From 7fbdda530c7815fcc4569d3025dfdb9daec2e654 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 15:49:32 +0000
Subject: [PATCH 1/8] build(deps): bump the gomod group across 1 directory with
 4 updates

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: oras.land/oras-go/v2
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: sigs.k8s.io/kustomize/api
  dependency-version: 0.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: sigs.k8s.io/kustomize/kyaml
  dependency-version: 0.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 15 +++++----------
 go.sum | 29 ++++++++++-------------------
 2 files changed, 15 insertions(+), 29 deletions(-)

diff --git a/go.mod b/go.mod
index 62420b36..71e8530b 100644
--- a/go.mod
+++ b/go.mod
@@ -45,7 +45,7 @@ require (
 	go.uber.org/goleak v1.3.0
 	golang.org/x/crypto v0.58.0
 	golang.org/x/mod v0.42.0
-	golang.org/x/oauth2 v0.36.0
+	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0
 	golang.org/x/term v0.47.0
@@ -61,9 +61,9 @@ require (
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/yaml.v3 v3.0.1
-	oras.land/oras-go/v2 v2.6.2
-	sigs.k8s.io/kustomize/api v0.21.1
-	sigs.k8s.io/kustomize/kyaml v0.21.1
+	oras.land/oras-go/v2 v2.7.0
+	sigs.k8s.io/kustomize/api v0.21.3
+	sigs.k8s.io/kustomize/kyaml v0.21.3
 )
 
 require (
@@ -111,7 +111,6 @@ require (
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/creativeprojects/go-selfupdate v1.7.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/dekobon/tree-sitter-groovy v0.3.0 // indirect
 	github.com/dlclark/regexp2/v2 v2.7.1 // indirect
@@ -135,14 +134,10 @@ require (
 	github.com/go-openapi/loads v0.25.3 // indirect
 	github.com/go-openapi/spec v1.0.1 // indirect
 	github.com/go-openapi/strfmt v0.27.3 // indirect
-	github.com/go-openapi/swag v0.29.2 // indirect
-	github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
 	github.com/go-openapi/swag/conv v0.29.2 // indirect
-	github.com/go-openapi/swag/fileutils v0.29.2 // indirect
 	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
 	github.com/go-openapi/swag/loading v0.29.2 // indirect
 	github.com/go-openapi/swag/mangling v0.29.2 // indirect
-	github.com/go-openapi/swag/netutils v0.29.2 // indirect
 	github.com/go-openapi/swag/pools v0.29.2 // indirect
 	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
 	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
@@ -248,6 +243,6 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/go.sum b/go.sum
index f118e5da..51ebedc4 100644
--- a/go.sum
+++ b/go.sum
@@ -146,8 +146,6 @@ github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooY
 github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davidmz/go-pageant v1.0.2 h1:bPblRCh5jGU+Uptpz6LgMZGD5hJoOt7otgT454WvHn0=
 github.com/davidmz/go-pageant v1.0.2/go.mod h1:P2EDDnMqIwG5Rrp05dTRITj9z2zpGcD9efWSkTNKLIE=
 github.com/dekobon/tree-sitter-groovy v0.3.0 h1:bLi4b7WAQr6Q7nGw529JTHr+jmqvo4yK6nkmGbYQRFU=
@@ -217,13 +215,8 @@ github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV
 github.com/go-openapi/strfmt v0.27.3 h1:cyf4J5Wjpd6bFpAs44MF8PsbWF/mWXhn82Ck/hgQZgw=
 github.com/go-openapi/strfmt v0.27.3/go.mod h1:Bl+xadPLa3nhBiaCAxNND1vrQfzyEjF0vBrLx96n/4E=
 github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
-github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
-github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
-github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw=
 github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0=
 github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q=
-github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI=
-github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0=
 github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k=
 github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs=
 github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo=
@@ -232,8 +225,6 @@ github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJf
 github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI=
 github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog=
 github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8=
-github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8=
-github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE=
 github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c=
 github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc=
 github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk=
@@ -558,8 +549,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
 golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -616,16 +607,16 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
-k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
-k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
-oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
-oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
+k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 h1:Fe0G8t8FaMDn2lpat0IHu3X9lHrVyGzDxhhCwKXKp28=
+k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926/go.mod h1:3e2VxsK2svhjvkNik92kYU1a5kgau5tZeAuEWwoN4q0=
+oras.land/oras-go/v2 v2.7.0 h1:0bXRBBSqYgPSjZRrhJbT71Rb465c+rdlft2xdQPxLtQ=
+oras.land/oras-go/v2 v2.7.0/go.mod h1:imXEFiYkTZUVVYkfv/r5GVmWeiLkGtNQA8FU4F/sjKs=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
-sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
-sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
-sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
+sigs.k8s.io/kustomize/api v0.21.3 h1:DXGrbifGrAd+7AQ75Kx/tVhr+RLMCZFfAYl61HOR3T0=
+sigs.k8s.io/kustomize/api v0.21.3/go.mod h1:JKlHjHXGh54cdoWVdKNqDscFzPb9z+sBk9upy9PBh6k=
+sigs.k8s.io/kustomize/kyaml v0.21.3 h1:4ygzLsc8B1ep9dFuEivrJ2lFIAglL19dhPrWp1ioceY=
+sigs.k8s.io/kustomize/kyaml v0.21.3/go.mod h1:HrAVNlYyEphOlRCcaSIQziGR+0ehwx6Xp1ucUrpC6hs=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=

From 3946e6df6a1d50eee5edd5de4bce2fa7fe2d7b80 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:42:08 -0400
Subject: [PATCH 2/8] fix(deps): patch x/net and gRPC before companion
 publication

