Caro.Release.Hotfix

---
description: Emergency hotfix workflow for critical security patches
---

**Path reference rule:** When you mention directories or files, provide either the absolute path or a path relative to the project root (for example, `Cargo.toml`). Never refer to a folder by name alone.

## User Input

```text
$ARGUMENTS

You MUST consider the user input before proceeding (if not empty).

Expected input: Brief description of the security issue or bug being hotfixed

Example: "/caro.release.hotfix RUSTSEC-2025-0001 critical memory safety issue"

---

Branch Pre-flight Check (EMERGENCY MODE)

This command can start from ANY branch due to emergency nature.

However, it will:

1. Fetch latest tags
2. Create a hotfix branch from the latest release tag
3. Apply minimal fix
4. Fast-track through release process

WARNING: This bypasses normal development workflow. Use ONLY for:

• Critical security vulnerabilities
• Data loss bugs
• System crash bugs
• Actively exploited vulnerabilities

---

Workflow Context

Emergency Workflow: Bypasses normal feature development cycle

Purpose: Rapid patch release for critical issues

After this: Hotfix must be backported to main and any active release branches

---

Outline

1. Verify Emergency Justification

Display warning:

⚠️  EMERGENCY HOTFIX WORKFLOW ⚠️

This workflow is for CRITICAL ISSUES ONLY:
  • Security vulnerabilities (RUSTSEC advisories)
  • Data loss or corruption bugs
  • System crashes or panics
  • Actively exploited vulnerabilities

For non-critical bugs, use the normal release workflow:
  /caro.release.prepare

Continue with hotfix? (yes/no - must type 'yes')

Require explicit confirmation:

• User must type "yes" (not just "y")
• If anything else, exit with instructions to use normal workflow

2. Identify Base Version

Fetch all tags:

git fetch --tags

Get latest release tag:

LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
if [ -z "$LATEST_TAG" ]; then
  echo "ERROR: No release tags found"
  echo "Cannot create hotfix without a base release"
  exit 1
fi

echo "Latest release: $LATEST_TAG"

Parse version:

BASE_VERSION=${LATEST_TAG#v}
echo "Base version: $BASE_VERSION"

Prompt for hotfix version:

Current latest: v$BASE_VERSION

Hotfix version will be: v$BASE_VERSION patch bump

Examples:
  v1.0.0 → v1.0.1 (patch bump)
  v1.2.3 → v1.2.4 (patch bump)

This hotfix will be: v[calculated]

Proceed? (y/n)

Calculate hotfix version:

• Parse major.minor.patch from BASE_VERSION
• Increment patch number
• Store as HOTFIX_VERSION

3. Create Hotfix Branch

Create branch from release tag:

git checkout -b "hotfix/v$HOTFIX_VERSION" "$LATEST_TAG"

Verify branch created:

CURRENT_BRANCH=$(git branch --show-current)
echo "Created hotfix branch: $CURRENT_BRANCH"

If branch already exists:

• Ask: "Hotfix branch already exists. Continue on existing branch? (y/n)"
• If yes: Checkout existing branch
• If no: Exit with instructions

4. Document the Issue

Create or update SECURITY.md:

• If security vulnerability, document in SECURITY.md
• Include CVE number if available
• Include RUSTSEC advisory ID if applicable
• Document impact and severity

Prepare hotfix description:

Hotfix v$HOTFIX_VERSION

Issue: [User-provided description from $ARGUMENTS]

Severity: [Prompt user: Critical/High/Medium]

Impact:
- [Prompt user for impact description]

Fix:
- [Will be documented after fix is applied]

5. Apply Minimal Fix

This is the manual step:

Apply the MINIMAL fix required to address the issue.

Guidelines:
  • Change only what's necessary to fix the issue
  • Avoid refactoring or "improvements"
  • Minimize risk of introducing new bugs
  • Focus on stability over elegance

Files to modify:
  [User identifies which files need changes]

After making changes, commit them:
  git add [files]
  git commit -m "hotfix: [description]"

Type 'done' when fix is committed:

Wait for user confirmation:

• User types "done" when fix is committed
• Verify commit exists: git log -1 --oneline

6. Update Version and Changelog

Update Cargo.toml:

# Update version to HOTFIX_VERSION
sed -i '' "s/^version = .*/version = \"$HOTFIX_VERSION\"/" Cargo.toml

Verify version update:

grep '^version = ' Cargo.toml | head -1

Update CHANGELOG.md:

• Add hotfix section at the top (after [Unreleased])
• Document the security fix
• Include CVE/RUSTSEC IDs if applicable

Example CHANGELOG entry:

## [X.Y.Z] - YYYY-MM-DD [SECURITY HOTFIX]

### Security
- **CRITICAL**: Fixed [vulnerability description]
  - CVE-YYYY-NNNNN / RUSTSEC-YYYY-NNNN
  - Impact: [description]
  - Severity: [Critical/High]
  - Credit: [Reporter name if applicable]

### Fixed
- [Bug description if non-security]

**Upgrade immediately**: This release fixes a critical security vulnerability.
All users should upgrade as soon as possible.

Commit version bump:

git add Cargo.toml CHANGELOG.md SECURITY.md
git commit -m "chore: Bump version to $HOTFIX_VERSION for security hotfix"

7. Run Tests

Critical: Tests must pass before hotfix release:

echo "Running tests..."
cargo test --lib
cargo test --test '*'

If tests fail:

• Display failures
• DO NOT proceed
• Fix test failures
• Re-run tests until all pass

If tests pass:

✓ All tests passed

Test summary:
  • N unit tests passed
  • N integration tests passed

8. Quick Security Audit

Run cargo audit (abbreviated):

cargo audit

If new vulnerabilities found:

• Display them
• Ask: "New vulnerabilities found. These should be fixed if possible. Continue anyway? (y/n)"
• Document in CHANGELOG.md if proceeding

9. Fast-Track PR

Push hotfix branch:

git push -u origin "hotfix/v$HOTFIX_VERSION"

Create URGENT PR:

gh pr cre