Prepare CLI 0.5.3 with congestion-aware rendering

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "stack-diagram-cli"
-version = "0.5.2"
+version = "0.5.3"
 edition = "2024"
 rust-version = "1.85"
 publish = ["crates-io"]
@@ -28,8 +28,8 @@ serde_json = "=1.0.151"
 serde_yaml_ng = "=0.10.0"
 sha2 = "=0.11.0"
 stack-compiler = "=0.1.0"
-stack-engine = "=0.8.0"
-stack-theme = "=0.6.0"
+stack-engine = "=0.9.0"
+stack-theme = "=0.7.0"
 ureq = { version = "=3.4.0", default-features = false, features = ["rustls"] }
 zip = { version = "=6.0.0", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 

THIRD_PARTY_LICENSES.md

@@ -6,9 +6,9 @@ Audit date: 2026-09-05
 
 | Component | Version or revision | License | Source | Distribution note |
 | --- | --- | --- | --- | --- |
-| `stack-engine` / `stack-formatter` | `0.8.0` / `0.1.0` (crates.io) | Apache-2.0 | <https://github.com/stack-sh/engine> | Linked into the native binary; validates and renders caller-owned provider packs without bundling vendor assets. |
+| `stack-engine` / `stack-formatter` | `0.9.0` / `0.1.0` (crates.io) | Apache-2.0 | <https://github.com/stack-sh/engine> | Linked into the native binary; validates and renders caller-owned provider packs without bundling vendor assets. |
 | `stack-compiler` | `0.1.0 (crates.io)` | Apache-2.0 | <https://github.com/stack-sh/compiler> | Linked directly for protocol-neutral language intelligence and transitively through `stack-engine`; performs no runtime I/O. |
-| `stack-theme` | `0.6.0 (crates.io)` | Apache-2.0 | <https://github.com/stack-sh/theme> | Linked directly and through `stack-engine`; its fallback icons and 30 explicit core SVGs are Stack-authored Apache-2.0 assets. It also provides the asset-free provider-pack contract and types. |
+| `stack-theme` | `0.7.0 (crates.io)` | Apache-2.0 | <https://github.com/stack-sh/theme> | Linked directly and through `stack-engine`; its fallback icons and 30 explicit core SVGs are Stack-authored Apache-2.0 assets. It also provides the asset-free provider-pack contract and types. |
 | `roxmltree` | `0.21.1` | MIT OR Apache-2.0 | <https://github.com/RazrFalcon/roxmltree> | Parses untrusted local SVG into a read-only tree before allowlisted serialization. |
 | `sha2`, `digest`, `block-buffer`, `crypto-common`, `hybrid-array`, `const-oid`, `typenum` | `0.11.0`, `0.11.3`, `0.12.1`, `0.2.2`, `0.4.14`, `0.10.2`, `1.20.1` | MIT OR Apache-2.0 | <https://github.com/RustCrypto> | Computes complete archive and per-asset SHA-256 identities. |
 | `zip` | `6.0.0` | MIT | <https://github.com/zip-rs/zip2> | Reads audited, allowlisted entries from verified official ZIP archives. |

distribution/distribution-contract.json

@@ -6,7 +6,7 @@
     "sourceCargoPackage": "stack-diagram-cli",
     "publishedCargoPackage": "stack-diagram-cli",
     "sourceVersionFile": "Cargo.toml",
-    "currentSourceVersion": "0.5.2",
+    "currentSourceVersion": "0.5.3",
     "minimumRustVersion": "1.85",
     "currentReleaseVersion": "0.5.2"
   },

distribution/generated/share/man/man1/stack.1

@@ -1,4 +1,4 @@
-.TH STACK 1 "" "Stack CLI 0.5.2" "Stack CLI Manual"
+.TH STACK 1 "" "Stack CLI 0.5.3" "Stack CLI Manual"
 .SH NAME
 stack \- Stack diagram toolchain
 .SH SYNOPSIS

docs/releases/v0.5.3.md

@@ -0,0 +1,10 @@
+# Stack CLI 0.5.3
+
+- Upgrade the shared rendering engine to 0.9.0 and the core theme catalog to 0.7.0.
+- Distribute busy edge terminals and routing lanes to reduce dense connector bundles and ambiguous junctions.
+- Keep connectors clear of node and group borders with deterministic congestion penalties.
+- Render built-in cache nodes as rounded cards while preserving custom theme cylinder shapes.
+
+Commands, configuration, machine-readable contracts, and the Rust 1.85 minimum remain unchanged. SVG geometry and bytes intentionally change; review any snapshots or exported diagrams when upgrading.
+
+Upgrade through the package manager that owns the installation. There is no self-update command. A new source version does not activate a distribution channel until its release artifacts and clean-install checks have succeeded.