---
 docs/runbooks/cut-a-release.md | 15 +++++++++++++++
 go.mod                         | 16 ++++------------
 go.sum                         | 18 ++++++++----------
 3 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/docs/runbooks/cut-a-release.md b/docs/runbooks/cut-a-release.md
index aef7d3bd..f84bbeca 100644
--- a/docs/runbooks/cut-a-release.md
+++ b/docs/runbooks/cut-a-release.md
@@ -145,3 +145,18 @@ codefly self check-update                                     # sees the new sta
 - [ ] `release.yaml` green end to end
 - [ ] `codefly version --json` reports the tag
 - [ ] `brew` install/upgrade works; `self check-update` sees it
+
+## Dependency fixes in companion images
+
+The October 2026 refresh selects `golang.org/x/net` 0.62.0 for
+GO-2026-6860 and GO-2026-6866, and gRPC 1.85.0 supersedes the old 1.84.0
+hold. The dependency update command's automatic outdated list contains direct
+dependencies; verify indirect dependencies such as `x/net` explicitly too.
+The dependency pin command supports existing indirect requirements and performs
+a standalone build after updating and tidying the locks.
+
+Companion publication compiles this checkout into the images. Merge the CLI
+fix before dispatching `companions.yaml` against Core's exact merged commit
+with new companion versions. A CLI merge does not refresh existing images:
+inspect and scan the published executable, record each index digest, and
+rebuild the services consuming it. Do not overwrite previously published tags.
diff --git a/go.mod b/go.mod
index 39577564..8a46249f 100644
--- a/go.mod
+++ b/go.mod
@@ -49,16 +49,8 @@ require (
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0
 	golang.org/x/term v0.47.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b
-	// HELD at v1.83.2: v1.84.0 is affected by GO-2026-6443 (server panic via a
-	// missing :authority/Host header) and the advisory's only fix for the 1.84
-	// line is an unreleased v1.85.0-dev pseudo-version, so there is nothing to
-	// bump to. v1.83.2 is itself the patched release for the 1.83 line. The
-	// `bootstrap-audit` gate fails on this as an actionable finding, which is
-	// correct -- do NOT add a .govulncheck.yaml suppression to get past it.
-	// Raise this to v1.85.0 (or a patched v1.84.x) once one ships; see
-	// .github/dependabot.yml, which ignores only the known-bad v1.84.0.
-	google.golang.org/grpc v1.84.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e
+	google.golang.org/grpc v1.85.0
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/yaml.v3 v3.0.1
 	oras.land/oras-go/v2 v2.7.0
@@ -237,10 +229,10 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
 	golang.org/x/exp v0.0.0-20261014143641-f0251eb4aa3e // indirect
-	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.16.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 // indirect
diff --git a/go.sum b/go.sum
index 46683ab5..280264b2 100644
--- a/go.sum
+++ b/go.sum
@@ -117,8 +117,6 @@ github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad722
 github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855/go.mod h1:rfn41uiORQ36RrOeFEjXHPLC9NUi0j14AoYJtcovsn4=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 h1:4EygH7/J0E6aM7hUPdbQGfit1rsLUNCtWJ8kMh2b9PE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
-github.com/codefly-dev/core v0.19.10 h1:rTeh1vph0xGtpiCCt2Dl1AH2Rz9hzIYt1YGcbv6bLYE=
-github.com/codefly-dev/core v0.19.10/go.mod h1:aTJY3Rw0OSVkbWRThgDzSkqieoF9mW4MiPRXM8Vzxww=
 github.com/codefly-dev/core v0.19.11-0.20261028153419-de19eba80550 h1:IBur1pFM7LelM+9ecMgl2/Mxgd+04rgesSVFm3R1k0E=
 github.com/codefly-dev/core v0.19.11-0.20261028153419-de19eba80550/go.mod h1:aTJY3Rw0OSVkbWRThgDzSkqieoF9mW4MiPRXM8Vzxww=
 github.com/codefly-dev/golor v0.1.3 h1:xmo+ceyJFRYZdvpWE2fNd0jeaadp/Ibm1BnganiGKOc=
@@ -549,8 +547,8 @@ golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
@@ -585,12 +583,12 @@ golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
 golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b h1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=
-google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b/go.mod h1:9N4vtjEwvgQKEdlFVQO0M44ErhecQ9DCSQfGoZ51M6w=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 h1:QG6hS4zFplRZvOQedzei4t2pT/zkQc3VR1u+S9/rcAw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
-google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
-google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
+google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e h1:e789sLZjeTdc02ZCQGTSzHOu0fR73+dwPQVKUp67Z88=
+google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e/go.mod h1:vHV3wJM9WZyfV7GyB+OQGq5dWVrFwCDxapPK4WlRD88=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
+google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From 80bc794d984738292a922efe35caf91295c3b5ae Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:49:41 -0400
Subject: [PATCH 3/8] fix(update): select indirect dependency pins without
 unrelated upgrades

---
 cmd/agents/deps.go               | 38 ++-------------------
 cmd/update/deps.go               | 57 +++++++++++++++++++++++---------
 cmd/update/deps_selected_test.go | 56 +++++++++++++++++++++++++++++++
 docs/cli-reference.md            | 16 ++++++---
 docs/commands.md                 |  1 +
 docs/runbooks/cut-a-release.md   | 10 ++++--
 go.mod                           | 11 ++++--
 go.sum                           | 21 ++++++++----
 pkg/dependencypins/pins.go       | 51 ++++++++++++++++++++++++++++
 9 files changed, 195 insertions(+), 66 deletions(-)
 create mode 100644 cmd/update/deps_selected_test.go
 create mode 100644 pkg/dependencypins/pins.go

diff --git a/cmd/agents/deps.go b/cmd/agents/deps.go
index f85c3993..37182292 100644
--- a/cmd/agents/deps.go
+++ b/cmd/agents/deps.go
@@ -13,10 +13,10 @@ import (
 
 	"github.com/codefly-dev/cli/cmd/common"
 	"github.com/codefly-dev/cli/pkg/cli"
+	"github.com/codefly-dev/cli/pkg/dependencypins"
 	"github.com/codefly-dev/core/shared"
 	"github.com/spf13/cobra"
 	"golang.org/x/mod/modfile"
-	"golang.org/x/mod/module"
 )
 
 // DepsCmd manages an agent's build dependencies: the local↔published core
@@ -414,44 +414,12 @@ func pinModule(ctx context.Context, dir string, env []string, version, label str
 // Select pins before any mutation so a typo cannot produce a partial update or
 // add a dependency to modules that never used it.
 func dependencyPins(dirs, dependencies []string) (map[string][]string, error) {
-	pins := make(map[string][]string)
-	selected := make(map[string]string)
 	for _, dependency := range dependencies {
-		path, version, found := strings.Cut(dependency, "@")
-		if !found || version == "" || strings.ContainsAny(version, "@ \t\r\n") || module.CheckPath(path) != nil {
-			return nil, fmt.Errorf("dependency %q must be module@version", dependency)
-		}
-		if path == coreModule {
+		if strings.HasPrefix(dependency, coreModule+"@") {
 			return nil, fmt.Errorf("select Core through --pin, not --dependency")
 		}
-		if _, exists := selected[path]; exists {
-			return nil, fmt.Errorf("dependency %q is selected more than once", path)
-		}
-		selected[path] = dependency
-	}
-	matched := make(map[string]bool)
-	for _, dir := range dirs {
-		data, err := os.ReadFile(filepath.Join(dir, "go.mod"))
-		if err != nil {
-			return nil, err
-		}
-		file, err := modfile.Parse("go.mod", data, nil)
-		if err != nil {
-			return nil, err
-		}
-		for _, requirement := range file.Require {
-			if dependency, exists := selected[requirement.Mod.Path]; exists {
-				pins[dir] = append(pins[dir], dependency)
-				matched[requirement.Mod.Path] = true
-			}
-		}
-	}
-	for path := range selected {
-		if !matched[path] {
-			return nil, fmt.Errorf("dependency %q is not required by the agent or its base fixtures", path)
-		}
 	}
-	return pins, nil
+	return dependencypins.Plan(dirs, dependencies)
 }
 
