Bump uuid, gate publishes per-registry, and stop Go caching the corpus

[brentrager]

Three small fixes from a cross-repo sweep, plus a verified negative on the stream question (below).

1. uuid 9.0.1 → 11.1.1

Advisory: moderate, missing buffer bounds check in v3/v5/v6 when buf is provided, patched in >=11.1.1.

Not reachable here. Logger's only call sites are uuidv4() with no arguments (src/Logger.ts:189, :573); v3/v5/v6 are never imported and no buf is ever passed. But the advisory propagates to every consumer — @smooai/config traced it through three separate paths into its tree and had to add a pnpm.overrides pin. Fixing it at the source is cheaper than N overrides. @types/uuid dropped; uuid 11 ships its own types.

2. Publish steps gate on the registry, not on npm's success

if: steps.changesets.outputs.published == 'true'   # ← on PyPI, crates.io, Go tag, NuGet

That output is true only when the publish command shipped something in that run. So a run that dies after npm leaves the other four behind — and the next run, with no changesets left, reports published=false, skips all four, and goes green having published nothing.

This happened here today. 4.5.1 and 4.5.2 reached npm and PyPI while crates.io, NuGet and the Go tag sat at 4.5.0, across runs that reported success. It only got caught because I compared the live registries by hand.

Each step now asks its own registry whether the version is already there:

PYPI=$(behind "$(curl -sfL https://pypi.org/pypi/smooai-logger/json || true)" '.releases | has($v)')
CRATES=$(behind "$(curl -sfL -H '...' https://crates.io/api/v1/crates/smooai-logger/versions || true)" '[.versions[].num] | index($v)')
NUGET=$(behind "$(curl -sfL https://api.nuget.org/v3-flatcontainer/smooai.logger/index.json || true)" '.versions | index($v)')
git ls-remote --exit-code --tags origin "refs/tags/go/v${VERSION}"

Side benefit: a re-run now heals a partial release instead of skipping it.

The lookup fails toward publishing — a garbled or failed response counts as "behind". Every path below is duplicate-tolerant (--skip-duplicate on NuGet) or version-guarded (the Go tag), so a redundant attempt is cheap while a skipped one loses a release.

Verified against the live registries:

version	pypi	crates	nuget	go-tag
4.5.3 (real)	not behind	not behind	behind ¹	not behind
9.9.9 (fake)	behind	behind	behind	behind
(empty response)	behind	—	—	—

¹ NuGet accepted the 4.5.3 push (HTTP 201, both .nupkg and .snupkg) but its flat-container index still 404s ~50 min later — nuget.org validation latency, not a failure. This is precisely the case --skip-duplicate plus fail-toward-publish handles gracefully.

3. go:test gains -count=1

Go's test cache does not invalidate on fixtures read from outside the package dir, and go/parity_corpus_test.go reads ../parity-corpus.json.

I checked before changing anything, and Go is currently safe — it refuses to cache that test at all. Positive control:

TestLevelString    (reads nothing outside the pkg)  → ok  (cached)   ← on re-run
TestParityCorpus   (reads ../parity-corpus.json)    → ok  0.296s
                                                    → ok  0.284s     ← never cached

I also re-ran the #183 corpus positive control: corrupting the placeholder still fails Go. So the Go half of that corpus proved what it claimed. -count=1 costs nothing and means a five-language parity guarantee no longer rests on that behaviour.

---

Verified negative: no single-read() and no hand-rolled stream mocks

Checked all five languages for the @smooai/file defect class. Logger is clean, and structurally so — it is a log producer; it never consumes a stream. There is no read(), ReadAll, read_to_end, or .Read( anywhere in any port (the .read() grep hits are iterator .next() and RwLock::read()).

Every write path uses a loop-until-done primitive:

port	write path
TypeScript	process.stdout.write + the rotating-file-stream library — Node buffers, never truncates
Python	stdlib RotatingFileHandler / TimedRotatingFileHandler, sys.stdout.write
Rust	write_all in both places (logger.rs:449, rotation.rs:87) — never bare write
Go	io.WriteString; rotation.go:100 uses os.File.Write, whose contract returns a non-nil error when n != len(b), and the code checks it
.NET	FileStream.Write(bytes, 0, bytes.Length) — writes all or throws

And no hand-rolled stream mocks. Every test writer is the real runtime type: Go bytes.Buffer (io.Writer), .NET StringWriter (TextWriter), Python io.StringIO, Rust tempfile::tempdir (real files). There is no vi.mock in the TS suite at all — CapturingLogger overrides the logger's own declared logFunc hook, which is not a stream. The only MagicMock is a Lambda context object.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

[changeset-bot]

🦋 Changeset detected

Latest commit: 40b3a97

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/logger	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR