format!("Could not initialize cache schema: {e}"));
        return None;
    }

@@ -11,50 +11,87 @@ use crate::mac::MacAddress;
    name = "mac2ip",
    author,
    version,
-    about = "Findet zuverlässig die aktuelle IP-Adresse zu einer MAC-Adresse im lokalen Netzwerk",
+    about = "Reliably finds the current IP address for a MAC address on the local network",
    long_about = None
 )]
 pub struct Cli {
    /// MAC-Adresse, deren aktuelle IP-Adresse ermittelt werden soll (z. B. aa:bb:cc:dd:ee:ff)
+    #[arg(help = "MAC address to look up the current IP address for (e.g. aa:bb:cc:dd:ee:ff)")]
    pub mac: MacAddress,

    /// Gibt das Ergebnis als einzeiliges JSON-Objekt aus; unterdrückt alle sonstigen Log-Ausgaben
-    #[arg(long)]
+    #[arg(
+        long,
+        help = "Print the result as a single-line JSON object; suppresses all other log output"
+    )]
    pub json: bool,

    /// Benutzerdefinierter Pfad zur Konfigurationsdatei
-    #[arg(long)]
+    #[arg(long, help = "Custom path to the configuration file")]
    pub config: Option<PathBuf>,

    /// Logging-Level (error, warn, info, debug)
-    #[arg(long, value_enum, env = "MAC2IP_LOG_LEVEL")]
+    #[arg(
+        long,
+        value_enum,
+        env = "MAC2IP_LOG_LEVEL",
+        help = "Log level (error, warn, info, debug)"
+    )]
    pub log_level: Option<LogLevelArg>,

    /// Cache-TTL in Sekunden (Standard: 1800)
-    #[arg(long, env = "MAC2IP_CACHE_TTL_SECONDS")]
+    #[arg(
+        long,
+        env = "MAC2IP_CACHE_TTL_SECONDS",
+        help = "Cache TTL in seconds (default: 1800)"
+    )]
    pub cache_ttl_seconds: Option<u64>,

    /// Pfad zur globalen Cache-Datenbankdatei (Standard: /var/lib/mac2ip/cache.db)
-    #[arg(long, env = "MAC2IP_CACHE_DB_PATH")]
+    #[arg(
+        long,
+        env = "MAC2IP_CACHE_DB_PATH",
+        help = "Path to the global cache database file (default: /var/lib/mac2ip/cache.db)"
+    )]
    pub cache_db_path: Option<PathBuf>,

    /// Timeout in Sekunden für einen einzelnen nmap-Subnetz-Scan (Standard: 120)
-    #[arg(long, env = "MAC2IP_NMAP_TIMEOUT_SECONDS")]
+    #[arg(
+        long,
+        env = "MAC2IP_NMAP_TIMEOUT_SECONDS",
+        help = "Timeout in seconds for a single nmap subnet scan (default: 120)"
+    )]
    pub nmap_timeout_seconds: Option<u64>,

    /// Kommagetrennte Liste von CIDR-Subnetzen für den nmap-Scan (überschreibt Auto-Erkennung)
-    #[arg(long, env = "MAC2IP_NETWORKS", value_delimiter = ',')]
+    #[arg(
+        long,
+        env = "MAC2IP_NETWORKS",
+        value_delimiter = ',',
+        help = "Comma-separated list of CIDR subnets for the nmap scan (overrides auto-detection)"
+    )]
    pub networks: Option<Vec<String>>,

    /// Kommagetrennte Liste von Gateway-MAC-Adressen, deren Netzwerke ohne Rückfrage für
    /// nmap-Scans (Schritt 3) vertraut werden (überschreibt die Konfigurationsdatei vollständig)
-    #[arg(long, env = "MAC2IP_TRUSTED_NETWORKS", value_delimiter = ',')]
+    #[arg(
+        long,
+        env = "MAC2IP_TRUSTED_NETWORKS",
+        value_delimiter = ',',
+        help = "Comma-separated list of gateway MAC addresses whose networks are trusted for \
+                nmap scans (step 3) without confirmation (fully overrides the config file)"
+    )]
    pub trusted_networks: Option<Vec<MacAddress>>,