 // baseFixtureDirs returns every base-fixture Go module under the agent
diff --git a/cmd/update/deps.go b/cmd/update/deps.go
index 0f99902f..ecdb34e7 100644
--- a/cmd/update/deps.go
+++ b/cmd/update/deps.go
@@ -14,6 +14,7 @@ import (
 	"github.com/codefly-dev/cli/cmd/common"
 	"github.com/codefly-dev/cli/cmd/companion"
 	"github.com/codefly-dev/cli/pkg/cli"
+	"github.com/codefly-dev/cli/pkg/dependencypins"
 	coreaudit "github.com/codefly-dev/core/agents/services/audit"
 	"github.com/spf13/cobra"
 )
@@ -30,6 +31,7 @@ var (
 	depsAudit      bool
 	depsStaleDays  int
 	depsGo         string
+	depsSelections []string
 )
 
 // DepsCmd implements `codefly update deps` — the "update all packages"
@@ -53,6 +55,10 @@ For each Go module under --dir (default: current directory), update deps:
   - go mod tidy
   - re-audit with govulncheck (unless --audit=false)
 
+With --dependency module@version (repeatable), pin only those existing external
+requirements, including indirect dependencies, and leave other selections alone.
+All selections are validated before changing any module.
+
 With --companions, also rebuilds every companion image with 'docker build
 --pull' so floating base tags (golang:1.26-alpine, …) pick up upstream
 patch releases — clearing base-image CVEs like the Go stdlib advisories.
@@ -60,6 +66,7 @@ patch releases — clearing base-image CVEs like the Go stdlib advisories.
 Examples:
   codefly update deps                 # update Go deps under cwd + audit
   codefly update deps --dir .         # same, explicit
+  codefly update deps --dependency golang.org/x/net@v0.62.0
   codefly update deps --companions    # also rebuild companion images (--pull)
   codefly update deps --audit=false   # skip the post-update audit`,
 	Args: cobra.NoArgs,
@@ -89,6 +96,15 @@ Examples:
 		if len(modDirs) == 0 {
 			return fmt.Errorf("no go.mod found under %s", root)
 		}
+		for _, selection := range depsSelections {
+			if strings.HasPrefix(selection, internalModulePrefix) {
+				return fmt.Errorf("first-party dependency %q is not managed by update deps", selection)
+			}
+		}
+		pins, err := dependencypins.Plan(modDirs, depsSelections)
+		if err != nil {
+			return err
+		}
 		cli.Header(1, "Updating dependencies across %d module(s)", len(modDirs))
 
 		var failures []error
@@ -123,7 +139,10 @@ Examples:
 				failures = append(failures, err)
 				break
 			}
-			if err := updateModule(ctx, md); err != nil {
+			if len(depsSelections) > 0 && len(pins[md]) == 0 {
+				continue
+			}
+			if err := updateModule(ctx, md, pins[md]...); err != nil {
 				cli.Error("update %s: %v", rel(root, md), err)
 				failures = append(failures, fmt.Errorf("update %s: %w", rel(root, md), err))
 			}
@@ -172,24 +191,31 @@ Examples:
 // updateModule bumps every outdated external dependency in the module at
 // dir to its latest safe version, then tidies. Internal codefly-dev
 // modules are skipped (see internalModulePrefix).
-func updateModule(ctx context.Context, dir string) error {
-	res, err := coreaudit.Golang(ctx, dir, true)
-	if err != nil {
-		return fmt.Errorf("list outdated: %w", err)
-	}
+func updateModule(ctx context.Context, dir string, selections ...string) error {
 	var bumped int
-	for _, o := range res.Outdated {
-		if strings.HasPrefix(o.Package, internalModulePrefix) {
-			continue
+	if len(selections) > 0 {
+		if err := runGo(ctx, dir, append([]string{"get"}, selections...)...); err != nil {
+			return err
 		}
-		if o.LatestSafe == "" || o.LatestSafe == o.Current {
-			continue
+		bumped = len(selections)
+	} else {
+		res, err := coreaudit.Golang(ctx, dir, true)
+		if err != nil {
+			return fmt.Errorf("list outdated: %w", err)
 		}
-		if err := runGo(ctx, dir, "get", o.Package+"@"+o.LatestSafe); err != nil {
-			return fmt.Errorf("go get %s@%s: %w", o.Package, o.LatestSafe, err)
+		for _, o := range res.Outdated {
+			if strings.HasPrefix(o.Package, internalModulePrefix) {
+				continue
+			}
+			if o.LatestSafe == "" || o.LatestSafe == o.Current {
+				continue
+			}
+			if err := runGo(ctx, dir, "get", o.Package+"@"+o.LatestSafe); err != nil {
+				return fmt.Errorf("go get %s@%s: %w", o.Package, o.LatestSafe, err)
+			}
+			cli.Info("  %s %s → %s", o.Package, o.Current, o.LatestSafe)
+			bumped++
 		}
-		cli.Info("  %s %s → %s", o.Package, o.Current, o.LatestSafe)
-		bumped++
 	}
 	// `go mod tidy` ignores go.work: it resolves every import from the
 	// module graph (cache/network), not from workspace-local sibling
@@ -314,6 +340,7 @@ func rel(root, p string) string {
 }
 
 func init() {
+	DepsCmd.Flags().StringArrayVar(&depsSelections, "dependency", nil, "Pin only selected existing external module@version requirements, including indirect dependencies (repeatable)")
 	DepsCmd.Flags().StringVar(&depsDir, "dir", "", "Root to update (default: current directory; recurses into every go.mod)")
 	DepsCmd.Flags().BoolVar(&depsCompanions, "companions", false, "Also rebuild companion Docker images with fresh base layers (docker build --pull)")
 	DepsCmd.Flags().BoolVar(&depsAudit, "audit", true, "Run the govulncheck audit after updating")
diff --git a/cmd/update/deps_selected_test.go b/cmd/update/deps_selected_test.go
new file mode 100644
index 00000000..a0d76beb
--- /dev/null
+++ b/cmd/update/deps_selected_test.go
@@ -0,0 +1,56 @@
+package update
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/codefly-dev/cli/cmd/common"
+	"github.com/codefly-dev/cli/pkg/dependencypins"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/mod/modfile"
+)
+
+func TestSelectedDependencyUpdatesIndirectWithoutMovingOthers(t *testing.T) {
+	t.Setenv("GOWORK", "off")
+	t.Setenv("GOPROXY", "off")
+	root := t.TempDir()
+	files := map[string]string{
+		"go.mod":               "module example.test/app\ngo 1.23\nrequire (\nexample.test/direct v1.0.0\nexample.test/indirect v1.0.0 // indirect\n)\nreplace example.test/direct => ./direct\nreplace example.test/indirect => ./indirect\n",
+		"app.go":               "package app\nimport \"example.test/direct\"\nvar Value = direct.Value\n",
+		"direct/go.mod":        "module example.test/direct\ngo 1.23\nrequire example.test/indirect v1.0.0\n",
+		"direct/direct.go":     "package direct\nimport \"example.test/indirect\"\nvar Value = indirect.Value\n",
+		"indirect/go.mod":      "module example.test/indirect\ngo 1.23\n",
+		"indirect/indirect.go": "package indirect\nconst Value = 42\n",
+	}
+	for name, data := range files {
+		path := filepath.Join(root, name)
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
+		require.NoError(t, os.WriteFile(path, []byte(data), 0644))
+	}
+	// The existing module resolver is real; local replacements keep the fixture offline.
+	pins, err := dependencypins.Plan([]string{root, filepath.Join(root, "indirect")}, []string{"example.test/indirect@v1.0.1"})
+	require.NoError(t, err)
+	require.Empty(t, pins[filepath.Join(root, "indirect")], "do not inject a requirement into a module that never used it")
+	ctx, done := common.NewContext()
+	defer done()
+	require.NoError(t, updateModule(ctx, root, pins[root]...))
+	data, err := os.ReadFile(filepath.Join(root, "go.mod"))
+	require.NoError(t, err)
+	parsed, err := modfile.Parse("go.mod", data, nil)
+	require.NoError(t, err)
+	versions := map[string]string{}
+	for _, r := range parsed.Require {
+		versions[r.Mod.Path] = r.Mod.Version
+	}
+	require.Equal(t, "v1.0.1", versions["example.test/indirect"])
+	require.Equal(t, "v1.0.0", versions["example.test/direct"])
+	require.NoError(t, runGo(ctx, root, "build", "./..."))
+	require.NoError(t, runGo(ctx, root, "mod", "tidy", "-diff"))
+	before := string(data)
+	_, err = dependencypins.Plan([]string{root}, []string{"example.test/indirect@v1.0.2", "example.test/missing@v1.0.1"})
+	require.Error(t, err)
+	data, err = os.ReadFile(filepath.Join(root, "go.mod"))
+	require.NoError(t, err)
+	require.Equal(t, before, string(data), "all selections must validate before mutation")
+}
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 4c0df52e..4ee0b7ec 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -5281,6 +5281,10 @@ For each Go module under --dir (default: current directory), update deps:
   - go mod tidy
   - re-audit with govulncheck (unless --audit=false)
 
