Update stacked: 7 packages by gominimal-pkgmgr-mgr[bot] · Pull Request #829 · gominimal/pkgs

gominimal-pkgmgr-mgr · 2026-10-07T15:52:31Z

Update base-soup (7 packages)

Note

These packages declare replace_on_cycle in their build.ncl, so
they participate in the toolchain rebuild graph and one hash change
cascades through the set. Bundling ensures the cascading rebuild
lands as a single unit, even when only one package is bumping —
avoids back-to-back full rebuilds from singleton PRs.

Warning

1 requested member did NOT ship — each needs separate follow-up.
A member is dropped when it fails to update, has its gs:// mirror
withheld by the scan gate, or is peeled to keep the shipped set a
closed dependency closure. Reasons are abbreviated — the full
diagnostics ride the Slack thread and the run's logs.

Package	Old	Target	Why
`prek`	`0.5.3`	`0.5.5`	gs:// mirror withheld (pkgscan-high).

Pkgscan: clean across all bundle members — diffs against prior versions surfaced no newly-introduced suspicious patterns.

Note

Build risk — 2 dependents across the tree. Package(s) that
build- or runtime-depend on a member of this bundle may need a rebuild,
or could FTBFS on an API/ABI change. Informational (not blocking) — a
heads-up for the reviewer on what this bump can ripple into.

Bundle member	Dependents
`cups`	2 — `chromium-bin`, `chromium-headless-shell-bin`

Summary

Package	Old	New	Source
cups	`2.4.19`	`2.4.20`	`github:OpenPrinting/cups:release-asset:operator-pinned`
prettier	`3.9.8`	`3.9.9`	`github:prettier/prettier:operator-pinned`
shadow	`4.20.2`	`4.20.3`	`github:shadow-maint/shadow:release-asset:operator-pinned`
stress-ng	`0.21.04`	`0.22.01`	`github:ColinIanKing/stress-ng:operator-pinned`
syft	`1.52.0`	`1.54.1`	`github:anchore/syft:operator-pinned`
trivy	`0.74.0`	`0.75.0`	`github:aquasecurity/trivy:operator-pinned`
vlt	`1.3.6`	`1.3.7`	`custom:https://registry.npmjs.org/vlt:operator-pinned`

Vulnerabilities fixed (11)

Package	CVE / GHSA	CPE	Severity	Fixed in
cups	CVE-2026-87875	`(apple, cups)`	MEDIUM	`2.4.20`
cups	GHSA-7j85-5r23-xhvh	`(apple, cups)`	MEDIUM	via range: `<= 2.4.19; <= 2.4.19`
cups	GHSA-gq9p-4w7m-2f5g	`(apple, cups)`	MEDIUM	via range: `<= 2.4.19; <= 2.4.19`
cups	GHSA-jj94-x3qh-ffp9	`(apple, cups)`	MEDIUM	via range: `<= 2.4.19`
cups	GHSA-qqm8-4q5h-jg55	`(apple, cups)`	MEDIUM	via range: `<= 2.4.19; <= 2.4.19`
cups	GHSA-w9hj-hq9p-m7f6	`(apple, cups)`	MEDIUM	`2.4.20`
cups	CVE-2026-87876	`(apple, cups)`	LOW	`2.4.20`
cups	GHSA-69qc-prxg-h2c7	`(apple, cups)`	LOW	via range: `<= 2.4.19`
cups	GHSA-7hqf-mfhx-7r3v	`(apple, cups)`	LOW	via range: `<= 2.4.19; <= 2.4.19`
cups	GHSA-pwg4-pv39-8c22	`(apple, cups)`	LOW	via range: `>= 1.4.8, <= 2.4.19; >= 1.4.8, <= 2.4.19`
cups	GHSA-wjc4-qhjr-5m5x	`(apple, cups)`	LOW	via range: `<= 2.4.19; <= 2.4.19`

Warning

2 known vulnerabilities still affect this bundle after update. Run pkgmgr vulns for details.

Per-package details

cups 2.4.19 → 2.4.20

SHA256: 820984b12a67f987... → ab4d9cd7f3e58060...
Size: 8.0 MB → 8.2 MB
Source: gs://minimal-staging-archives/cups-2.4.19-source.tar.gz → gs://minimal-staging-archives/cups-2.4.20-source.tar.gz
Released: 2 days ago (2026-10-05)
License: Apache-2.0 (source: GitHub + tarball)

prettier 3.9.8 → 3.9.9

SHA256: →
Size: 0 B
Source: npm:prettier@3.9.8 (lockfile) → npm:prettier@3.9.9 (lockfile)
Released: unknown (non-GitHub source or tag-only fallback)
Auto-applied:
- Regenerated package-lock.json for prettier@3.9.9 (version, resolved URL and integrity hash move together; npm ci installs exactly this tree).