    /// Beantwortet die "nmap-Scan in diesem Netzwerk erlauben?"-Rückfrage vor Schritt 3
    /// automatisch mit Ja (und merkt sich das Netzwerk dauerhaft im Cache), statt
    /// interaktiv nachzufragen bzw. im --json-Modus den Scan abzulehnen
-    #[arg(long)]
+    #[arg(
+        long,
+        help = "Automatically answers yes to the \"allow nmap scan on this network?\" prompt \
+                before step 3 (and remembers the network permanently in the cache), instead of \
+                asking interactively or rejecting the scan in --json mode"
+    )]
    pub auto_trust_networks: bool,
 }

@@ -4,15 +4,15 @@ use crate::mac::MacAddressError;

 #[derive(Debug, thiserror::Error)]
 pub enum Mac2IpError {
-    #[error("keine IP-Adresse für MAC '{mac}' gefunden")]
+    #[error("no IP address found for MAC '{mac}'")]
    NotFound { mac: String },
    #[error(
-        "nmap-Scan abgelehnt: Netzwerk nicht vertrauenswürdig{}",
-        .gateway_mac.as_ref().map(|m| format!(" (Gateway-MAC {m})")).unwrap_or_default()
+        "nmap scan rejected: network not trusted{}",
+        .gateway_mac.as_ref().map(|m| format!(" (gateway MAC {m})")).unwrap_or_default()
    )]
    UntrustedNetwork { gateway_mac: Option<String> },
-    #[error("MAC-Adresse ungültig: {0}")]
+    #[error("invalid MAC address: {0}")]
    InvalidMac(#[from] MacAddressError),
-    #[error("E/A-Fehler: {0}")]
+    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),
 }
@@ -9,7 +9,7 @@ pub struct MacAddress([u8; 6]);

 #[derive(Debug, thiserror::Error, Clone, PartialEq, Eq)]
 pub enum MacAddressError {
-    #[error("ungültige MAC-Adresse: '{0}'")]
+    #[error("invalid MAC address: '{0}'")]
    InvalidFormat(String),
 }

@@ -86,11 +86,11 @@ pub enum SudoMode {

 #[derive(Debug, thiserror::Error)]
 pub enum NmapRunError {
-    #[error("sudo-Zugangsdaten nicht verfügbar (nicht-interaktiver Modus)")]
+    #[error("sudo credentials unavailable (non-interactive mode)")]
    SudoUnavailable,
-    #[error("nmap-Scan hat das Zeitlimit überschritten")]
+    #[error("nmap scan exceeded the time limit")]
    Timeout,
-    #[error("E/A-Fehler: {0}")]
+    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),
 }