+With --dependency module@version (repeatable), pin only those existing external
+requirements, including indirect dependencies, and leave other selections alone.
+All selections are validated before changing any module.
+
 With --companions, also rebuilds every companion image with 'docker build
 --pull' so floating base tags (golang:1.26-alpine, …) pick up upstream
 patch releases — clearing base-image CVEs like the Go stdlib advisories.
@@ -5288,6 +5292,7 @@ patch releases — clearing base-image CVEs like the Go stdlib advisories.
 Examples:
   codefly update deps                 # update Go deps under cwd + audit
   codefly update deps --dir .         # same, explicit
+  codefly update deps --dependency golang.org/x/net@v0.62.0
   codefly update deps --companions    # also rebuild companion images (--pull)
   codefly update deps --audit=false   # skip the post-update audit
 ```
@@ -5299,11 +5304,12 @@ codefly update deps [flags]
 Flags:
 
 ```
-      --audit            Run the govulncheck audit after updating (default true)
-      --companions       Also rebuild companion Docker images with fresh base layers (docker build --pull)
-      --dir string       Root to update (default: current directory; recurses into every go.mod)
-      --go string        Pin the Go toolchain to this version across every go.mod + go.work (e.g. 1.26.4) — clears stdlib CVEs in standalone/CI builds
-      --stale-days int   Audit: fail when a suppression's reviewed date is older than this many days (0 disables) (default 45)
+      --audit                    Run the govulncheck audit after updating (default true)
+      --companions               Also rebuild companion Docker images with fresh base layers (docker build --pull)
+      --dependency stringArray   Pin only selected existing external module@version requirements, including indirect dependencies (repeatable)
+      --dir string               Root to update (default: current directory; recurses into every go.mod)
+      --go string                Pin the Go toolchain to this version across every go.mod + go.work (e.g. 1.26.4) — clears stdlib CVEs in standalone/CI builds
+      --stale-days int           Audit: fail when a suppression's reviewed date is older than this many days (0 disables) (default 45)
 ```
 
 ## `codefly update service`
diff --git a/docs/commands.md b/docs/commands.md
index 15350f9e..1bde38e3 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -2431,6 +2431,7 @@ codefly update workspace --agent-override codefly.dev/go-grpc=0.1.47-dev.abc123d
 codefly update service api                                            # one service to its latest compatible release
 codefly update service api --agent-version 0.1.47-dev.abc123def456    # pin one service exactly
 codefly update deps                                                   # Go dependencies under the current directory
+codefly update deps --dependency golang.org/x/net@v0.62.0              # only this existing external requirement, including indirect pins
 ```
 
 Without flags, `update workspace` and `update service` move to the agent's
diff --git a/docs/runbooks/cut-a-release.md b/docs/runbooks/cut-a-release.md
index f84bbeca..7efd382d 100644
--- a/docs/runbooks/cut-a-release.md
+++ b/docs/runbooks/cut-a-release.md
@@ -152,8 +152,14 @@ The October 2026 refresh selects `golang.org/x/net` 0.62.0 for
 GO-2026-6860 and GO-2026-6866, and gRPC 1.85.0 supersedes the old 1.84.0
 hold. The dependency update command's automatic outdated list contains direct
 dependencies; verify indirect dependencies such as `x/net` explicitly too.
-The dependency pin command supports existing indirect requirements and performs
-a standalone build after updating and tidying the locks.
+Use `codefly update deps --dependency golang.org/x/net@v0.62.0` to select an
+existing direct or indirect external requirement without moving unrelated
+versions. The repeatable flag validates every selection across the selected
+modules before mutation, then uses the same Go resolver, tidy and audit path as
+the automatic update. Modules without the selected requirement are not changed;
+unknown or duplicate selections and first-party selections are refused. Exact
+selections also retain a version required by a compatibility gate without
+silently undoing that hold during an unrelated security update.
 
 Companion publication compiles this checkout into the images. Merge the CLI
 fix before dispatching `companions.yaml` against Core's exact merged commit
diff --git a/go.mod b/go.mod
index 8a46249f..7e74a23d 100644
--- a/go.mod
+++ b/go.mod
@@ -54,8 +54,8 @@ require (
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/yaml.v3 v3.0.1
 	oras.land/oras-go/v2 v2.7.0
-	sigs.k8s.io/kustomize/api v0.21.3
-	sigs.k8s.io/kustomize/kyaml v0.21.3
+	sigs.k8s.io/kustomize/api v0.21.1
+	sigs.k8s.io/kustomize/kyaml v0.21.1
 )
 