scripts/release-security.test.mjs

@@ -12,7 +12,7 @@ import {
   verifyReleaseMetadata,
 } from "./release-security.mjs";
 
-const version = "0.5.2";
+const version = "0.5.3";
 const commit = "0123456789abcdef0123456789abcdef01234567";
 const provenancePredicate = "https://slsa.dev/provenance/v1";
 const sbomPredicate = "https://spdx.dev/Document/v2.3";

scripts/resolve-release-context.test.mjs

@@ -20,17 +20,17 @@ test("main dispatch resolves a non-publishing verification run", () => {
       ref: "refs/heads/main",
       refName: "main",
       sha,
-      requestedVersion: "0.5.2",
+      requestedVersion: "0.5.3",
       cargoToml,
       contract,
     }),
     {
-      version: "0.5.2",
-      tag: "v0.5.2",
+      version: "0.5.3",
+      tag: "v0.5.3",
       sourceRef: "refs/heads/main",
       publish: false,
       verifiedChannels: "",
-      minimumSupportedCliVersion: "0.5.2",
+      minimumSupportedCliVersion: "0.5.3",
     },
   );
 });
@@ -39,28 +39,28 @@ test("an exact version tag resolves a publishing run", () => {
   assert.deepEqual(
     resolveReleaseContext({
       eventName: "push",
-      ref: "refs/tags/v0.5.2",
-      refName: "v0.5.2",
+      ref: "refs/tags/v0.5.3",
+      refName: "v0.5.3",
       sha,
       requestedVersion: "",
       cargoToml,
       contract,
     }),
     {
-      version: "0.5.2",
-      tag: "v0.5.2",
-      sourceRef: "refs/tags/v0.5.2",
+      version: "0.5.3",
+      tag: "v0.5.3",
+      sourceRef: "refs/tags/v0.5.3",
       publish: true,
       verifiedChannels: "github-release",
-      minimumSupportedCliVersion: "0.5.2",
+      minimumSupportedCliVersion: "0.5.3",
     },
   );
 });
 
 test("removed self-update cannot be activated", () => {
   const activated = structuredClone(contract);
   activated.channels.push({ id: "self-update", state: "available" });
-  assert.throws(() => resolveReleaseContext({eventName: "push", ref: "refs/tags/v0.5.2", refName: "v0.5.2", sha, cargoToml, contract: activated}), /self-update has been removed/);
+  assert.throws(() => resolveReleaseContext({eventName: "push", ref: "refs/tags/v0.5.3", refName: "v0.5.3", sha, cargoToml, contract: activated}), /self-update has been removed/);
 });
 
 test("manual runs from another ref or version are rejected", () => {
@@ -72,7 +72,7 @@ test("manual runs from another ref or version are rejected", () => {
     contract,
   };
   assert.throws(
-    () => resolveReleaseContext({ ...common, ref: "refs/heads/topic", requestedVersion: "0.5.2" }),
+    () => resolveReleaseContext({ ...common, ref: "refs/heads/topic", requestedVersion: "0.5.3" }),
     /must run from main/,
   );
   assert.throws(
@@ -107,7 +107,7 @@ test("source and contract version drift is rejected", () => {
       ref: "refs/heads/main",
       refName: "main",
       sha,
-      requestedVersion: "0.5.2",
+      requestedVersion: "0.5.3",
       cargoToml,
       contract: drifted,
     }),

scripts/test_package_release.py

@@ -9,7 +9,7 @@
 
 
 class PackageReleaseTest(unittest.TestCase):
-    version = "0.5.2"
+    version = "0.5.3"
     target = "aarch64-apple-darwin"
     source_date_epoch = 1_788_566_400