@@ -42,12 +42,11 @@ pub fn print_success(result: &ResolveResult, json: bool) {
    if json {
        println!(
            "{}",
-            serde_json::to_string(&success_json(result))
-                .expect("JSON-Serialisierung schlägt nicht fehl")
+            serde_json::to_string(&success_json(result)).expect("JSON serialization never fails")
        );
    } else {
        println!(
-            "{} -> {} (Quelle: {})",
+            "{} -> {} (source: {})",
            result.mac,
            result.ip,
            result.source.as_str()
@@ -59,8 +58,7 @@ pub fn print_failure(mac: &MacAddress, err: &Mac2IpError, json: bool) {
    if json {
        println!(
            "{}",
-            serde_json::to_string(&failure_json(mac, err))
-                .expect("JSON-Serialisierung schlägt nicht fehl")
+            serde_json::to_string(&failure_json(mac, err)).expect("JSON serialization never fails")
        );
    } else {
        crate::log::error("mac2ip", &err.to_string());
@@ -55,10 +55,7 @@ pub async fn resolve(
        && !cache::is_expired(entry.updated_at, now, config.cache_ttl_seconds)
        && network::ping_check(entry.ip).await
    {
-        crate::log::info(
-            "resolver",
-            &format!("Treffer im Cache für {mac}: {}", entry.ip),
-        );
+        crate::log::info("resolver", &format!("Cache hit for {mac}: {}", entry.ip));
        return Ok(ResolveResult {
            mac: *mac,
            ip: entry.ip,
@@ -69,13 +66,13 @@ pub async fn resolve(
    // Schritt 2: ip neigh
    crate::log::debug(
        "resolver",
-        "Cache-Treffer nicht verfügbar, prüfe 'ip neigh show'",
+        "No cache hit available, checking 'ip neigh show'",
    );
    if let Ok(output) = network::run_ip_neigh_show().await
        && let Some(ip) = network::parse_ip_neigh_output(&output, mac)
        && network::ping_check(ip).await
    {
-        crate::log::info("resolver", &format!("Treffer via ip neigh für {mac}: {ip}"));
+        crate::log::info("resolver", &format!("Hit via ip neigh for {mac}: {ip}"));
        if let Some(cache) = cache {
            cache.upsert(mac, ip, MatchSource::Arp.as_str(), now).await;
        }
@@ -87,14 +84,14 @@ pub async fn resolve(
    }

    // Schritt 3: nmap
-    crate::log::debug("resolver", "Kein Treffer via ip neigh, starte nmap-Scan");
+    crate::log::debug("resolver", "No hit via ip neigh, starting nmap scan");