 require (
@@ -103,6 +103,7 @@ require (
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/creativeprojects/go-selfupdate v1.7.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/dekobon/tree-sitter-groovy v0.3.0 // indirect
 	github.com/dlclark/regexp2/v2 v2.7.1 // indirect
@@ -126,10 +127,14 @@ require (
 	github.com/go-openapi/loads v0.25.3 // indirect
 	github.com/go-openapi/spec v1.0.1 // indirect
 	github.com/go-openapi/strfmt v0.27.3 // indirect
+	github.com/go-openapi/swag v0.29.2 // indirect
+	github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
 	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/fileutils v0.29.2 // indirect
 	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
 	github.com/go-openapi/swag/loading v0.29.2 // indirect
 	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/netutils v0.29.2 // indirect
 	github.com/go-openapi/swag/pools v0.29.2 // indirect
 	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
 	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
@@ -235,6 +240,6 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 280264b2..5a622a26 100644
--- a/go.sum
+++ b/go.sum
@@ -146,6 +146,8 @@ github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooY
 github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davidmz/go-pageant v1.0.2 h1:bPblRCh5jGU+Uptpz6LgMZGD5hJoOt7otgT454WvHn0=
 github.com/davidmz/go-pageant v1.0.2/go.mod h1:P2EDDnMqIwG5Rrp05dTRITj9z2zpGcD9efWSkTNKLIE=
 github.com/dekobon/tree-sitter-groovy v0.3.0 h1:bLi4b7WAQr6Q7nGw529JTHr+jmqvo4yK6nkmGbYQRFU=
@@ -215,8 +217,13 @@ github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV
 github.com/go-openapi/strfmt v0.27.3 h1:cyf4J5Wjpd6bFpAs44MF8PsbWF/mWXhn82Ck/hgQZgw=
 github.com/go-openapi/strfmt v0.27.3/go.mod h1:Bl+xadPLa3nhBiaCAxNND1vrQfzyEjF0vBrLx96n/4E=
 github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
+github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
+github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
+github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw=
 github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0=
 github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q=
+github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI=
+github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0=
 github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k=
 github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs=
 github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo=
@@ -225,6 +232,8 @@ github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJf
 github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI=
 github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog=
 github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8=
+github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8=
+github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE=
 github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c=
 github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc=
 github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk=
@@ -607,16 +616,16 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
-k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926 h1:Fe0G8t8FaMDn2lpat0IHu3X9lHrVyGzDxhhCwKXKp28=
-k8s.io/kube-openapi v0.0.0-20261001230523-97fa35140926/go.mod h1:3e2VxsK2svhjvkNik92kYU1a5kgau5tZeAuEWwoN4q0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
 oras.land/oras-go/v2 v2.7.0 h1:0bXRBBSqYgPSjZRrhJbT71Rb465c+rdlft2xdQPxLtQ=
 oras.land/oras-go/v2 v2.7.0/go.mod h1:imXEFiYkTZUVVYkfv/r5GVmWeiLkGtNQA8FU4F/sjKs=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/kustomize/api v0.21.3 h1:DXGrbifGrAd+7AQ75Kx/tVhr+RLMCZFfAYl61HOR3T0=
-sigs.k8s.io/kustomize/api v0.21.3/go.mod h1:JKlHjHXGh54cdoWVdKNqDscFzPb9z+sBk9upy9PBh6k=
-sigs.k8s.io/kustomize/kyaml v0.21.3 h1:4ygzLsc8B1ep9dFuEivrJ2lFIAglL19dhPrWp1ioceY=
-sigs.k8s.io/kustomize/kyaml v0.21.3/go.mod h1:HrAVNlYyEphOlRCcaSIQziGR+0ehwx6Xp1ucUrpC6hs=
+sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
+sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
+sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
+sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
diff --git a/pkg/dependencypins/pins.go b/pkg/dependencypins/pins.go
new file mode 100644
index 00000000..ca6ae083
--- /dev/null
+++ b/pkg/dependencypins/pins.go
@@ -0,0 +1,51 @@
+// Package dependencypins selects existing Go requirements before a pin mutates locks.
+package dependencypins
+
+import (
+	"fmt"
+	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/module"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Plan validates selections across every module before returning each module's pins.
+// Requirements may be direct or indirect; absent requirements are never introduced.
+func Plan(dirs, dependencies []string) (map[string][]string, error) {
+	pins := make(map[string][]string)
+	selected := make(map[string]string)
+	for _, dependency := range dependencies {
+		path, version, found := strings.Cut(dependency, "@")
+		if !found || version == "" || strings.ContainsAny(version, "@ \t\r\n") || module.CheckPath(path) != nil {
+			return nil, fmt.Errorf("dependency %q must be module@version", dependency)
+		}
+		if _, exists := selected[path]; exists {
+			return nil, fmt.Errorf("dependency %q is selected more than once", path)
+		}
+		selected[path] = dependency
+	}
+	matched := make(map[string]bool)
+	for _, dir := range dirs {
+		data, err := os.ReadFile(filepath.Join(dir, "go.mod"))
+		if err != nil {
+			return nil, err
+		}
+		file, err := modfile.Parse("go.mod", data, nil)
+		if err != nil {
+			return nil, err
+		}
+		for _, requirement := range file.Require {
+			if dependency, exists := selected[requirement.Mod.Path]; exists {
+				pins[dir] = append(pins[dir], dependency)
+				matched[requirement.Mod.Path] = true
+			}
+		}
+	}
+	for path := range selected {
+		if !matched[path] {
+			return nil, fmt.Errorf("dependency %q is not required by any selected module", path)
+		}
+	}
+	return pins, nil
+}

From 6c98b0f1dede69928077d4ebee774a49edff8206 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:53:42 -0400
Subject: [PATCH 4/8] test(update): exercise selective pinning through the
 command

---
 cmd/update/deps_selected_test.go | 15 ++++++++++-----
 pkg/dependencypins/pins.go       |  5 +++--
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/cmd/update/deps_selected_test.go b/cmd/update/deps_selected_test.go
index a0d76beb..ce177973 100644
--- a/cmd/update/deps_selected_test.go
+++ b/cmd/update/deps_selected_test.go
@@ -18,23 +18,27 @@ func TestSelectedDependencyUpdatesIndirectWithoutMovingOthers(t *testing.T) {
 	files := map[string]string{
 		"go.mod":               "module example.test/app\ngo 1.23\nrequire (\nexample.test/direct v1.0.0\nexample.test/indirect v1.0.0 // indirect\n)\nreplace example.test/direct => ./direct\nreplace example.test/indirect => ./indirect\n",
 		"app.go":               "package app\nimport \"example.test/direct\"\nvar Value = direct.Value\n",
-		"direct/go.mod":        "module example.test/direct\ngo 1.23\nrequire example.test/indirect v1.0.0\n",
+		"direct/go.mod":        "module example.test/direct\ngo 1.23\nrequire example.test/indirect v1.0.0\nreplace example.test/indirect => ../indirect\n",
 		"direct/direct.go":     "package direct\nimport \"example.test/indirect\"\nvar Value = indirect.Value\n",
 		"indirect/go.mod":      "module example.test/indirect\ngo 1.23\n",
 		"indirect/indirect.go": "package indirect\nconst Value = 42\n",
 	}
 	for name, data := range files {
 		path := filepath.Join(root, name)
-		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
-		require.NoError(t, os.WriteFile(path, []byte(data), 0644))
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+		require.NoError(t, os.WriteFile(path, []byte(data), 0o644))
 	}
 	// The existing module resolver is real; local replacements keep the fixture offline.
 	pins, err := dependencypins.Plan([]string{root, filepath.Join(root, "indirect")}, []string{"example.test/indirect@v1.0.1"})
 	require.NoError(t, err)
 	require.Empty(t, pins[filepath.Join(root, "indirect")], "do not inject a requirement into a module that never used it")
+	oldDir, oldAudit, oldSelections := depsDir, depsAudit, depsSelections
+	t.Cleanup(func() { depsDir, depsAudit, depsSelections = oldDir, oldAudit, oldSelections })
+	depsDir, depsAudit = root, false
+	depsSelections = []string{"example.test/indirect@v1.0.1"}
 	ctx, done := common.NewContext()
 	defer done()
-	require.NoError(t, updateModule(ctx, root, pins[root]...))
+	require.NoError(t, DepsCmd.RunE(DepsCmd, nil))
 	data, err := os.ReadFile(filepath.Join(root, "go.mod"))
 	require.NoError(t, err)
 	parsed, err := modfile.Parse("go.mod", data, nil)
@@ -48,7 +52,8 @@ func TestSelectedDependencyUpdatesIndirectWithoutMovingOthers(t *testing.T) {
 	require.NoError(t, runGo(ctx, root, "build", "./..."))
 	require.NoError(t, runGo(ctx, root, "mod", "tidy", "-diff"))
 	before := string(data)
-	_, err = dependencypins.Plan([]string{root}, []string{"example.test/indirect@v1.0.2", "example.test/missing@v1.0.1"})
+	depsSelections = []string{"example.test/indirect@v1.0.2", "example.test/missing@v1.0.1"}
+	err = DepsCmd.RunE(DepsCmd, nil)
 	require.Error(t, err)
 	data, err = os.ReadFile(filepath.Join(root, "go.mod"))
 	require.NoError(t, err)
diff --git a/pkg/dependencypins/pins.go b/pkg/dependencypins/pins.go
index ca6ae083..3c3f017a 100644
--- a/pkg/dependencypins/pins.go
+++ b/pkg/dependencypins/pins.go
@@ -3,11 +3,12 @@ package dependencypins
 
