Repository navigation
build: bump the pkgs locked_commit on release/0.7.0 for the brotli and curl fixes - #2671
Merged
Merged
Conversation
…d curl fixes Moves the pkgs locked_commit from bd1feab5 (2026-10-26) to fe10f54c (pkgs main, 2026-10-27), the same pin as #2670 on main. The guest rootfs this pin materializes picks up brotli-libs 1.2.1-r0 (CVE-2026-111497, a critical decoder buffer overflow that a malicious git server reaches through libcurl) and libcurl 8.23.0-r0 with Alpine's 8.23.0 curl CVE fixes (pkgs#1109). The rest of the range is package version bumps: grafana, patch, wrangler, stlink, redis, nats-server, lerna, hunk and cloudflared. (cherry picked from commit d9c9403) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016CYvTy9Jxczrnwgma36qEu
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
Contributor
|
Approved: no findings at Nothing to do. Clobber: none seen. |
norrietaylor
approved these changes
Oct 27, 2026
This was referenced Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This brings 0.7.2 onto the same pkgs pin as the
mainPR #2670. It moveslocked_commitfrombd1feab5(2026-10-26) tofe10f54c(pkgsmain, 2026-10-27). This is the second pin bump that #2638 said would follow.The guest rootfs that this pin materializes picks up gominimal/pkgs#1109:
The rest of the range is package version bumps that this repo's
minimal.tomldoes not name: grafana, patch, wrangler, stlink, redis, nats-server, lerna, hunk and cloudflared. This PR adds no version bump.release/0.7.0already declares 0.7.2.Merge it before the 0.7.2 release run, or 0.7.2 ships the rootfs without these fixes.
Testing
scripts/next-version.sh --checkon this branch:package.version 0.7.2 satisfies the 3 commit(s) since v0.7.1 (patch bump, at least 0.7.2) and is greater than the newest tag v0.7.1.git cherrymatches it to themaincommit at the step 7 merge-back.ci-linux-kvmandci-macos.🤖 Generated with Claude Code
https://claude.ai/code/session_016CYvTy9Jxczrnwgma36qEu