    match trust::ensure_network_trusted(config, cache, auto_trust_networks, json_mode, now).await {
        TrustDecision::Allowed => {}
        TrustDecision::Denied { gateway_mac } => {
            crate::log::warn(
                "resolver",
-                "nmap-Scan übersprungen: Netzwerk nicht als vertrauenswürdig bestätigt",
+                "nmap scan skipped: network not confirmed as trusted",
            );
            return Err(Mac2IpError::UntrustedNetwork {
                gateway_mac: gateway_mac.map(|m| m.to_string()),
@@ -125,7 +122,7 @@ pub async fn resolve(
                if let Some(ip) = network::parse_nmap_output(&output, mac)
                    && network::ping_check(ip).await
                {
-                    crate::log::info("resolver", &format!("Treffer via nmap für {mac}: {ip}"));
+                    crate::log::info("resolver", &format!("Hit via nmap for {mac}: {ip}"));
                    if let Some(cache) = cache {
                        cache.upsert(mac, ip, MatchSource::Nmap.as_str(), now).await;
                    }
@@ -139,12 +136,12 @@ pub async fn resolve(
            Err(NmapRunError::SudoUnavailable) => {
                crate::log::warn(
                    "nmap",
-                    "sudo -n fehlgeschlagen (keine Zugangsdaten) - Schritt 3 wird abgebrochen",
+                    "sudo -n failed (no credentials available) - aborting step 3",
                );
                break; // sudo-Session-Status ist global, ein Retry pro Subnetz bringt nichts
            }
            Err(e) => {
-                crate::log::warn("nmap", &format!("nmap-Scan für {cidr} fehlgeschlagen: {e}"));
+                crate::log::warn("nmap", &format!("nmap scan for {cidr} failed: {e}"));
                continue; // Fehler pro Subnetz (z. B. Timeout) - nächstes Subnetz versuchen
            }
        }
@@ -35,12 +35,12 @@ pub async fn ensure_network_trusted(
    let Some(gateway_mac) = network::detect_default_gateway_mac().await else {
        crate::log::warn(
            "trust",
-            "Gateway-MAC konnte nicht ermittelt werden, Netzwerk kann nicht identifiziert werden",
+            "Could not determine gateway MAC, network cannot be identified",
        );
        if auto_trust {
            crate::log::warn(
                "trust",
-                "--auto-trust-networks gesetzt: nmap-Scan wird trotz unbekannter Gateway-MAC ausgeführt",
+                "--auto-trust-networks set: running nmap scan despite unknown gateway MAC",
            );
            return TrustDecision::Allowed;
        }
@@ -60,9 +60,7 @@ pub async fn ensure_network_trusted(
    if auto_trust {
        crate::log::info(
            "trust",
-            &format!(
-                "Netzwerk (Gateway-MAC {gateway_mac}) automatisch als vertrauenswürdig markiert"
-            ),
+            &format!("Network (gateway MAC {gateway_mac}) automatically marked as trusted"),
        );
        if let Some(cache) = cache {
            cache.trust_network(&gateway_mac, now).await;
@@ -95,7 +93,7 @@ pub async fn ensure_network_trusted(
 async fn prompt_trust_confirmation(gateway_mac: MacAddress) -> bool {
    tokio::task::spawn_blocking(move || {
        eprint!(
-            "Unbekanntes Netzwerk (Gateway-MAC {gateway_mac}). nmap-Scan in diesem Netzwerk erlauben und dauerhaft merken? [y/N]: "
+            "Unknown network (gateway MAC {gateway_mac}). Allow nmap scan on this network and remember it permanently? [y/N]: "
        );
        let _ = std::io::stderr().flush();
Author	SHA1	Message	Date
DragonSlayer_14andClaude Sonnet 5	b2c22e8f80	CI: Fuegt automatisiertes Nightly-Release hinzu und behebt Zeitzone bei geplanten Workflows Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped Security Scans / Trivy & OSV-Scanner (push) Successful in 1m15s Details Nightly Build & Publish / Erkenne relevante Code-Änderungen (push) Successful in 19s Details TruffleHog Secret Scan / TruffleHog (push) Successful in 28s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Failing after 12m40s Details Nightly Build & Publish / Build & Publish Packages (Nightly) (push) Failing after 17h51m44s Details - Neuer Workflow "nightly-pr.yaml": Erstellt und merged taeglich automatisch einen Pull Request von dev nach nightly (09:00 Uhr Europe/Berlin); legt den nightly-Branch bei Bedarf initial von dev an. - Neuer Workflow "nightly.yaml": Baut und veroeffentlicht Pakete bei Aenderungen auf nightly in den nightly-Kanal der Paket-Registry (Debian/RPM/Arch); erstellt bewusst kein Gitea-Release. - CRON_TZ=Europe/Berlin in security-scan.yaml und trufflehog-scan.yaml ergaenzt: Gitea Actions interpretiert schedule-Cron sonst in der lokalen Zeitzone des Gitea-Servers statt in der beabsichtigten Zeitzone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-21 00:23:05 +02:00