 import (
 	"fmt"
-	"golang.org/x/mod/modfile"
-	"golang.org/x/mod/module"
 	"os"
 	"path/filepath"
 	"strings"
+
+	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/module"
 )
 
 // Plan validates selections across every module before returning each module's pins.

From 7947e7d7330b033374834b93d09a1bca6edfb7f1 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:40:52 -0400
Subject: [PATCH 5/8] fix(generate): adopt Core without Rust companion tooling

---
 docs/commands.md |  6 +++++-
 go.mod           | 14 +++++++-------
 go.sum           | 28 ++++++++++++++--------------
 3 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/docs/commands.md b/docs/commands.md
index 1bde38e3..1e09f317 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -3377,7 +3377,11 @@ codefly agent ci --skip-conformance               # Source/build/drift debugging
 
 ### `codefly generate`
 
-Generate client code from service APIs.
+Generate client code from service APIs. Codefly owns the proto generation path
+and invokes the pinned proto companion for its compilers and plugins. Core
+0.19.13 selects proto companion 0.0.21, which generates Go, Python, and
+TypeScript without building or shipping Rust tooling. Rust client generation
+is not supported.
 
 ```bash
 codefly generate client --from billing/api/grpc --language go --output libraries/billing-api-client  # A codefly library from a live local service
diff --git a/go.mod b/go.mod
index 7e74a23d..ddf99552 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93
 	github.com/codefly-dev/authority/libraries/fixture-composition/go v0.0.0-20261027171336-5178f01696e3
 	github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855
-	github.com/codefly-dev/core v0.19.11-0.20261028153419-de19eba80550
+	github.com/codefly-dev/core v0.19.13
 	github.com/codefly-dev/golor v0.1.3
 	github.com/codefly-dev/llm v0.1.7
 	github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458
@@ -120,13 +120,13 @@ require (
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/analysis v1.0.0 // indirect
+	github.com/go-openapi/analysis v1.0.1 // indirect
 	github.com/go-openapi/errors v0.22.9 // indirect
-	github.com/go-openapi/jsonpointer v1.0.1 // indirect
-	github.com/go-openapi/jsonreference v1.0.2 // indirect
+	github.com/go-openapi/jsonpointer v1.0.2 // indirect
+	github.com/go-openapi/jsonreference v1.0.3 // indirect
 	github.com/go-openapi/loads v0.25.3 // indirect
 	github.com/go-openapi/spec v1.0.1 // indirect
-	github.com/go-openapi/strfmt v0.27.3 // indirect
+	github.com/go-openapi/strfmt v0.27.4 // indirect
 	github.com/go-openapi/swag v0.29.2 // indirect
 	github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
 	github.com/go-openapi/swag/conv v0.29.2 // indirect
@@ -145,7 +145,7 @@ require (
 	github.com/google/go-github/v86 v86.0.0 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
@@ -237,7 +237,7 @@ require (
 	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.16.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
diff --git a/go.sum b/go.sum
index 5a622a26..a675237c 100644
--- a/go.sum
+++ b/go.sum
@@ -117,8 +117,8 @@ github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad722
 github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855/go.mod h1:rfn41uiORQ36RrOeFEjXHPLC9NUi0j14AoYJtcovsn4=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 h1:4EygH7/J0E6aM7hUPdbQGfit1rsLUNCtWJ8kMh2b9PE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
-github.com/codefly-dev/core v0.19.11-0.20261028153419-de19eba80550 h1:IBur1pFM7LelM+9ecMgl2/Mxgd+04rgesSVFm3R1k0E=
-github.com/codefly-dev/core v0.19.11-0.20261028153419-de19eba80550/go.mod h1:aTJY3Rw0OSVkbWRThgDzSkqieoF9mW4MiPRXM8Vzxww=
+github.com/codefly-dev/core v0.19.13 h1:PdBd4JZhNSr/IRlm2Xic6R3vsZyPRhhCC2NDmquXh3E=
+github.com/codefly-dev/core v0.19.13/go.mod h1:Q7PHKw8SFb1wNxlTy2EgG11cI9Zmq55TYY1fdsQUhpE=
 github.com/codefly-dev/golor v0.1.3 h1:xmo+ceyJFRYZdvpWE2fNd0jeaadp/Ibm1BnganiGKOc=
 github.com/codefly-dev/golor v0.1.3/go.mod h1:sl/u/K1l7J0Pr3xyVZp8fOJYQItKKst1No9JqgzLLoY=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
@@ -202,20 +202,20 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-openapi/analysis v1.0.0 h1:sNvbAGCJqUTqIAodr9IVqJMmuZas3YS9ms1dGK9yiJ4=
-github.com/go-openapi/analysis v1.0.0/go.mod h1:NhYjJ57fnE+bcE7UwrJyMkhWA3Dfz7TdiBfTVAnos4Y=
+github.com/go-openapi/analysis v1.0.1 h1:JTEyujgl4GyFj8pbMUY2yZx5ak1Ozt/DaqzQjQBnBWM=
+github.com/go-openapi/analysis v1.0.1/go.mod h1:f3gYbXmnXSQIZB02DqE4f8JX969PdOEnaY7gDBLeJjI=
 github.com/go-openapi/errors v0.22.9 h1:HI9+SyVYiRzyeBQGv0CbWbQa+u2S0nny7G7AhY+UMiM=
 github.com/go-openapi/errors v0.22.9/go.mod h1:R73q66sXP2smzAGgFOI4nqtusRK2xN5pYCjsij+KX58=
-github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg=
-github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY=
-github.com/go-openapi/jsonreference v1.0.2 h1:oS4et8FOf3p3UQxEo4Xt0esijmBUM+F259Xl72OSZsc=
-github.com/go-openapi/jsonreference v1.0.2/go.mod h1:TbUNSOo+fcorZjFaNoiSDSoaNnnZtqJtLGR1PuvE/Cs=
+github.com/go-openapi/jsonpointer v1.0.2 h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=
+github.com/go-openapi/jsonpointer v1.0.2/go.mod h1:N0rI4MbNKD7xAFTiHtB+5Nhrg2j/wwYg7m7Fmb4/jk8=
+github.com/go-openapi/jsonreference v1.0.3 h1:5rDbq+JsjCv6/nUDDJt83nLZoADI4w03uvHXer+4aYQ=
