chore(release): prepare v1.3.3

Bump version strings across install scripts, README, SECURITY, release
workflow, and packaging templates. SHA256 placeholders until assets upload.

Author: Cod-e-Codes

.github/workflows/release.yml

@@ -6,9 +6,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version to build (e.g., v1.3.2)'
+        description: 'Version to build (e.g., v1.3.3)'
         required: true
-        default: 'v1.3.2'
+        default: 'v1.3.3'
 
 permissions:
   contents: read

CHANGELOG.md

@@ -6,10 +6,16 @@ Narrative notes by release. Per-file binaries and assets: [GitHub releases](http
 
 On **`main`** only; not part of the latest tagged release until you tag and publish. Compare against the current tag on [GitHub releases](https://github.com/Cod-e-Codes/marchat/releases).
 
-- **Dependencies**: **modernc.org/sqlite** v1.55.0 (SQLite 3.53.3; **modernc.org/libc** v1.74.1); **github.com/mattn/go-runewidth** v0.0.27.
-- **Server**: **Fix:** oversized file WebSocket messages hit explicit read-limit handling with correct rejection logging and a System reply when the connection is still writable; read limit accounts for base64 JSON wire size (not raw bytes only); rejects declared `size` and actual payload length above the limit.
+## v1.3.3
+
+**Released 2026-08-03.** Since **[v1.3.2](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.3.2)**; compare [`v1.3.2...v1.3.3`](https://github.com/Cod-e-Codes/marchat/compare/v1.3.2...v1.3.3). Commits: **`git log v1.3.2..v1.3.3 --oneline`**.
+
+- **Server**: **Fix:** oversized file WebSocket messages hit explicit read-limit handling with correct rejection logging and a System reply when the connection is still writable; read limit accounts for base64 JSON wire size (not raw bytes only); rejects declared `size` and actual payload length above the limit ([#114](https://github.com/Cod-e-Codes/marchat/issues/114)).
 - **Client**: **Fix:** WebSocket close **1009** (message too big) shows a file-size error instead of a generic reconnect warning.
-- **Plugins**: Archive extraction uses **`os.OpenRoot`** scoped writes and **`filepath.IsLocal`** entry validation so zip-slip static analysis and runtime checks align.
+- **Plugins**: Archive extraction uses **`os.OpenRoot`** scoped writes and **`filepath.IsLocal`** entry validation so zip-slip static analysis and runtime checks align (CodeQL **go/zipslip**).
+- **Docs**: **PROTOCOL** and **TESTING** note file rejection behavior and refreshed coverage (**46.4%** main module).
+- **Dependencies**: **modernc.org/sqlite** v1.55.0 (SQLite 3.53.3; **modernc.org/libc** v1.74.1); **github.com/mattn/go-runewidth** v0.0.27.
+- **Packaging**: Version strings and URLs for **v1.3.3** in **install.ps1**, **install.sh**, **build-release.ps1**, **scripts/build-*.ps1/sh**, **README**, **SECURITY.md**, **.github/workflows/release.yml**, and **packaging/** (Homebrew, Scoop, winget **1.3.3** manifest set, Chocolatey, AUR). **SHA256** fields are **placeholders** (`000000...`) until replaced from published release zips (**PACKAGING.md**, **packaging/ci/render-release-manifests.sh**).
 
 ## v1.3.2
 

PACKAGING.md

@@ -58,7 +58,7 @@ Published tap: [homebrew-marchat](https://github.com/Cod-e-Codes/homebrew-marcha
 
 Upstream is [microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs). Maintainers use a fork, add `manifests/c/Cod-e-Codes/Marchat/<PackageVersion>/`, run `winget validate` on that folder, and open a PR. Package identifier: `Cod-e-Codes.Marchat`. The installer is a zip with `NestedInstallerType: portable` and two `PortableCommandAlias` entries for client and server. Microsoft may prompt first-time contributors to accept the CLA on the PR; follow the bot instructions there.
 