DragonSlayer_14andClaude Sonnet 5	ab6a0e4ad2	CI: Renovate-Schedule von wöchentlich auf täglich verkürzt Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 26s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 1m13s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m18s Details 'before 6am on monday' erlaubte nur einmal pro Woche automatische PR-Erstellung - jeder außerhalb dieses Fensters gefundene Update musste im Dependency-Dashboard-Issue erst manuell abgehakt werden ("Awaiting Schedule"), auch nach der letzten Automerge-Änderung. 'before 6am' (ohne Wochentag) öffnet das Fenster jetzt täglich, PRs für sichere Updates laufen dadurch spürbar zeitnaher und größtenteils ohne manuelles Abhaken durch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 23:36:46 +02:00
DragonSlayer_14andClaude Sonnet 5	43e2209a16	CI: Renovate merged sichere Updates automatisch, unit-tests laufen jetzt auch für PRs gegen dev Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 30s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 1m14s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m22s Details Patch-/Minor-/Digest-Updates (Cargo, Gitea Actions, Docker-Images) werden künftig automatisch gemergt, sobald alle CI-Checks erfolgreich sind - Major-Updates bleiben weiterhin manuell zu prüfen, da sie eher brechende Änderungen enthalten. Voraussetzung dafür: unit-tests.yaml (der eigentliche 'cargo test'-Lauf) löste bisher nur bei Pull Requests gegen 'testing' aus, nicht gegen 'dev' - Renovate-PRs zielen aber auf 'dev' und wurden damit nie durch einen echten Build/Test abgesichert, nur durch die Security-/Secret- Scans. Jetzt läuft er auch dort. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 23:27:01 +02:00
DragonSlayer_14andClaude Sonnet 5	51890f6bff	CI: Ersetzt rohes actions/cache für Cargo-Build-Artefakte durch Swatinem/rust-cache Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 30s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 1m17s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 8m17s Details Ein rohes 'actions/cache' auf target/ lieferte zwar einen technischen Cache-Hit, Cargo kompilierte die Abhängigkeiten aber trotzdem neu: der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was älter/neuer als was ist. Swatinem/rust-cache behebt das gezielt (u. a. gezielte Mtime-Korrektur nach dem Restore). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 23:17:57 +02:00
DragonSlayer_14	10bcd17ea6	Merge pull request 'chore(deps): update rust crate clap to v4.6.7' (#9 ) from renovate/cargo-dependencies into dev Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 16s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 33s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 44s Details Reviewed-on: #9 Reviewed-by: dragonslayer14@murena.io <4+dragonslayer_14@noreply.localhost>	2026-09-20 10:07:59 +00:00
DragonSlayer_14	462fe20bed	Merge pull request 'chore(deps): update gitea actions' (#10 ) from renovate/gitea-actions into dev Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 27s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 1m14s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m24s Details Reviewed-on: #10	2026-09-20 09:02:04 +00:00
Renovate-Bot	92cb9d83d9	chore(deps): update gitea actions Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped Unit-Tests / Unit-Tests (pull_request) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 17s Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 16s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 32s Details	2026-09-20 03:01:12 +00:00
Renovate-Bot	62d65149ab	chore(deps): update rust crate clap to v4.6.7 Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 22s Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 20s Details Unit-Tests / Unit-Tests (pull_request) Skipped Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 47s Details	2026-09-19 19:03:49 +00:00
Gitea-Bot	2b9e761d9e	Style: Automatische Formatierung & Clippy-Fixes Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 16s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 34s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 35s Details	2026-09-14 22:51:40 +00:00
DragonSlayer_14	232e39f518	Merge remote-tracking branch 'origin/dev' into dev TruffleHog Secret Scan / TruffleHog (push) Successful in 17s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 33s Details Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 36s Details	2026-09-15 00:50:56 +02:00
