diff --git a/companions/codefly/info.codefly.yaml b/companions/codefly/info.codefly.yaml index 888ec6e45..5c0a9fa32 100644 --- a/companions/codefly/info.codefly.yaml +++ b/companions/codefly/info.codefly.yaml @@ -1 +1 @@ -version: 0.0.5 +version: 0.0.6 diff --git a/companions/execution/info.codefly.yaml b/companions/execution/info.codefly.yaml index b1465aaf8..af0337af5 100644 --- a/companions/execution/info.codefly.yaml +++ b/companions/execution/info.codefly.yaml @@ -1 +1 @@ -version: 0.0.1 +version: 0.0.2 diff --git a/companions/go/Dockerfile b/companions/go/Dockerfile index 1d1a9a963..bd40d6b59 100644 --- a/companions/go/Dockerfile +++ b/companions/go/Dockerfile @@ -2,7 +2,7 @@ # companion image it builds on, and the builder resolves that to a registry. # The default keeps a plain `docker build` working and is pinned to the version # in companions/codefly/info.codefly.yaml. -ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.5 +ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.6 FROM ${CODEFLY_BASE_IMAGE} AS codeflybase FROM golang:1.27-alpine diff --git a/companions/go/info.codefly.yaml b/companions/go/info.codefly.yaml index f9a0e57b9..d6e816cf6 100644 --- a/companions/go/info.codefly.yaml +++ b/companions/go/info.codefly.yaml @@ -1 +1 @@ -version: 0.0.12 +version: 0.0.13 diff --git a/companions/node/Dockerfile b/companions/node/Dockerfile index 0c8868c1b..3364f8cfc 100644 --- a/companions/node/Dockerfile +++ b/companions/node/Dockerfile @@ -10,7 +10,7 @@ # companion image it builds on, and the builder resolves that to a registry. # The default keeps a plain `docker build` working and is pinned to the version # in companions/codefly/info.codefly.yaml. -ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.5 +ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.6 FROM ${CODEFLY_BASE_IMAGE} AS codeflybase FROM node:26.3.0-alpine3.22 diff --git a/companions/node/info.codefly.yaml b/companions/node/info.codefly.yaml index 282b91ba4..8ffeae728 100644 --- a/companions/node/info.codefly.yaml +++ b/companions/node/info.codefly.yaml @@ -1 +1 @@ -version: 0.0.14 +version: 0.0.15 diff --git a/companions/proto/Dockerfile b/companions/proto/Dockerfile index f4f4b6277..3ab37c516 100644 --- a/companions/proto/Dockerfile +++ b/companions/proto/Dockerfile @@ -16,7 +16,7 @@ # companion image it builds on, and the builder resolves that to a registry. # The default keeps a plain `docker build` working and is pinned to the version # in companions/codefly/info.codefly.yaml. -ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.5 +ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.6 FROM ${CODEFLY_BASE_IMAGE} AS codeflybase # --- Builder stage: compile every Go plugin from source -------------- diff --git a/companions/proto/info.codefly.yaml b/companions/proto/info.codefly.yaml index 1be3e0519..89acbc43c 100644 --- a/companions/proto/info.codefly.yaml +++ b/companions/proto/info.codefly.yaml @@ -1 +1 @@ -version: 0.0.19 +version: 0.0.20 diff --git a/companions/python/Dockerfile b/companions/python/Dockerfile index 2e3593ee7..a19e82afc 100644 --- a/companions/python/Dockerfile +++ b/companions/python/Dockerfile @@ -13,7 +13,7 @@ # companion image it builds on, and the builder resolves that to a registry. # The default keeps a plain `docker build` working and is pinned to the version # in companions/codefly/info.codefly.yaml. -ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.5 +ARG CODEFLY_BASE_IMAGE=ghcr.io/codefly-dev/codefly:0.0.6 FROM ${CODEFLY_BASE_IMAGE} AS codeflybase FROM python:3.14.10-alpine3.24@sha256:cfe4b5079e5852da965ae14f74a6e2b137ece05b918d27c575fb70de3c85db2b diff --git a/companions/python/info.codefly.yaml b/companions/python/info.codefly.yaml index 5c0a9fa32..87fb744f1 100644 --- a/companions/python/info.codefly.yaml +++ b/companions/python/info.codefly.yaml @@ -1 +1 @@ -version: 0.0.6 +version: 0.0.7 diff --git a/docs/runbooks/publish-companions.md b/docs/runbooks/publish-companions.md index 0387e1c75..72f09af8b 100644 --- a/docs/runbooks/publish-companions.md +++ b/docs/runbooks/publish-companions.md @@ -143,3 +143,18 @@ Consumers must adopt the new Core/agent selections and rebuild their service images; a source merge or a successful tag-existence check does not refresh an already published service image. NYL acceptance requires its re-scan of those resulting images, including vulnerability and secret policies. + +## Follow-up dependency refresh + +The scan of the published codefly 0.0.5 binary found GO-2026-6860 and +GO-2026-6866 in `golang.org/x/net` 0.61.0; both are fixed in 0.62.0. +Core 0.19.12 raises that dependency and selects new companion versions: +codefly 0.0.6, Python 0.0.7, Go 0.0.13, Node 0.0.15, proto 0.0.20 and +execution 0.0.2. Every companion carries the CLI, so every image needs a +new version even where its Dockerfile otherwise stays the same. + +Publish this set only after the CLI dependency refresh is merged: the +publisher compiles the CLI checkout, and a Core dependency bump alone does +not change that executable. Verify the published executable's module +versions and scan it again before recording the fixes as delivered. Keep +previous tags immutable, and adopt the new Python index digest in FastAPI. diff --git a/go.mod b/go.mod index a54a269ff..0231cda58 100644 --- a/go.mod +++ b/go.mod @@ -34,9 +34,8 @@ require ( github.com/google/go-cmp v0.7.0 github.com/google/go-github/v89 v89.0.0 github.com/google/uuid v1.6.0 - github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 + github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0 github.com/hashicorp/go-multierror v1.1.1 - github.com/mitchellh/mapstructure v1.5.0 github.com/moby/buildkit v0.34.1 github.com/moby/patternmatcher v0.6.1 github.com/muesli/termenv v0.16.0 @@ -69,13 +68,13 @@ require ( go.opentelemetry.io/otel/trace v1.47.0 go.uber.org/goleak v1.3.0 golang.org/x/mod v0.42.0 - golang.org/x/net v0.61.0 + golang.org/x/net v0.62.0 golang.org/x/sys v0.49.0 golang.org/x/term v0.47.0 golang.org/x/text v0.43.0 - google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 - google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 - google.golang.org/grpc v1.84.0 + google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e + google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e + google.golang.org/grpc v1.85.0 google.golang.org/protobuf v1.36.12 gopkg.in/yaml.v3 v3.0.1 mvdan.cc/sh/v3 v3.14.1 @@ -123,11 +122,11 @@ require ( github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-ole/go-ole v1.3.0 // indirect - github.com/go-openapi/analysis v1.0.0 // indirect + github.com/go-openapi/analysis v1.0.1 // indirect github.com/go-openapi/errors v0.22.9 // indirect - github.com/go-openapi/jsonpointer v1.0.1 // indirect - github.com/go-openapi/jsonreference v1.0.2 // indirect - github.com/go-openapi/strfmt v0.27.3 // indirect + github.com/go-openapi/jsonpointer v1.0.2 // indirect + github.com/go-openapi/jsonreference v1.0.3 // indirect + github.com/go-openapi/strfmt v0.27.4 // indirect github.com/go-openapi/swag v0.29.2 // indirect github.com/go-openapi/swag/cmdutils v0.29.2 // indirect github.com/go-openapi/swag/conv v0.29.2 // indirect diff --git a/go.sum b/go.sum index 3d4d0084f..1225fc57e 100644 --- a/go.sum +++ b/go.sum @@ -152,20 +152,20 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE= github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78= -github.com/go-openapi/analysis v1.0.0 h1:sNvbAGCJqUTqIAodr9IVqJMmuZas3YS9ms1dGK9yiJ4= -github.com/go-openapi/analysis v1.0.0/go.mod h1:NhYjJ57fnE+bcE7UwrJyMkhWA3Dfz7TdiBfTVAnos4Y= +github.com/go-openapi/analysis v1.0.1 h1:JTEyujgl4GyFj8pbMUY2yZx5ak1Ozt/DaqzQjQBnBWM= +github.com/go-openapi/analysis v1.0.1/go.mod h1:f3gYbXmnXSQIZB02DqE4f8JX969PdOEnaY7gDBLeJjI= github.com/go-openapi/errors v0.22.9 h1:HI9+SyVYiRzyeBQGv0CbWbQa+u2S0nny7G7AhY+UMiM= github.com/go-openapi/errors v0.22.9/go.mod h1:R73q66sXP2smzAGgFOI4nqtusRK2xN5pYCjsij+KX58= -github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg= -github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY= -github.com/go-openapi/jsonreference v1.0.2 h1:oS4et8FOf3p3UQxEo4Xt0esijmBUM+F259Xl72OSZsc= -github.com/go-openapi/jsonreference v1.0.2/go.mod