+github.com/go-openapi/jsonreference v1.0.3/go.mod h1:OJSlMXHysgH272D9z2tiy2MGe5A9vQLHaCPb6KbYdE4=
 github.com/go-openapi/loads v0.25.3 h1:V+jKy/thXWdLJUuYC8sZX2dICyAa8M3DokF70jj34P0=
 github.com/go-openapi/loads v0.25.3/go.mod h1:LgLyCSOLBL2Qnj0Ps1oo2YH8jZoEKsMeVZCc+ALIxFo=
 github.com/go-openapi/spec v1.0.1 h1:lj2vdGpNDcVgwRc6qXdw6qt/KQpCtSa9tnUH6vpDPDk=
 github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV3H1fYw8=
-github.com/go-openapi/strfmt v0.27.3 h1:cyf4J5Wjpd6bFpAs44MF8PsbWF/mWXhn82Ck/hgQZgw=
-github.com/go-openapi/strfmt v0.27.3/go.mod h1:Bl+xadPLa3nhBiaCAxNND1vrQfzyEjF0vBrLx96n/4E=
+github.com/go-openapi/strfmt v0.27.4 h1:E1xsvHb8R9vsuYru4TP2PVVTv9AIgSFAUACUZrFQfCI=
+github.com/go-openapi/strfmt v0.27.4/go.mod h1:SCOff81PPhU26acBiW96jHaFycEbT2nkQRvojM+V2z0=
 github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
 github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
 github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
@@ -271,8 +271,8 @@ github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/graph-gophers/graphql-go v1.9.0 h1:yu0ucKHLc5qGpRwLYKIWtr9bOoxovkWasuBrPQwlHls=
 github.com/graph-gophers/graphql-go v1.9.0/go.mod h1:23olKZ7duEvHlF/2ELEoSZaY1aNPfShjP782SOoNTyM=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 h1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0/go.mod h1:+ZQ6iUL8+ATyxGDQNuRKpNwJFdGDUi0e7E1QL9MvI7U=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0 h1:5T5Ns3kMpWr+z3s5ZA0e7ljVyWNVNxK76sHPAxi5D1k=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0/go.mod h1:oWNYw09cH8wl8fFgC5hKlBLxR4XfKy2KQpP8MJjeCcc=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -594,8 +594,8 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e h1:e789sLZjeTdc02ZCQGTSzHOu0fR73+dwPQVKUp67Z88=
 google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e/go.mod h1:vHV3wJM9WZyfV7GyB+OQGq5dWVrFwCDxapPK4WlRD88=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e h1:w3fy/G8OrJHYexn+u5y7hFyc8YRRIr7DCevtIOwAcGY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
 google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
 google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

From 75b4810b2851725f75c75767cab71628819fe919 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:45:16 -0400
Subject: [PATCH 6/8] fix(conformance): align support matrix with Core 0.19.13

---
 docs/supported-matrix.md    | 3 ++-
 pkg/conformance/matrix.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/supported-matrix.md b/docs/supported-matrix.md
index c22e6b68..39348c4b 100644
--- a/docs/supported-matrix.md
+++ b/docs/supported-matrix.md
@@ -27,7 +27,8 @@ When `go.mod` moves to a new core release line, update the `core` field in
 `go test ./pkg/conformance/...` before the full coverage and race gates.
 `TestMatrixCoreMatchesGoMod` refuses a stale declared version.
 
-The current pin targets Core's published `v0.19.10` release line, including the
+The current pin targets Core's published `v0.19.13` release line, including
+proto companion `0.0.21` without Rust generation tooling and the
 Linux process-inspection correction: a missing executable link while process
 state remains is an inspection error, not successful proof of absence. The exact source
 revision is declared in `go.mod`; the CLI consumes Core's container parent
diff --git a/pkg/conformance/matrix.json b/pkg/conformance/matrix.json
index b3e44868..1169c949 100644
--- a/pkg/conformance/matrix.json
+++ b/pkg/conformance/matrix.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "cli": "source",
-  "core": "v0.19.11",
+  "core": "v0.19.13",
   "rows": [
     {
       "id": "linux-amd64-source",

From 8f0ebb0be874c5c71cc190d79569e9373636acff Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 17:57:57 -0400
Subject: [PATCH 7/8] fix(proto): consume native-built companion 0.0.22

---
 docs/commands.md            | 5 +++--
 docs/supported-matrix.md    | 4 ++--
 go.mod                      | 2 +-
 go.sum                      | 4 ++--
 pkg/conformance/matrix.json | 2 +-
 5 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/docs/commands.md b/docs/commands.md
index 1e09f317..fefdff7a 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -3379,9 +3379,10 @@ codefly agent ci --skip-conformance               # Source/build/drift debugging
 
 Generate client code from service APIs. Codefly owns the proto generation path
 and invokes the pinned proto companion for its compilers and plugins. Core
-0.19.13 selects proto companion 0.0.21, which generates Go, Python, and
+0.19.14 selects proto companion 0.0.22, which generates Go, Python, and
 TypeScript without building or shipping Rust tooling. Rust client generation
-is not supported.
+is not supported. Companion publication cross-compiles Go tools natively for
+each architecture instead of compiling under ARM emulation.
 
 ```bash
 codefly generate client --from billing/api/grpc --language go --output libraries/billing-api-client  # A codefly library from a live local service
diff --git a/docs/supported-matrix.md b/docs/supported-matrix.md
index 39348c4b..5c1a16db 100644
--- a/docs/supported-matrix.md
+++ b/docs/supported-matrix.md
@@ -27,8 +27,8 @@ When `go.mod` moves to a new core release line, update the `core` field in
 `go test ./pkg/conformance/...` before the full coverage and race gates.
 `TestMatrixCoreMatchesGoMod` refuses a stale declared version.
 
