chore(main): release 2.3.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.2.6"
+  ".": "2.3.0"
 }

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 > 说明：以下历史条目中提及的 `AGENTS.md` 为**本地维护、不随仓库分发**的资产（`.gitignore` 已忽略）；条目仅为变更发生时的历史记录，clone 读者无需在仓库中查找该文件。
 
+## [2.3.0](https://github.com/ReSerendipity/TTS_MultiModel/compare/v2.2.6...v2.3.0) (2026-09-25)
+
+
+### Features
+
+* **upstream-sync:** 落地 2.5 参数面 + prompt_text 链路与护栏 + 上游同步探针 ([#142](https://github.com/ReSerendipity/TTS_MultiModel/issues/142)) ([d7f609f](https://github.com/ReSerendipity/TTS_MultiModel/commit/d7f609fae4381cb8b234d2d194aa921cb6bba918))
+
+
+### Bug Fixes
+
+* **security:** 路径包含性与对外错误面各收敛到一处 ([#155](https://github.com/ReSerendipity/TTS_MultiModel/issues/155)) ([d875c9c](https://github.com/ReSerendipity/TTS_MultiModel/commit/d875c9c9d757478d2041f70dd8524a727205b313))
+* **security:** 转义 step-audio-editx / voicebox 成功页的请求可控插值 ([#153](https://github.com/ReSerendipity/TTS_MultiModel/issues/153)) ([3d549a8](https://github.com/ReSerendipity/TTS_MultiModel/commit/3d549a8946f864b3e8fe4a5afabf164425253dc3))
+* **ui:** [#130](https://github.com/ReSerendipity/TTS_MultiModel/issues/130) —— 16 处（不是 7 处）内联事件属性不再把服务器值拼进 JS 字符串，加一条全仓闸 ([650825c](https://github.com/ReSerendipity/TTS_MultiModel/commit/650825cd371e7a18f2599531c0e59d44e4f98c35))
+* **ui:** 16 处内联事件属性不再把服务器值拼进 JS 字符串，改成 data-* + 事件委托（[#130](https://github.com/ReSerendipity/TTS_MultiModel/issues/130)） ([ac9c1dd](https://github.com/ReSerendipity/TTS_MultiModel/commit/ac9c1ddd1c97c610430265cfee373ba021a89dae))
+
 ## [2.2.6](https://github.com/ReSerendipity/TTS_MultiModel/compare/v2.2.5...v2.2.6) (2026-09-23)
 
 

config.yaml

@@ -1,4 +1,4 @@
-version: "2.2.6"
+version: "2.3.0"
 
 server:
   host: "127.0.0.1"

deploy/kubernetes/deployment.yaml

@@ -44,7 +44,7 @@ spec:
         # P0-1：subPath 挂载要求 PVC 内子目录预先存在（kubelet 不会自动创建）。
         # 用主镜像（离线可用、自带 python）在可写的 data 卷上预建全部运行时目录。
         - name: init-dirs
-          image: ghcr.io/reserendipity/tts_multimodel:2.2.6
+          image: ghcr.io/reserendipity/tts_multimodel:2.3.0
           imagePullPolicy: IfNotPresent
           command: ["python3.12", "-c",
             "import os; [os.makedirs(f'/mnt/data/{d}', exist_ok=True) for d in ['data','outputs','logs','cache','lora','personas']]; print('init-dirs ok')"]
@@ -65,7 +65,7 @@ spec:
               memory: "256Mi"
       containers:
         - name: tts
-          image: ghcr.io/reserendipity/tts_multimodel:2.2.6
+          image: ghcr.io/reserendipity/tts_multimodel:2.3.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 7869

desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tts-multimodel-desktop",
-  "version": "2.2.6",
+  "version": "2.3.0",
   "private": true,
   "description": "TTS MultiModel 桌面应用壳",
   "scripts": {

desktop/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tts-multimodel-desktop"
-version = "2.2.6"
+version = "2.3.0"
 description = "TTS MultiModel 桌面应用壳"
 authors = ["TTSMultiModel"]
 edition = "2021"

desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "TTSMultiModel",
-  "version": "2.2.6",
+  "version": "2.3.0",
   "identifier": "com.ttsmultimodel.desktop",
   "build": {
     "beforeDevCommand": "",

docs/release-governance.md

@@ -8,7 +8,7 @@
 
 ## 1. 版本号规范
 
-- 遵循 SemVer `MAJOR.MINOR.PATCH`。**已发布最新 = v2.2.6（2026-09-23）**。
+- 遵循 SemVer `MAJOR.MINOR.PATCH`。**已发布最新 = v2.3.0（2026-09-25）**。
   版本号出现在 11 处（`version.json`/`pyproject.toml`/`config.yaml`/`desktop/*`/`scripts/installer/setup.nsi`），
   但只有 tag + GitHub Release 同时存在才算发出去；核对：`gh release view v<版本>`。
   > 其中 `desktop/package-lock.json` 在 `.gitignore` 里（不是仓库内的版本位）；仓库内跟踪的 9 处

