8000 build: bump the pkgs locked_commit on release/0.7.0 for 0.7.2 by bryan-minimal · Pull Request #2638 · gominimal/minimal · GitHub
[go: up one dir, main page]
Skip to content

build: bump the pkgs locked_commit on release/0.7.0 for 0.7.2 - #2638

Merged
bryan-minimal merged 1 commit into
release/0.7.0from
build/pkgs-pin-bd1feab5-0.7.0
Oct 26, 2026
Merged

build: bump the pkgs locked_commit on release/0.7.0 for 0.7.2#2638
bryan-minimal merged 1 commit into
release/0.7.0from
build/pkgs-pin-bd1feab5-0.7.0

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Oct 26, 2026 •
edited
Loading
Copy link
Copy Markdown
Member

Summary

This brings 0.7.2 onto the same pkgs pin as the main PR #2637. It moves locked_commit from bd62e6e2 (2026-10-04) to bd1feab5 (pkgs main, 2026-10-26), so the 0.7.2 guest image no longer trusts emSign ECC Root CA - G3 (CVE-2026-111943) and carries musl 1.2.6-r3 and OpenSSL 3.5.9. Stable 0.7.1 still ships the 10-04 image.

release/0.7.0 already declares 0.7.2 through #2630 (merged 2026-10-26 20:09Z, before this PR opened, so it can't be stacked on that branch; this targets release/0.7.0 directly), and nothing is staged yet: versions/0.7.2/ returns 404. This PR adds no version bump. Merge it before the 0.7.2 release run, or 0.7.2 locks in the old image.

Not in this PR: #1277, the -rN revision/patch ledger. I left it out on purpose, for two reasons:

  1. It is feat(stdlib):, and scripts/next-version.sh --check requires a minor bump for any feat since the last tag. On v0.7.1 plus git cherry-pick -x aa13debf5, the check says "the commits since v0.7.1 require at least 0.8.0". A release that carries it cannot be 0.7.2.
  2. The pin doesn't need it. The only stdlib difference between v0.7.1 and main is feat(stdlib): type the patch ledger by kind, and check revision against it #1277: stdlib 0.0.21 vs 0.0.22, on the same nickel-lang-core 0.19.0. No pkgs package at bd1feab5 declares revision or patches, so 0.7.x users have no -rN to use yet. feat(stdlib): type the patch ledger by kind, and check revision against it #1277 ships with 0.8.0 from main.

The pkgs changelog below is the same range as #2637. I generated it from git log bd62e6e2..bd1feab5 in a clean pkgs worktree and from the merged PR bodies.

Follow-up bump coming: a further guest-rootfs fix is in flight in pkgs. It moves microvm-rootfs's Alpine pin brotli-libs 1.2.0-r1 → 1.2.1-r0 (CVE-2026-111497; the guest's libcurl links brotli) and adds libcurl 8.23.0-r0. bd1feab5 does not contain it. A second pin bump follows once that pkgs PR merges.

What minimal itself ships (guest image, kernel, libkrun)

These are the packages that release.yml materializes from this pin: minvmd-rootfs = microvm-rootfs, virtio-kernel = virtio-kernel-raw, and libkrun.

Change pkgs PR Advisories
microvm-rootfs: ca-certificates-bundle 20260611-r0 → 20261020-r0. This drops emSign ECC Root CA - G3. #947 CVE-2026-111943
microvm-rootfs: musl, musl-utils 1.2.6-r2 → 1.2.6-r3 (regcomp overflows) #993 CVE-2026-107891
microvm-rootfs: libcrypto3/libssl3 3.5.8 → 3.5.9, libexpat 2.8.4 → 2.9.0, nghttp2-libs 1.69.0 → 1.70.0, pcre2 10.48 → 10.49 #933 CVE-2026-102633, CVE-2026-103111, CVE-2026-58055, CVE-2026-77214, CVE-2026-93990
virtio-linux / virtio-kernel-raw 6.12.111 → 6.12.114 #980 none cited (stable-tree update)
libkrun 1.19.4 → 1.19.7, libkrunfw 5.6.1 → 5.6.2 #835, #1018, #1019 none cited

just kernel-review 6.12.111 6.12.114 reports 7 core-subtree commits. The tool flags two of them, both in drivers/virtio: 1eaa83fd94ed "virtio: break and reset virtio devices on device_shutdown()" and 8e360ffa4aa6 "virtio-mmio: Remove virtqueue list from mmio device". The vsock changes are a vmci leak fix and vsock/virtio: account only unread bytes in read_skb(). There are no changes to virtio_console. The KVM and macOS lanes on this PR boot the new kernel.

emSign / eMudhra distrust across pkgs (CVE-2026-111943)

  • System store: ca-certificates rebuilt from the curl 2026-10-20 bundle (#948). Five more packages now declare it: ruby, typst, atuin, gws and skopeo (#957).
  • Runtimes with their own store: node and node-lts (#946), jdk-21/25/27 (#949), python's ensurepip pip 26.2.2 (#950), bun and plannotator (#951), httpie certifi (#952), and chromium-bin through the CADistrustedCertificates policy (#961).
  • These now read the system store: deno and claude-code (#956), and gcloud (#954).
  • rustls-webpki 0.103.16 / webpki-roots 1.0.10 (RUSTSEC-2026-0382, -0383) is locked in about 21 Rust tools: #953, #955, and the later upstream bumps (uv, prek, railway, tealdeer, biome, codex, nickel, nushell).