-The current pin targets Core's published `v0.19.13` release line, including
-proto companion `0.0.21` without Rust generation tooling and the
+The current pin targets Core's published `v0.19.14` release line, including
+proto companion `0.0.22` without Rust generation tooling and the
 Linux process-inspection correction: a missing executable link while process
 state remains is an inspection error, not successful proof of absence. The exact source
 revision is declared in `go.mod`; the CLI consumes Core's container parent
diff --git a/go.mod b/go.mod
index ddf99552..7563c13f 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93
 	github.com/codefly-dev/authority/libraries/fixture-composition/go v0.0.0-20261027171336-5178f01696e3
 	github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855
-	github.com/codefly-dev/core v0.19.13
+	github.com/codefly-dev/core v0.19.14
 	github.com/codefly-dev/golor v0.1.3
 	github.com/codefly-dev/llm v0.1.7
 	github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458
diff --git a/go.sum b/go.sum
index a675237c..75afb0ee 100644
--- a/go.sum
+++ b/go.sum
@@ -117,8 +117,8 @@ github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad722
 github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855/go.mod h1:rfn41uiORQ36RrOeFEjXHPLC9NUi0j14AoYJtcovsn4=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 h1:4EygH7/J0E6aM7hUPdbQGfit1rsLUNCtWJ8kMh2b9PE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
-github.com/codefly-dev/core v0.19.13 h1:PdBd4JZhNSr/IRlm2Xic6R3vsZyPRhhCC2NDmquXh3E=
-github.com/codefly-dev/core v0.19.13/go.mod h1:Q7PHKw8SFb1wNxlTy2EgG11cI9Zmq55TYY1fdsQUhpE=
+github.com/codefly-dev/core v0.19.14 h1:O7+C2aik5zHKp3BNjVZkAcfl2fQF7Tf2G4IY+t+b2nI=
+github.com/codefly-dev/core v0.19.14/go.mod h1:Q7PHKw8SFb1wNxlTy2EgG11cI9Zmq55TYY1fdsQUhpE=
 github.com/codefly-dev/golor v0.1.3 h1:xmo+ceyJFRYZdvpWE2fNd0jeaadp/Ibm1BnganiGKOc=
 github.com/codefly-dev/golor v0.1.3/go.mod h1:sl/u/K1l7J0Pr3xyVZp8fOJYQItKKst1No9JqgzLLoY=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
diff --git a/pkg/conformance/matrix.json b/pkg/conformance/matrix.json
index 1169c949..03bd0194 100644
--- a/pkg/conformance/matrix.json
+++ b/pkg/conformance/matrix.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "cli": "source",
-  "core": "v0.19.13",
+  "core": "v0.19.14",
   "rows": [
     {
       "id": "linux-amd64-source",

From cf82a61c9d9e6be76c73735de437c16ef7be1f29 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Wed, 28 Oct 2026 18:46:14 -0400
Subject: [PATCH 8/8] fix(proto): consume companion with writable non-root
 caches

---
 docs/commands.md            | 5 +++--
 docs/supported-matrix.md    | 4 ++--
 go.mod                      | 2 +-
 go.sum                      | 4 ++--
 pkg/conformance/matrix.json | 2 +-
 5 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/docs/commands.md b/docs/commands.md
index 2de0c6bd..d59182f8 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -3507,10 +3507,11 @@ codefly agent ci --skip-conformance               # Source/build/drift debugging
 
 Generate client code from service APIs. Codefly owns the proto generation path
 and invokes the pinned proto companion for its compilers and plugins. Core
-0.19.14 selects proto companion 0.0.22, which generates Go, Python, and
+0.19.15 selects proto companion 0.0.23, which generates Go, Python, and
 TypeScript without building or shipping Rust tooling. Rust client generation
 is not supported. Companion publication cross-compiles Go tools natively for
-each architecture instead of compiling under ARM emulation.
+each architecture instead of compiling under ARM emulation. Its runtime caches
+remain writable when Linux runs generation as the host user.
 
 ```bash
 codefly generate client --from billing/api/grpc --language go --output libraries/billing-api-client  # A codefly library from a live local service
diff --git a/docs/supported-matrix.md b/docs/supported-matrix.md
index 5c1a16db..73eb029b 100644
--- a/docs/supported-matrix.md
+++ b/docs/supported-matrix.md
@@ -27,8 +27,8 @@ When `go.mod` moves to a new core release line, update the `core` field in
 `go test ./pkg/conformance/...` before the full coverage and race gates.
 `TestMatrixCoreMatchesGoMod` refuses a stale declared version.
 
-The current pin targets Core's published `v0.19.14` release line, including
-proto companion `0.0.22` without Rust generation tooling and the
+The current pin targets Core's published `v0.19.15` release line, including
+proto companion `0.0.23` without Rust generation tooling and the
 Linux process-inspection correction: a missing executable link while process
 state remains is an inspection error, not successful proof of absence. The exact source
 revision is declared in `go.mod`; the CLI consumes Core's container parent
diff --git a/go.mod b/go.mod
index 7563c13f..6cfe8916 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93
 	github.com/codefly-dev/authority/libraries/fixture-composition/go v0.0.0-20261027171336-5178f01696e3
 	github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855
-	github.com/codefly-dev/core v0.19.14
+	github.com/codefly-dev/core v0.19.15
 	github.com/codefly-dev/golor v0.1.3
 	github.com/codefly-dev/llm v0.1.7
 	github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458
diff --git a/go.sum b/go.sum
index 75afb0ee..719f1773 100644
--- a/go.sum
+++ b/go.sum
@@ -117,8 +117,8 @@ github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad722
 github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026175541-3afad7224855/go.mod h1:rfn41uiORQ36RrOeFEjXHPLC9NUi0j14AoYJtcovsn4=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 h1:4EygH7/J0E6aM7hUPdbQGfit1rsLUNCtWJ8kMh2b9PE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
-github.com/codefly-dev/core v0.19.14 h1:O7+C2aik5zHKp3BNjVZkAcfl2fQF7Tf2G4IY+t+b2nI=
-github.com/codefly-dev/core v0.19.14/go.mod h1:Q7PHKw8SFb1wNxlTy2EgG11cI9Zmq55TYY1fdsQUhpE=
+github.com/codefly-dev/core v0.19.15 h1:GzjDvPEuoyxsbQ82L4/Qgpog9z8vMSHeBScOTAvDBiQ=
+github.com/codefly-dev/core v0.19.15/go.mod h1:Q7PHKw8SFb1wNxlTy2EgG11cI9Zmq55TYY1fdsQUhpE=
 github.com/codefly-dev/golor v0.1.3 h1:xmo+ceyJFRYZdvpWE2fNd0jeaadp/Ibm1BnganiGKOc=
 github.com/codefly-dev/golor v0.1.3/go.mod h1:sl/u/K1l7J0Pr3xyVZp8fOJYQItKKst1No9JqgzLLoY=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
diff --git a/pkg/conformance/matrix.json b/pkg/conformance/matrix.json
index 03bd0194..b53376d3 100644
--- a/pkg/conformance/matrix.json
+++ b/pkg/conformance/matrix.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "cli": "source",
-  "core": "v0.19.14",
+  "core": "v0.19.15",
   "rows": [
     {
       "id": "linux-amd64-source",