Drop python 3.10 which is EOL

.claude/skills/update-anycable/SKILL.md

@@ -0,0 +1,212 @@
+---
+name: update-anycable
+description: Rebuild the bundled anycable-go binaries (openc3-anycable/anycable-go-linux-amd64 and -arm64). Syncs a local anycable checkout with upstream, bumps the Go toolchain and module dependencies when a newer Go patch release is out, builds with openc3-anycable/build-anycable.sh, and opens a COSMOS PR with the new binaries. Optionally opens a dependency-bump PR against anycable/anycable from the user's fork. Use when asked to update or rebuild anycable or to pick up Go security releases.
+argument-hint: "[go-minor, e.g. 1.26] [--force-build]"
+---
+
+# Update the anycable-go binaries
+
+COSMOS ships prebuilt `anycable-go` binaries in `openc3-anycable/` (copied into
+the API images by their Dockerfiles). We build them ourselves
+so they pick up Go security releases faster than upstream anycable does.
+
+## Inputs
+
+`$ARGUMENTS` can include:
+- A Go minor line such as `1.26`. If it's missing, read the `toolchain` line in
+  the anycable `go.mod` and use its major.minor.
+- `--force-build` rebuilds and opens the COSMOS PR even when the toolchain is
+  already current (for example, after upstream released a new anycable version).
+
+## Requirements
+
+- `go` (any recent version; Go downloads the toolchain go.mod asks for)
+- `gh`, authenticated (`gh auth status`)
+- An anycable checkout at `$ANYCABLE_DIR`, defaulting to `../anycable` relative
+  to the cosmos repo root
+
+The shell's cwd resets to the cosmos repo between commands, so use
+`git -C "$ANYCABLE_DIR"` or absolute paths.
+
+## Steps
+
+### 1. Ask about the upstream PR
+
+Ask the user (AskUserQuestion) whether to also open a dependency-bump PR against
+`anycable/anycable`. Opening it needs a GitHub fork of anycable under their
+account. Recommend "yes" only if nobody else on the team usually does it, so
+upstream doesn't get duplicate Go-bump PRs. Remember the answer as `UPSTREAM_PR`.
+
+### 2. Find or create the anycable checkout
+
+```bash
+ANYCABLE_DIR="${ANYCABLE_DIR:-$(cd .. && pwd)/anycable}"
+GH_USER=$(gh api user -q .login)
+```
+
+If `$ANYCABLE_DIR` doesn't exist:
+- `UPSTREAM_PR` = yes: `cd "$(dirname "$ANYCABLE_DIR")" && gh repo fork anycable/anycable --clone`.
+  This forks under `$GH_USER` (or reuses an existing fork), clones it into
+  `./anycable`, and sets `origin` = fork and `upstream` = anycable/anycable. If
+  `$ANYCABLE_DIR`'s basename isn't `anycable`, rename the clone to match.
+- `UPSTREAM_PR` = no: `git clone https://github.com/anycable/anycable.git "$ANYCABLE_DIR"`.
+
+Then work out the remote names by URL rather than assuming them:
+
+```bash
+git -C "$ANYCABLE_DIR" remote -v
+```
+
+- `UPSTREAM` = the remote whose URL is `github.com/anycable/anycable` (or `.git`)
+- `FORK` = the remote whose URL is `github.com/$GH_USER/anycable`, if any
+
+If there's no `UPSTREAM` remote (for example, a clone of the fork alone), add
+one with `git -C "$ANYCABLE_DIR" remote add upstream https://github.com/anycable/anycable.git`
+and use `UPSTREAM=upstream`.
+
+If `UPSTREAM_PR` = yes but there's no `FORK` remote, run
+`gh repo fork anycable/anycable --remote --remote-name fork` from inside the
+checkout and use `FORK=fork`. If the checkout has local commits or a dirty tree
+(`git status --short`), stop and ask the user before continuing. Untracked
+`dist/` or build scripts are fine to ignore.
+
+### 3. Sync with upstream
+
+```bash
+git -C "$ANYCABLE_DIR" fetch "$UPSTREAM" --tags
+git -C "$ANYCABLE_DIR" switch main
+git -C "$ANYCABLE_DIR" merge --ff-only "$UPSTREAM/main"
+```
+
+If the fast-forward fails, local `main` has diverged from upstream. Stop and
+ask the user. Don't rebase, reset, or force-push. Don't push `main` to the
+fork. Only the `go/$NEW` branch in step 9 goes there.
+
+### 4. Check whether Go is out of date
+
+Find the newest patch release in the minor line, using the release page as the
+source of truth:
+
+```bash
+curl -s https://go.dev/doc/devel/release | grep -oE 'go1\.26\.[0-9]+' | sort -uV | tail -1
+grep '^toolchain' "$ANYCABLE_DIR/go.mod"
+```
+
+(Replace `1\.26` with the requested minor line.) `https://go.dev/dl/?mode=json`
+makes a good cross-check. If a newer minor line exists (for example `go1.27.x`),
+mention it to the user, but stay on the current line unless they ask to move.
