Repository navigation
build: bump the pkgs locked_commit for the brotli and curl fixes - #2670
Conversation
Moves the pkgs locked_commit from bd1feab5 (2026-10-26) to fe10f54c (pkgs main, 2026-10-27). The guest rootfs this pin materializes picks up brotli-libs 1.2.1-r0 (CVE-2026-111497, a critical decoder buffer overflow that a malicious git server reaches through libcurl) and libcurl 8.23.0-r0 with Alpine's 8.23.0 curl CVE fixes (pkgs#1109). The rest of the range is package version bumps: grafana, patch, wrangler, stlink, redis, nats-server, lerna, hunk and cloudflared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016CYvTy9Jxczrnwgma36qEu
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update locked commit .minimal/minimal.toml |
The configured locked_commit value changes to fe10f54c021665a5432e64f75988a0a3f926e791. |
Priority:
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Other
Possibly related issues
gominimal/inboxissue 1167 describes stale guest-package pins; this change advances the configured pin.gominimal/inboxissue 1165 describes the package pin as a path for guest security fixes; this change updates that pin.
Possibly related PRs
- gominimal/minimal#2637 updated the same pin to the previous commit; this change advances it again.
Suggested reviewers: bryan-minimal, norrietaylor
Merge Risk: 
d9c94
-
No actionable merge-blocking risk was identified in this pin update.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the primary change: bumping the locked pkgs commit for Brotli and curl fixes. It uses a concise Conventional Commit format with an imperative verb. Description check The description clearly explains the locked commit update, security fixes, affected package versions, unrelated package updates, and release follow-up. It omits the template's Testing and Checklist se… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description clearly explains the locked commit update, security fixes, affected package versions, unrelated package updates, and release follow-up. It omits the template's Testing and Checklist sections, but the core change and intent are complete.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the pin with care,
A newer commit now waits there.
The config points along its way,
While carrots crunch beside the tray.
Soft paws hop to greet the day.
Comment @coderabbitai help to get the list of available commands.
|
Approved: no findings at Nothing to do. Clobber: none. |
…d curl fixes (#2671) Moves the pkgs locked_commit from bd1feab5 (2026-10-26) to fe10f54c (pkgs main, 2026-10-27), the same pin as #2670 on main. The guest rootfs this pin materializes picks up brotli-libs 1.2.1-r0 (CVE-2026-111497, a critical decoder buffer overflow that a malicious git server reaches through libcurl) and libcurl 8.23.0-r0 with Alpine's 8.23.0 curl CVE fixes (pkgs#1109). The rest of the range is package version bumps: grafana, patch, wrangler, stlink, redis, nats-server, lerna, hunk and cloudflared. (cherry picked from commit d9c9403) Claude-Session: https://claude.ai/code/session_016CYvTy9Jxczrnwgma36qEu Co-authored-by: Karl Godard <karl@minimal.dev> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Summary
Moves the pkgs
locked_commitfrombd1feab5(2026-10-26) tofe10f54c(pkgsmain, 2026-10-27). This is a fast-forward on pkgsmain.The change that matters is in the guest rootfs (gominimal/pkgs#1109):
The rest of the range is package version bumps that this repo's
minimal.tomldoes not name: grafana, patch, wrangler, stlink, redis, nats-server, lerna, hunk and cloudflared.Follow-up
Once this merges, cherry-pick it onto
release/0.7.0for the 0.7.2 release, as #2638 did for #2637.🤖 Generated with Claude Code
https://claude.ai/code/session_016CYvTy9Jxczrnwgma36qEu
Summary by CodeRabbit