chore(release): prepare VaultSync 2.0.1 build 37

[psimaker]

Version bump to 2.0.1 (build 37, app + widget) and the CHANGELOG section for the #135 identity fail-closed fix (#138) — the only shipped change since 2.0.0. go/bridge changed, so the archive needs a fresh xcframework (rebuilt and verified during prep). Verification on this tree: Go bridge suite green, gofmt clean, full Xcode plan 431/431 zero fail/skip (xcresulttool-verified), strings parity 884 keys, design-token lint green, version-check logic mirrored locally.

Summary

• Prepared the VaultSync 2.0.1 (build 37) release for both the iOS app and the VaultSyncWidget extension (bumped CFBundleShortVersionString/CFBundleVersion accordingly) and updated the release changelog.
• Device identity fail-closed fix: after a crash or failed engine start—when the stored identity certificate can’t be loaded—the sync engine no longer silently regenerates a new device identity (which could invalidate existing pairings and look like endless new “unknown devices”). Instead, it refuses to start in ambiguous states and reports the error until identity verification is unambiguous; only a confirmed first launch can create a new identity. This improves privacy/security by preventing silent identity churn and unintended re-pairing.
• Security/dependency update: bumped golang.org/x/text to 0.39.0 (fixes GO-2026-5970 infinite-loop DoS in Unicode normalization) with transitive moves to x/sys 0.46.0 and x/tools 0.47.0, and included a freshly rebuilt/verified Go bridge xcframework due to go/bridge changes.

Verification

• govulncheck (pinned) reported zero called vulnerabilities.
• Go bridge suite passed.
• Formatting checks were clean.
• Full Xcode plan completed successfully: 431/431 tests passing, with no failures or skips.
• Additional checks passed: strings parity, design-token lint, and version-check logic.

Security addendum (2026-07-22): the merge-blocking govulncheck gate flagged GO-2026-5970 (infinite loop on invalid input in golang.org/x/text, reached by the embedded engine via norm.Form). Fixed in the second commit by bumping x/text to 0.39.0 (x/sys 0.46.0 / x/tools 0.47.0 move along transitively) with a CHANGELOG Security entry. Re-verified on the bumped tree: pinned govulncheck v1.6.0 reports 0 called vulnerabilities, Go suite green, gofmt clean, xcframework rebuilt, full Xcode plan re-run 431/431 zero fail/skip (xcresulttool-verified).

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e934ee38-d830-4bbc-b094-2522fd7653a9

📥 Commits

Reviewing files that changed from the base of the PR and between 0a9920d and d0e1b71.

⛔ Files ignored due to path filters (1)

• go/go.sum is excluded by !**/*.sum and included by **/*

📒 Files selected for processing (2)

• CHANGELOG.md
• go/go.mod

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: Go Tests
• GitHub Check: Helper Runtime Packaging
• GitHub Check: M5/M6 Syncthing Transfer E2E
• GitHub Check: govulncheck (go bridge)

🧰 Additional context used

📓 Path-based instructions (1)

**/*

⚙️ CodeRabbit configuration file

**/*: VaultSync syncs private Obsidian notes through Syncthing. Treat data loss,
privacy leaks, security regressions, and broken sync behavior as high priority.
Do not nitpick formatting unless it affects maintainability, correctness, or public API clarity.
Flag any accidental logging, telemetry, crash reporting, or network transfer of note contents,
vault paths, filenames with private context, API keys, APNs tokens, relay keys, or security-scoped bookmark data.

Files:

• go/go.mod

🔇 Additional comments (1)

go/go.mod (1)

66-74: LGTM!

---

📝 Walkthrough

Walkthrough

The changelog now records version 2.0.1 dated 2026-07-22. The iOS app and widget use version 2.0.1 and build 37, while several indirect Go modules were updated.

Changes

Release updates

Layer / File(s)	Summary
Release version and build updates CHANGELOG.md, ios/project.yml	The changelog identifies release 2.0.1, and the VaultSync app and widget targets use version 2.0.1 with build 37.
Go dependency updates go/go.mod	Several indirect golang.org/x/* module versions were bumped, including crypto, net, sync, sys, text, and tools.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• psimaker/vaultsync#130: Contains analogous release heading and iOS version/build updates.

Poem

A release note blooms bright,
App and widget take flight.
Go modules march in tune,
Build thirty-seven meets the moon—
2.0.1 arrives tonight.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses a conventional-commit style and clearly matches the release/version bump in this changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	Only CHANGELOG.md and indirect Go dependency pins changed; no executable code, logging, analytics, or network paths were added.
Bounded Ios Background Work	✅ Passed	PASS: This PR only updates changelog/versioning and Go deps; no Swift background-execution code changed, so the check is not applicable.
Bridge Contract Compatibility	✅ Passed	PASS — the PR only changes changelog, go.mod/go.sum, and ios/project.yml; no go/bridge or SyncBridgeService code changed, so the bridge contract stays intact.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/release-2.0.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}