-Example template path in this repo: `packaging/winget/manifests/c/Cod-e-Codes/Marchat/1.3.2/` (duplicate the folder layout for new versions). Older **`1.0.0/`**, **`1.1.0/`**, **`1.2.0/`**, **`1.3.0/`**, and **`1.3.1/`** manifests may remain for reference; the current release templates target **v1.3.2** until the next bump.
+Example template path in this repo: `packaging/winget/manifests/c/Cod-e-Codes/Marchat/1.3.3/` (duplicate the folder layout for new versions). Older **`1.0.0/`**, **`1.1.0/`**, **`1.2.0/`**, **`1.3.0/`**, **`1.3.1/`**, and **`1.3.2/`** manifests may remain for reference; the current release templates target **v1.3.3** until the next bump.
 
 **Checksums vs GitHub release timing:** Portable zip manifests embed SHA256. After you publish a release and the five platform zips exist on GitHub, run [`packaging/ci/render-release-manifests.sh`](packaging/ci/render-release-manifests.sh) with `RELEASE_TAG` set and copy `packaging-out/` into `packaging/` (and into your tap, bucket, winget fork, or AUR clone as needed) so local `winget validate`, `brew audit`, and `choco pack` match real bytes. The committed templates may carry placeholder hashes until that sync step.
 

README.md

@@ -7,7 +7,7 @@
 [![Go Version](https://img.shields.io/github/go-mod/go-version/Cod-e-Codes/marchat?logo=go)](https://go.dev/dl/)
 [![GitHub all releases](https://img.shields.io/github/downloads/Cod-e-Codes/marchat/total?logo=github)](https://github.com/Cod-e-Codes/marchat/releases)
 [![Docker Pulls](https://img.shields.io/docker/pulls/codecodesxyz/marchat?logo=docker)](https://hub.docker.com/r/codecodesxyz/marchat)
-[![Version](https://img.shields.io/badge/version-v1.3.2-blue)](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.3.2)
+[![Version](https://img.shields.io/badge/version-v1.3.3-blue)](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.3.3)
 
 A lightweight terminal chat with real-time messaging over WebSockets, optional E2E encryption, and a flexible plugin ecosystem. Built for developers who prefer the command line.
 
@@ -37,7 +37,7 @@ Both clients follow the same wire format documented in [PROTOCOL.md](PROTOCOL.md
 
 ## Release notes
 
-**Latest tagged release:** [v1.3.2](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.3.2) (2026-07-15). Narrative history: [CHANGELOG.md](CHANGELOG.md). Assets and tags: [GitHub releases](https://github.com/Cod-e-Codes/marchat/releases).
+**Latest tagged release:** [v1.3.3](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.3.3) (2026-08-03). Narrative history: [CHANGELOG.md](CHANGELOG.md). Assets and tags: [GitHub releases](https://github.com/Cod-e-Codes/marchat/releases).
 
 **`main` branch:** may include changes not yet in that tag (for example items under **Unreleased** in [CHANGELOG.md](CHANGELOG.md)). Feature descriptions elsewhere in this README match the tree you build from source; compare your binary’s `-doctor` / `-version` output to the release page when in doubt.
 
