8000 Update stacked: c-ares 1.34.8 -> 1.34.9 by gominimal-pkgmgr-mgr[bot] · Pull Request #979 · gominimal/pkgs · GitHub
[go: up one dir, main page]

Skip to content

Update stacked: c-ares 1.34.8 -> 1.34.9 - #979

Merged
bryan-minimal merged 1 commit into
mainfrom
update-stacked-2026-10-22-d91b3e6f
Oct 22, 2026
Merged

bryan-minimal merged 1 commit into
mainfrom
update-stacked-2026-10-22-d91b3e6f

Conversation

@gominimal-pkgmgr-mgr
Copy link
Copy Markdown
Contributor

Update base-soup (1 package)

Note

These packages declare replace_on_cycle in their build.ncl, so
they participate in the toolchain rebuild graph and one hash change
cascades through the set. Bundling ensures the cascading rebuild
lands as a single unit, even when only one package is bumping —
avoids back-to-back full rebuilds from singleton PRs.

Warning

2 requested members did NOT ship — each needs separate follow-up.
A member is dropped when it fails to update, has its gs:// mirror
withheld by the scan gate, or is peeled to keep the shipped set a
closed dependency closure. Reasons are abbreviated — the full
diagnostics ride the Slack thread and the run's logs.

Package Old Target Why
python 3.14.8 3.14.9 update failed: update refused: python's source URL is keyed on a non-version binding (commit/revision/snapshot), so bumping the version leaves the URL — and therefore the downloaded bytes — unchanged.
setuptools 84.0.0 84.2.1 peeled — depends on dropped member 'python'

Pkgscan: clean across all bundle members — diffs against prior versions surfaced no newly-introduced suspicious patterns.

Note

Build risk — 3 dependents across the tree. Package(s) that
build- or runtime-depend on a member of this bundle may need a rebuild,
or could FTBFS on an API/ABI change. Informational (not blocking) — a
heads-up for the reviewer on what this bump can ripple into.

Bundle member Dependents
c-ares 3 — grpc, node, node-lts

Summary

Package Old New Source
c-ares 1.34.8 1.34.9 github:c-ares/c-ares:release-asset:operator-pinned

Vulnerabilities fixed (11)

Package CVE / GHSA Severity Fixed in
c-ares GHSA-wpr3-8q3r-4q8c HIGH via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-97vq-4mxv-7vhm MEDIUM via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-cfcv-8v2j-qj6r MEDIUM via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-fqh5-3x7m-wp44 MEDIUM via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-grv7-fq5q-9vfc MEDIUM via range: >= 1.28.0, <= 1.34.8; >= 1.28.0, <= 1.34.8
c-ares GHSA-mw23-pfg6-2x9r MEDIUM via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-ph6c-3cvx-mq6v MEDIUM via range: >= 1.23.0, <= 1.34.8; >= 1.23.0, <= 1.34.8
c-ares GHSA-pj7p-v3cw-hq66 MEDIUM via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-rf6g-ww74-97qh MEDIUM via range: <= 1.34.8; <= 1.34.8
c-ares GHSA-v33j-65h4-4ch8 MEDIUM via range: >= 1.29.0, <= 1.34.8; >= 1.29.0, <= 1.34.8
c-ares GHSA-wrgc-prmw-27xh LOW via range: >= 1.23.0, <= 1.34.8; >= 1.23.0, <= 1.34.8

Per-package details

c-ares 1.34.8 → 1.34.9
  • SHA256: c222b6d681096f94... → 9364b70a12eb59a0...
  • Size: 1.1 MB
  • Source: https://github.com/c-ares/c-ares/releases/download/v1.34.8/c-ares-1.34.8.tar.gz → https://github.com/c-ares/c-ares/releases/download/v1.34.9/c-ares-1.34.9.tar.gz
  • Released: 2 days ago (2026-10-20)
  • License: MIT (source: GitHub + tarball)

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner October 22, 2026 16:36
@coderabbitai
coderabbitai Bot commented Oct 22, 2026
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 22, 2026
Merged via the queue into main with commit befeac7 Oct 22, 2026
11 checks passed
@bryan-minimal
bryan-minimal deleted the update-stacked-2026-10-22-d91b3e6f branch October 22, 2026 17:10
@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot restored the update-stacked-2026-10-22-d91b3e6f branch October 22, 2026 17:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0