h1:TbUNSOo+fcorZjFaNoiSDSoaNnnZtqJtLGR1PuvE/Cs= +github.com/go-openapi/jsonpointer v1.0.2 h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8= +github.com/go-openapi/jsonpointer v1.0.2/go.mod h1:N0rI4MbNKD7xAFTiHtB+5Nhrg2j/wwYg7m7Fmb4/jk8= +github.com/go-openapi/jsonreference v1.0.3 h1:5rDbq+JsjCv6/nUDDJt83nLZoADI4w03uvHXer+4aYQ= +github.com/go-openapi/jsonreference v1.0.3/go.mod h1:OJSlMXHysgH272D9z2tiy2MGe5A9vQLHaCPb6KbYdE4= github.com/go-openapi/loads v0.25.3 h1:V+jKy/thXWdLJUuYC8sZX2dICyAa8M3DokF70jj34P0= github.com/go-openapi/loads v0.25.3/go.mod h1:LgLyCSOLBL2Qnj0Ps1oo2YH8jZoEKsMeVZCc+ALIxFo= github.com/go-openapi/spec v1.0.1 h1:lj2vdGpNDcVgwRc6qXdw6qt/KQpCtSa9tnUH6vpDPDk= github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV3H1fYw8= -github.com/go-openapi/strfmt v0.27.3 h1:cyf4J5Wjpd6bFpAs44MF8PsbWF/mWXhn82Ck/hgQZgw= -github.com/go-openapi/strfmt v0.27.3/go.mod h1:Bl+xadPLa3nhBiaCAxNND1vrQfzyEjF0vBrLx96n/4E= +github.com/go-openapi/strfmt v0.27.4 h1:E1xsvHb8R9vsuYru4TP2PVVTv9AIgSFAUACUZrFQfCI= +github.com/go-openapi/strfmt v0.27.4/go.mod h1:SCOff81PPhU26acBiW96jHaFycEbT2nkQRvojM+V2z0= github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4= github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo= github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro= @@ -223,8 +223,8 @@ github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8= github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0= github.com/graph-gophers/graphql-go v1.9.0 h1:yu0ucKHLc5qGpRwLYKIWtr9bOoxovkWasuBrPQwlHls= github.com/graph-gophers/graphql-go v1.9.0/go.mod h1:23olKZ7duEvHlF/2ELEoSZaY1aNPfShjP782SOoNTyM= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 h1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0/go.mod h1:+ZQ6iUL8+ATyxGDQNuRKpNwJFdGDUi0e7E1QL9MvI7U= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0 h1:5T5Ns3kMpWr+z3s5ZA0e7ljVyWNVNxK76sHPAxi5D1k= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.33.0/go.mod h1:oWNYw09cH8wl8fFgC5hKlBLxR4XfKy2KQpP8MJjeCcc= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -268,8 +268,6 @@ github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhV github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk= github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA= -github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= -github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= github.com/moby/buildkit v0.34.1 h1:jVdxsXX0UpU0q1Et+9lFezPmh9sGE6vF0TrKZaGlfy4= github.com/moby/buildkit v0.34.1/go.mod h1:e+Za70y2a3nL1U2Y0P8TvhPyKp2Ok2NS+Q4siSArDiM= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= @@ -450,8 +448,8 @@ golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= -golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= @@ -483,12 +481,12 @@ golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 h1:DS/w3N8rsfrwxwgGSj6WhMsPo7aNQGmDx74J81zd0NQ= -google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941/go.mod h1:AuGAdi9KnXss7xbLxIKhCvk+Ro/SxpET/iS45DNYN+M= -google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 h1:0SXBqli5dnuCKMjI/X3FM226zEaEa0GUcSCJtN1vL2o= -google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= -google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0= -google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0= +google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e h1:e789sLZjeTdc02ZCQGTSzHOu0fR73+dwPQVKUp67Z88= +google.golang.org/genproto/googleapis/api v0.0.0-20261026165753-2ffab32bce7e/go.mod h1:vHV3wJM9WZyfV7GyB+OQGq5dWVrFwCDxapPK4WlRD88= +google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e h1:w3fy/G8OrJHYexn+u5y7hFyc8YRRIr7DCevtIOwAcGY= +google.golang.org/genproto/googleapis/rpc v0.0.0-20261026165753-2ffab32bce7e/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= +google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw= +google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/version/info.codefly.yaml b/version/info.codefly.yaml index 319d44d91..9469d9d18 100644 --- a/version/info.codefly.yaml +++ b/version/info.codefly.yaml @@ -1 +1 @@ -version: 0.19.11 +version: 0.19.12