@@ -153,12 +153,12 @@ Tables created by the server (dialect-aware DDL for SQLite, PostgreSQL, and MySQ
 **Binary Installation:**
 ```bash
 # Linux (amd64)
-wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.2/marchat-v1.3.2-linux-amd64.zip
-unzip marchat-v1.3.2-linux-amd64.zip && chmod +x marchat-*
+wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.3/marchat-v1.3.3-linux-amd64.zip
+unzip marchat-v1.3.3-linux-amd64.zip && chmod +x marchat-*
 
 # macOS (amd64)
-wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.2/marchat-v1.3.2-darwin-amd64.zip
-unzip marchat-v1.3.2-darwin-amd64.zip && chmod +x marchat-*
+wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.3/marchat-v1.3.3-darwin-amd64.zip
+unzip marchat-v1.3.3-darwin-amd64.zip && chmod +x marchat-*
 
 # Windows - PowerShell
 iwr -useb https://raw.githubusercontent.com/Cod-e-Codes/marchat/main/install.ps1 | iex
@@ -184,11 +184,11 @@ See [PACKAGING.md](PACKAGING.md) and `packaging/` for Homebrew, Scoop, winget, C
 
 **Docker:**
 ```bash
-docker pull codecodesxyz/marchat:v1.3.2
+docker pull codecodesxyz/marchat:v1.3.3
 docker run -d -p 8080:8080 \
   -e MARCHAT_ADMIN_KEY=$(openssl rand -hex 32) \
   -e MARCHAT_USERS=admin1,admin2 \
-  codecodesxyz/marchat:v1.3.2
+  codecodesxyz/marchat:v1.3.3
 ```
 
 **Docker Compose (local development):**

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-`marchat` is currently at **v1.3.2**.  
+`marchat` is currently at **v1.3.3**.  
 All security updates and fixes are applied to the `main` branch.
 
 | Version            | Supported |

build-release.ps1

@@ -1,9 +1,9 @@
-# Build script for marchat v1.3.2
+# Build script for marchat v1.3.3
 # This script builds all platform targets and creates release zips
 
 $ErrorActionPreference = "Stop"
 
-$VERSION = "v1.3.2"
+$VERSION = "v1.3.3"
 $BUILD_DIR = "build"
 $RELEASE_DIR = "release"
 

install.ps1

@@ -4,7 +4,7 @@
 # Supports Windows, Linux, macOS, and Android (via PowerShell Core)
 
 param(
-    [string]$Version = "v1.3.2"
+    [string]$Version = "v1.3.3"
 )
 
 $ErrorActionPreference = "Stop"

install.sh

@@ -5,7 +5,7 @@
 
 set -e  # Exit on any error
 
-VERSION="v1.3.2"
+VERSION="v1.3.3"
 
 # Detect OS and architecture
 OS=$(uname | tr '[:upper:]' '[:lower:]')

packaging/aur/.SRCINFO

@@ -1,16 +1,16 @@
 pkgbase = marchat-bin
 	pkgdesc = Terminal chat with WebSockets (official release binaries)
-	pkgver = 1.3.2
+	pkgver = 1.3.3
 	pkgrel = 1
 	url = https://github.com/Cod-e-Codes/marchat
 	arch = x86_64
 	arch = aarch64
 	license = MIT
 	depends = glibc
 	options = !strip
-	source_x86_64 = marchat-v1.3.2-linux-amd64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.2/marchat-v1.3.2-linux-amd64.zip
-	sha256sums_x86_64 = 3f604784d11452ad907775676cb0774de8f932987e5cd208505c9d46eb89367a
-	source_aarch64 = marchat-v1.3.2-linux-arm64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.2/marchat-v1.3.2-linux-arm64.zip
-	sha256sums_aarch64 = 8893e13368016d727fed37b9e2b8fff6c75c5598aabb4b059eb1f36041945cd7
+	source_x86_64 = marchat-v1.3.3-linux-amd64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.3/marchat-v1.3.3-linux-amd64.zip
+	sha256sums_x86_64 = 0000000000000000000000000000000000000000000000000000000000000000
+	source_aarch64 = marchat-v1.3.3-linux-arm64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.3.3/marchat-v1.3.3-linux-arm64.zip
+	sha256sums_aarch64 = 0000000000000000000000000000000000000000000000000000000000000000
 
 pkgname = marchat-bin

packaging/aur/PKGBUILD

@@ -1,8 +1,8 @@
 # Maintainer: Cody Marsengill <cod.e.codes.dev@gmail.com>
 pkgname=marchat-bin
-pkgver=1.3.2
+pkgver=1.3.3
 pkgrel=1
-_pkgtag=v1.3.2
+_pkgtag=v1.3.3
 pkgdesc='Terminal chat with WebSockets (official release binaries)'
 arch=('x86_64' 'aarch64')
 url='https://github.com/Cod-e-Codes/marchat'
@@ -11,8 +11,8 @@ options=('!strip')
 depends=('glibc')
 source_x86_64=("marchat-${_pkgtag}-linux-amd64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/${_pkgtag}/marchat-${_pkgtag}-linux-amd64.zip")
 source_aarch64=("marchat-${_pkgtag}-linux-arm64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/${_pkgtag}/marchat-${_pkgtag}-linux-arm64.zip")
-sha256sums_x86_64=('3f604784d11452ad907775676cb0774de8f932987e5cd208505c9d46eb89367a')
-sha256sums_aarch64=('8893e13368016d727fed37b9e2b8fff6c75c5598aabb4b059eb1f36041945cd7')
+sha256sums_x86_64=('0000000000000000000000000000000000000000000000000000000000000000')
+sha256sums_aarch64=('0000000000000000000000000000000000000000000000000000000000000000')
 
 package() {
   if [[ $CARCH == x86_64 ]]; then