DragonSlayer_14	8ce23b6374	Merge branch 'main' into dev	2026-09-15 00:50:51 +02:00
DragonSlayer_14andClaude Sonnet 5	b094b11429	Chore: Terminal-Ausgaben ins Englische übersetzt Log-Meldungen, Fehlertexte, CLI---help-Ausgabe und der interaktive Vertrauens-Prompt erscheinen jetzt auf Englisch. Rustdoc-Kommentare bleiben unverändert Deutsch; in cli.rs wird dafür ein separates clap-help-Attribut (Englisch) neben dem deutschen Doc-Kommentar verwendet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011asoZDNEvn4RZBxxPQLCG9	2026-09-15 00:33:45 +02:00
DragonSlayer_14	fd441a95a6	Merge pull request 'chore(deps): update gitea actions' (#8 ) from renovate/gitea-actions into dev Security Scans / Trivy & OSV-Scanner (push) Successful in 58s Details TruffleHog Secret Scan / TruffleHog (push) Successful in 31s Details Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m33s Details Reviewed-on: #8 Reviewed-by: dragonslayer14@murena.io <4+dragonslayer_14@noreply.localhost>	2026-09-14 10:52:11 +00:00
Renovate-Bot	2c8c9c885f	chore(deps): update gitea actions TruffleHog Secret Scan / TruffleHog (push) Successful in 17s Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 15s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 28s Details Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped Unit-Tests / Unit-Tests (pull_request) Skipped	2026-09-14 10:01:00 +00:00
DragonSlayer_14	8073ee6a49	Merge pull request 'Merge testing in main: Release 1.0.0' (#6 ) from testing into main Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped Main Release & Publish / Erkenne relevante Code-Änderungen (push) Successful in 5s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 22s Details Main Release & Publish / Build, Publish Packages (Stable) & Create Release (push) Successful in 12m27s Details TruffleHog Secret Scan / TruffleHog (push) Successful in 10s Details Reviewed-on: #6 Reviewed-by: dragonslayer14@murena.io <4+dragonslayer_14@noreply.localhost>	2026-09-13 20:46:58 +00:00
DragonSlayer_14	651cecc81a	Merge pull request 'Mereg dev in testing: Entfernt 32bit-Unterstützung' (#7 ) from dev into testing Unit-Tests / Unit-Tests (pull_request) Skipped Auto-PR (Testing → Main) / Erstelle automatisch PR von testing nach main (push) Successful in 10s Details Testing Build, Publish & Preview Release / Erkenne relevante Code-Änderungen (push) Successful in 12s Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 25s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 42s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 43s Details Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Successful in 12m59s Details TruffleHog Secret Scan / TruffleHog (push) Successful in 10s Details Reviewed-on: #7	2026-09-13 20:10:01 +00:00
DragonSlayer_14	c4b33fe5f6	Merge remote-tracking branch 'origin/dev' into dev Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 16s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 25s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 33s Details Auto Patch-Version-Bump (Dev → Testing PR) / Erkenne relevante Änderungen im PR (pull_request) Successful in 9s Details Auto Patch-Version-Bump (Dev → Testing PR) / Patch-Version erhöhen & auf Dev pushen (pull_request) Skipped Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 19s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 27s Details Unit-Tests / Unit-Tests (pull_request) Successful in 1m55s Details	2026-09-13 22:05:23 +02:00
DragonSlayer_14andClaude Sonnet 5	01dbbba227	Fix: i686-Build-Target entfernen (io-uring unterstützt keine 32-Bit-x86-Bindings) testing.yaml scheiterte beim i686-Cross-Build mit "The prebuilt sys.rs may not be compatible with your target" aus der io-uring-Crate. Ursache: turso_sdk_kit (Abhängigkeit von turso) fordert von turso_core unconditional das Feature "io_uring" an - anders als "fts" ist das nicht abschaltbar. io-uring 0.7.15 (aktuellste Version) liefert vorgefertigte FFI-Bindings nur für x86_64/aarch64/riscv64/powerpc64/ loongarch64, nicht für i686. --cfg=io_uring_skip_arch_check wurde bewusst NICHT verwendet: auf i686 würde das stillschweigend die x86_64-Bindings nutzen, deren Struct-Layouts (u. a. Pointer-Breite) nicht zum 32-Bit-ABI passen - echtes Risiko für Speicherkorruption bei den rohen io_uring-Syscalls, kein reiner Lint. i686 daher komplett aus den Build-Targets entfernt: Linker-Eintrag (.cargo/config.toml), Toolchain-Install/rustup-Target/Build-/Paketier- Schritte (main.yaml, testing.yaml), sowie die Zielarchitektur-Angaben in README.md/AGENTS.md. Revert-Bedingung in AGENTS.md §5.2.2 dokumentiert (sobald io-uring i686-Bindings mitbringt oder turso io_uring optional macht). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SnWfGGqHJGh2AhZ6uhotaD	2026-09-13 21:50:19 +02:00