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tts-multimodel"
-version = "2.2.6"
+version = "2.3.0"
 description = "TTS MultiModel - Multi-engine Text-to-Speech platform with voice cloning, voice design, and LoRA fine-tuning"
 readme = "README.md"
 license = "Apache-2.0"

scripts/installer/setup.nsi

@@ -5,15 +5,15 @@ Unicode true
 !include "LogicLib.nsh"
 
 Name "TTSMultiModel 桌面版"
-OutFile "TTSMultiModel-Setup-v2.2.6.exe"
+OutFile "TTSMultiModel-Setup-v2.3.0.exe"
 InstallDir "$LOCALAPPDATA\Programs\TTSMultiModel"
 InstallDirRegKey HKCU "Software\TTSMultiModel" "InstallDir"
 RequestExecutionLevel user
 SetCompressor /SOLID lzma
 CRCCheck on
 BrandingText "TTSMultiModel"
 
-!define APP_VERSION "2.2.6"
+!define APP_VERSION "2.3.0"
 !define DATA_PREFIX "TTSMultiModel-Data.7z"
 !define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\TTSMultiModel"
 !define APP_ICON "${__FILEDIR__}\..\..\desktop\src-tauri\icons\icon.ico"
@@ -135,7 +135,7 @@ Section "TTSMultiModel 桌面版" SEC_APP
 SectionEnd
 
 ; ---------- 版本信息 ----------
-VIProductVersion "2.2.6.0"
+VIProductVersion "2.3.0.0"
 VIAddVersionKey "ProductName" "TTSMultiModel 桌面版"
 VIAddVersionKey "LegalCopyright" "Copyright (C) 2026 TTSMultiModel"
 VIAddVersionKey "ProductVersion" "${APP_VERSION}"

version.json

@@ -1,6 +1,6 @@
 {
-  "version": "2.2.6",
-  "release_date": "2026-09-23",
+  "version": "2.3.0",
+  "release_date": "2026-09-25",
   "minimum_shell_version": "2.2.2",
-  "changelog": "2.2.6：这一版修的是「照着 k8s 清单上线却拉不到镜像」。清单、README 与回滚 SOP 里的镜像名一直写的是 ghcr.io/reserendipity/tts-multimodel（连字符），而 docker-publish 真正推的是 tts_multimodel（下划线：名字由 github.repository 整体小写得到，下划线原样保留）—— 连字符那个包从来不存在，照清单起的两个容器（含预建目录的 init 容器）必然 ImagePullBackOff。名字与 tag 形状现在由 tests/test_image_name_consistency.py 从工作流推导钉住：原先那道版本位闸把名字写死在正则里，所以只核得出版本、核不出名字。清单同时补上 imagePullSecrets: ghcr-pull 与 README 里的建法——那个包不是匿名可拉的，缺这一步 kubectl apply 不会报错、Pod 却永远起不来。另外 docker-publish 加了并发组（同一天曾有三条 20+ 分钟的构建并行、抢同一份 10 GiB 层缓存），回滚 SOP 那条命令去掉多余的 v 前缀。真机侧的验收没重跑：这一版不含运行时代码改动。"
+  "changelog": "2.3.0：这一版的主干是极致克隆的 prompt_text 链路与 2.5 参数面落地，外加两条上游同步探针（#142）；安全面做了三处收敛——路径包含性与对外错误面各收成一处（#155）、step-audio-editx / voicebox 成功页的请求可控插值改为转义（#153）、16 处内联事件属性不再把服务器值拼进 JS 字符串并加了全仓闸（#130）。口径要说清三件事：GPU 真机推理链路本轮没有覆盖（self-hosted runner 数为 0，release-gate 只跑过 fixture）；CI 侧新增的 DCO 自证与并发去重属门禁改动，不改运行行为；以及 release-please 自己打的 tag 不会级联触发 docker-publish，所以 2.3.0 的容器镜像需要显式发布（手工 git tag 或 dispatch），k8s 清单的镜像 tag 在那之前只是目标值而非已存在值。"
 }