Other security fixes

Toolchain bumps

rust 1.98.1 → 1.99.0 (#810) · go 1.27.1 → 1.27.3 (#935, #945) · python 3.14.7 → 3.14.9 · node 26.12.1 / node-lts 24.22.1 · ocaml 5.5.1 → 5.5.2 (#1100) · cmake 4.4.2 → 4.4.4 · git 2.55.0 → 2.56.0 · new jdk-21, jdk-25 and jdk-27 (Temurin, #897, #898)

Not in this range: harfbuzz 15.0.0 (GHSA-r62p-jr5f-3mjm, pkgs#1001) is still open.

Stdlib compatibility

The newest pkgs stdlib feature in range is [stdlib] minimum_version = "0.0.18" in pkgs minimal.toml (bd1feab5). minimal's stdlib is 0.0.22 on main and 0.0.21 on 0.7.1. Every attrs key used across pkgs (upstream_version, license_spdx, source_provenance, build_cost_multiple, repology_project, binary_from, env_*, redistributable, closed_source, needed_for_internet) already exists in 0.7.1's attr_classes.ncl. No package declares revision or patches yet (#1277).

Testing

  • scripts/next-version.sh --check on this branch: package.version 0.7.2 satisfies the 2 commit(s) since v0.7.1 (patch bump, at least 0.7.2) and is greater than the newest tag v0.7.1.
  • pkgs CI on bd1feab5 is green. cache.minimal.farm has the per-commit map, and the rootfs, kernel, libkrun and libkrunfw artifacts return 200 for amd64 and arm64.
  • The 0.7.x stdlib evaluates the new pin in this PR's lanes. native-daemon-e2e (scripts/session-e2e.sh) seeds this repo's [upstream] pin into the min and minimald that it builds from this branch. ci-linux-kvm and ci-macos boot the new kernel and rootfs.

Release steps after merge (docs/internal/release-pipeline.md; for a maintainer)

gh workflow run release.yml --ref release/0.7.0 -f versioned=true -f dry_run=true
gh workflow run release.yml --ref release/0.7.0 -f versioned=true -f dry_run=false
curl -fsS https://storage.googleapis.com/minimal-one/versions/0.7.2/smoked
gh workflow run promote.yml -f target=stable -f version=0.7.2 -f dry_run=true
gh workflow run promote.yml -f target=stable -f version=0.7.2   # a second minimalist comments `approved`

Then do the step 7 merge-back of v0.7.2 into main with -s ours. v0.7.1 was never merged back either, and git cherry can't match #2630's squashed picks one by one, so check that by hand. #2630's fixes reached main as #2627, #2503, #2517 and #2326. This pin bump reaches main as #2637.

Checklist

  • Docs updated if behavior changed (no behavior change in minimal)
  • BREAKING CHANGE: footer present if this is a breaking change (not breaking)

🤖 Generated with Claude Code

@bryan-minimal @claude
build: bump the pkgs locked_commit for the October security fixes
f5ac990 
Moves the pkgs locked_commit from bd62e6e2 (2026-10-04) to bd1feab5
(pkgs main, 2026-10-26), the same pin as the main PR #2637, so 0.7.2
ships the current guest image. That image picks up the emSign ECC Root
CA - G3 distrust (CVE-2026-111943, pkgs#947), musl 1.2.6-r3
(CVE-2026-107891, pkgs#993), and OpenSSL 3.5.9, expat 2.9.0, nghttp2
1.70.0 and pcre2 10.49 (pkgs#933). The guest kernel moves from 6.12.111
to 6.12.114, and libkrun moves to 1.19.7 with libkrunfw 5.6.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner October 26, 2026 20:16
@coderabbitai
coderabbitai Bot commented Oct 26, 2026
Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: 68de32f3-53f7-4360-8016-2355a2f810fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@minimal-foundry
minimal-foundry Bot commented Oct 26, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Approved: no findings at f5ac99027e40.

Nothing to do.

Clobber: none.

minimal-foundry[bot]
minimal-foundry Bot approved these changes Oct 26, 2026
View reviewed changes
@minimal-foundry minimal-foundry Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minimal-review — approved

Verdict APPROVE — No findings.

Panel: 3 of 3 personas ran (correctness, security, supply-chain).

@minimal-foundry minimal-foundry Bot added the review:approved minimal-review approved the current head label Oct 26, 2026
@bryan-minimal
bryan-minimal merged commit c670e54 into release/0.7.0 Oct 26, 2026
32 checks passed
@bryan-minimal
bryan-minimal deleted the build/pkgs-pin-bd1feab5-0.7.0 branch October 26, 2026 21:21
This was referenced Oct 27, 2026
Merged
Merged
@mitodrummer mitodrummer mentioned this pull request Oct 28, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@evanspearman evanspearman evanspearman approved these changes
@minimal-foundry minimal-foundry[bot] minimal-foundry[bot] approved these changes

Assignees

No one assigned

Labels

review:approved minimal-review approved the current head

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bryan-minimal @evanspearman
0