DragonSlayer_14	88392aafff	Merge pull request 'Merge dev in testing: Erstellt das Projekt' (#3 ) from dev into testing Unit-Tests / Unit-Tests (pull_request) Skipped Testing Build, Publish & Preview Release / Erkenne relevante Code-Änderungen (push) Successful in 9s Details Auto-PR (Testing → Main) / Erstelle automatisch PR von testing nach main (push) Successful in 13s Details TruffleHog Secret Scan / TruffleHog (push) Successful in 19s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 35s Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 24s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 32s Details Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Failing after 13m33s Details Reviewed-on: #3	2026-09-13 19:20:44 +00:00
DragonSlayer_14	8bd3ce8da3	Merge pull request 'chore(deps): update ghcr.io/renovatebot/renovate docker tag to v44.83.0' (#5 ) from renovate/gitea-actions into dev Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 27s Details TruffleHog Secret Scan / TruffleHog (push) Successful in 28s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 47s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 50s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m0s Details Unit-Tests / Unit-Tests (pull_request) Successful in 2m2s Details Reviewed-on: #5	2026-09-13 18:46:20 +00:00
Renovate-Bot	15121eba3c	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v44.83.0 Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 9s Details Unit-Tests / Unit-Tests (pull_request) Skipped TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 11s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 17s Details	2026-09-13 18:40:05 +00:00
DragonSlayer_14	4a4a1afe9d	Feat: Hebt Version auf 1.0.0 Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped TruffleHog Secret Scan / TruffleHog (push) Successful in 16s Details Security Scans / Trivy & OSV-Scanner (push) Successful in 26s Details Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m25s Details Auto Patch-Version-Bump (Dev → Testing PR) / Erkenne relevante Änderungen im PR (pull_request) Successful in 9s Details TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 20s Details Auto Patch-Version-Bump (Dev → Testing PR) / Patch-Version erhöhen & auf Dev pushen (pull_request) Successful in 9s Details Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 31s Details Unit-Tests / Unit-Tests (pull_request) Successful in 1m59s Details	2026-09-13 20:31:09 +02:00
DragonSlayer_14andClaude Sonnet 5	e482216b1b	Docs: Revert-Bedingung für RUSTSEC-2026-0253-Workaround dokumentieren Damit das Deaktivieren von turso/fts (Commit `2a96e03`) nicht dauerhaft vergessen wird, sobald der eigentliche Fix upstream verfügbar ist: - Cargo.toml: Kommentar direkt über der turso-Zeile mit Grund und konkreten Schritten zum Zurücksetzen. - AGENTS.md: neue Tabelle "Bekannte Sicherheits-Workarounds" (§5.2.1), damit auch bei einem Renovate-Update/Dependency-Review ohne Blick in Cargo.toml auffällt, dass hier eine befristete Ausnahme besteht. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SnWfGGqHJGh2AhZ6uhotaD	2026-09-13 20:28:06 +02:00
DragonSlayer_14andClaude Sonnet 5	2a96e031ef	Fix: RUSTSEC-2026-0253 (lru < 0.18.2) durch Deaktivierung von turso/fts beheben Die transitive Abhängigkeit lru 0.16.4 (über turso -> turso_core -> tantivy) ist von RUSTSEC-2026-0253 betroffen: LruCache::pop() ruft bei einem panickenden Drop des Keys self.detach() nicht auf, wodurch dangling Pointer in der internen verketteten Liste zurückbleiben - eine nachfolgende Eviction kann dadurch freigegebenen Speicher beschreiben (Use-after-free/Double-free, CWE-416/415). Fix erst ab lru 0.18.2, aber tantivy 0.26.2 (aktuell einzige stabile turso-Version) pinnt `lru = "^0.16.3"`, ein direktes Hochziehen ist daher nicht möglich. mac2ip nutzt turso ausschließlich als einfachen Key-Value-Cache (CREATE TABLE/INSERT/SELECT) und benötigt keine Volltextsuche. Das `fts`-Feature (zieht tantivy und damit lru überhaupt erst ein) wird daher deaktiviert, `mimalloc` bleibt als einziges Default-Feature erhalten. Damit verschwindet die verwundbare Abhängigkeit komplett aus dem Dependency-Baum (-591 Zeilen Cargo.lock), statt nur auf einen Fix von tantivy/turso zu warten. Verifiziert: Build/Clippy/Tests weiterhin grün, Cache-Datei wird nach wie vor erstellt und funktioniert (manueller Smoke-Test). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SnWfGGqHJGh2AhZ6uhotaD	2026-09-13 20:25:31 +02:00