shadow 4.20.2 → 4.20.3

SHA256: b89f432b75ae55a2... → 623be9429f64fa21...
Size: 2.3 MB → 2.3 MB
Source: gs://minimal-staging-archives/shadow-4.20.2.tar.xz → gs://minimal-staging-archives/shadow-4.20.3.tar.xz
Released: 13 days ago (2026-09-23)
License: BSD-3-Clause (source: tarball)

stress-ng 0.21.04 → 0.22.01

SHA256: a328ba050bd3014f... → 67e75894da3f634b...
Size: 8.5 MB → 8.6 MB
Source: gs://minimal-staging-archives/ColinIanKing/stress-ng/V0.21.04.tar.gz → gs://minimal-staging-archives/ColinIanKing/stress-ng/V0.22.01.tar.gz
Released: 17 days ago (2026-09-20)
License: GPL-2.0-only (source: GitHub + tarball)

syft 1.52.0 → 1.54.1

SHA256: 8b999a1b8bd08b12... → e3a8b41ef4050665...
Size: 7.4 MB → 7.5 MB
Source: gs://minimal-staging-archives/anchore/syft/v1.52.0.tar.gz → gs://minimal-staging-archives/anchore/syft/v1.54.1.tar.gz
Released: 1 days ago (2026-10-06)
License: Apache-2.0 (source: GitHub + tarball)

trivy 0.74.0 → 0.75.0

SHA256: 04268af574690b84... → 4ee2010384f90bf2...
Size: 56.7 MB → 56.7 MB
Source: gs://minimal-staging-archives/aquasecurity/trivy/v0.74.0.tar.gz → gs://minimal-staging-archives/aquasecurity/trivy/v0.75.0.tar.gz
Released: 6 days ago (2026-10-01)
License: Apache-2.0 (source: GitHub + tarball)

vlt 1.3.6 → 1.3.7

SHA256: →
Size: 0 B
Source: npm:vlt@1.3.6 (lockfile) → npm:vlt@1.3.7 (lockfile)
Released: unknown (non-GitHub source or tag-only fallback)
Auto-applied:
- Regenerated package-lock.json for vlt@1.3.7 (version, resolved URL and integrity hash move together; npm ci installs exactly this tree).

Created by pkgmgr

coderabbitai · 2026-10-07T15:52:41Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 9da24af9-3f9e-44d4-9781-c35ad57ba261

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

cups 2.4.20 (a security release, 7 CVEs) fails to compile when configured without DNS-SD, wh 8000 ich is how we build it: dest.c uses _cups_getdata_t.num_local/local_dests, declared only in the DNS-SD variant of the struct. Upstream OpenPrinting/cups#1739, fixed by #1740 (a197d30 on 2.4.x, merged 2026-10-06, not yet released). Drop the patch on the bump past 2.4.20. Verified: min package build --rebuild cups + min check (aarch64) pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bryan-minimal · 2026-10-07T15:59:49Z

cups 2.4.20 doesn't compile without DNS-SD (upstream OpenPrinting/cups#1739). Pushed the upstream fix (#1740, a197d30 on 2.4.x) as a carried patch; cups builds and passes min check in a session (aarch64). 2.4.20 is a security release (7 CVEs), so patching beats skipping it.

The patch backported upstream dc3c56eed5 for Go 1.27's json/v2 and was marked "drop at the next trivy release"; 0.75.0 is that release and the patch now reports every hunk as already applied. The grep guard in build.sh stays and still passes, proving no Go-1.26-only json/v2 usage remains. Verified: min package build --rebuild trivy + min check (aarch64) pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bryan-minimal · 2026-10-07T16:03:43Z

Next failure after cups was trivy: our carried go127-json-skipfunc.patch is upstream in 0.75.0 (every hunk reported as already applied). Dropped it; the build.sh json/v2 guard stays and passes. trivy + cups build and pass min check in a session (aarch64).

gominimal-pkgmgr-mgr Bot added 7 commits October 7, 2026 15:52

Update cups to 2.4.20

9dde051

Update prettier to 3.9.9

4d5f5df

Update shadow to 4.20.3

44bc4b0

Update stress-ng to 0.22.01

e37eedd

Update syft to 1.54.1

4ee46c6

Update trivy to 0.75.0

463d72f

Update vlt to 1.3.7

88b990d

gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner October 7, 2026 15:52

bryan-minimal approved these changes Oct 8, 2026

View reviewed changes

bryan-minimal added this pull request to the merge queue Oct 8, 2026

Merged via the queue into main with commit fcc320c Oct 8, 2026
11 checks passed

bryan-minimal deleted the update-stacked-2026-10-07-733f02cd branch October 8, 2026 01:30

This was referenced Oct 26, 2026

build: bump the pkgs locked_commit for the October security fixes gominimal/minimal#2637

Merged

build: bump the pkgs locked_commit on release/0.7.0 for 0.7.2 gominimal/minimal#2638

Merged

Navigation Menu

Repository navigation

Update stacked: 7 packages - #829

Update stacked: 7 packages#829
bryan-minimal merged 9 commits into
mainfrom
update-stacked-2026-10-07-733f02cd

Uh oh!

Review skipped

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Update base-soup (7 packages)

Summary

Vulnerabilities fixed (11)

Per-package details

Uh oh!

Uh oh!

Review skipped

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant