8000 Update stacked: zlib 1.3.2 -> 1.4 by gominimal-pkgmgr-mgr[bot] · Pull Request #1351 · gominimal/pkgs · GitHub
[go: up one dir, main page]

Skip to content

Update stacked: zlib 1.3.2 -> 1.4 - #1351

Merged
bryan-minimal merged 2 commits into
mainfrom
update-stacked-2026-11-06-b187f93e
Nov 7, 2026
Merged

bryan-minimal merged 2 commits into
mainfrom
update-stacked-2026-11-06-b187f93e

Conversation

@gominimal-pkgmgr-mgr
Copy link
Copy Markdown
Contributor

Update base-soup (1 package)

Note

zlib declares replace_on_cycle in build.ncl, so they take part in
the toolchain rebuild graph and one hash change cascades through the
set. Bundling lands the cascading rebuild as a single unit, even when
only one package is bumping, which avoids back-to-back full rebuilds
from singleton PRs.

Pkgscan: clean across every scanned bundle member — diffs against prior versions surfaced no newly-introduced suspicious patterns.

Note

Build risk — 97 dependents across the tree. Package(s) that
build- or runtime-depend on a member of this bundle may need a rebuild,
or could FTBFS on an API/ABI change. Informational (not blocking) — a
heads-up for the reviewer on what this bump can ripple into.

Bundle member Dependents
zlib 97 — actions-runner, bat, binutils, binutils-arm-none-eabi, charon, classpath-0.93, classpath-0.99, classpath-devel (+89 more)

Summary

Package Old New Source
zlib 1.3.2 1.4 github:madler/zlib:release-asset:operator-pinned

Vulnerabilities fixed (2)

Package CVE / GHSA CPE Severity Fixed in
zlib CVE-2026-76844 (zlib, zlib) HIGH via range: >= 1.2.11, <= 1.3.2
zlib CVE-2026-85091 (zlib, zlib) HIGH via range: >= 1.3.1.2, <= 1.3.2

Per-package details

zlib 1.3.2 → 1.4
  • SHA256: b99a0b86c0ba9360... → 02dd159783677a74...
  • Size: 1.6 MB → 1.5 MB
  • Source: gs://minimal-staging-archives/zlib-1.3.2.tar.gz → gs://minimal-staging-archives/zlib-1.4.tar.gz
  • Released: 1 days ago (2026-11-05)
  • License: Zlib (source: tarball)
  • 🔒 TLS: github.com — Sectigo Public Server Authentication CA DV E36 → Sectigo Public Server Authentication Root E46 (root c90f26f0fb1b4018…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519 ⇒ release-assets.githubusercontent.com — YR1 → Root YR → ISRG Root X1 (root 96bcec06264976f3…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519

License

  • Upstream 1.3.2 → 1.4: unchanged, license files byte-identical (LICENSE)
  • Declared license_spdx: Zlib agrees with the new release (Zlib)

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner November 6, 2026 16:54
@coderabbitai
coderabbitai Bot commented Nov 6, 2026 •
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

…le race, not a zlib failure; no-op)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal added this pull request to the merge queue Nov 7, 2026
Merged via the queue into main with commit 7930839 Nov 7, 2026
15 checks passed
@bryan-minimal
bryan-minimal deleted the update-stacked-2026-11-06-b187f93e branch November 7, 2026 02:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0