+
+If the toolchain is already current and `--force-build` wasn't given, report
+that and stop.
+
+### 5. Bump the toolchain and dependencies on a branch
+
+Name the branch `go/<version>`. Update **both** modules, the root module and
+`etc/benchi`:
+
+```bash
+NEW=1.26.9   # newest patch from step 4
+cd "$ANYCABLE_DIR"
+git switch -c go/$NEW
+go mod edit -toolchain=go$NEW && go get -u ./... && go mod tidy
+(cd etc/benchi && go mod edit -toolchain=go$NEW && go get -u ./... && go mod tidy)
+git diff --stat              # expect only go.mod/go.sum in both modules
+```
+
+Leave the `go 1.26.0` directive alone. Only `toolchain` changes.
+
+### 6. Verify
+
+```bash
+go version                   # must report the new toolchain
+go test ./...                # must pass
+(cd etc/benchi && go build ./...)
+go vet ./...
+```
+
+`go vet` already reports three `copies lock value` warnings on upstream main
+(`redis/config_test.go`, `config/config.go`), and they're expected. Flag any
+**new** vet output to the user. If tests fail, stop and report the output
+instead of building.
+
+### 7. Commit in anycable
+
+Commit **before** building so the SHA stamped into the binaries is the
+dependency-bump commit:
+
+```bash
+git -C "$ANYCABLE_DIR" add go.mod go.sum etc/benchi/go.mod etc/benchi/go.sum
+git -C "$ANYCABLE_DIR" commit -m "Bump dependencies including toolchain go$NEW"   # plus attribution footer
+```
+
+### 8. Build the binaries into COSMOS
+
+From the cosmos repo root:
+
+```bash
+openc3-anycable/build-anycable.sh "$ANYCABLE_DIR"
+```
+
+This builds linux/amd64 and linux/arm64 straight into `openc3-anycable/` and prints
+`go version` for both, which must show `go$NEW`. Report the new sizes.
+
+### 9. Open the upstream PR (only if `UPSTREAM_PR` = yes)
+
+Before creating the PR, run `gh pr list -R anycable/anycable --author "$GH_USER" --state open`
+to look for a dependency PR that's still open. If one exists, ask the user
+whether to update it or open a new one. Follow the format of earlier merged
+PRs (#334, #339):
+
+```bash
+git -C "$ANYCABLE_DIR" push -u "$FORK" go/$NEW
+gh pr create -R anycable/anycable --base main --head "$GH_USER:go/$NEW" \
+  --title "Bump dependencies including toolchain go$NEW" \
+  --body "### What is the purpose of this pull request?
+
+Bump dependencies to close Go CVEs: https://go.dev/doc/devel/release#go1.26.minor
+
+### What changes did you make? (overview)
+
+Just dependency updates"   # plus attribution footer
+```
+
+Afterwards, switch the checkout back to `main` (`git -C "$ANYCABLE_DIR" switch main`).
+If `UPSTREAM_PR` = no, leave the `go/$NEW` branch local and switch back to `main`.
+
+### 10. Open the COSMOS PR
+
+Work in the cosmos repo root:
+
+```bash
+git status --short           # note any unrelated changes; commit only the two binaries
+git fetch origin
+git switch -c anycable-go$NEW origin/main
+git add openc3-anycable/anycable-go-linux-amd64 openc3-anycable/anycable-go-linux-arm64
+git commit -m "build(openc3-anycable): update anycable-go binaries to go$NEW"   # plus attribution footer
+git push -u origin anycable-go$NEW
+gh pr create --base main --head anycable-go$NEW \
+  --title "build(openc3-anycable): update anycable-go binaries to go$NEW" \
+  --body "Rebuilds the anycable-go linux/amd64 and linux/arm64 binaries with toolchain go$NEW and bumped Go dependencies, picking up the security fixes in https://go.dev/doc/devel/release#go1.26.minor.
+
+Upstream dependency PR: <URL from step 9, or 'none'>"   # plus attribution footer
+```
+
+`git switch -c ... origin/main` carries over uncommitted working-tree changes
+(the new binaries included). If the switch fails because of conflicting local
+changes, stop and ask the user. Don't stash or discard their work.
+
+If the pre-commit hook fails with `invalid byte sequence in UTF-8`, the
+installed `.git/hooks/pre-commit` is an old copy that tries to read the
+binaries as text. Run `hooks/install.sh` to install the current hook, which
+skips files without a supported extension, then commit again. Don't use `--no-verify`.
+
+Afterwards, switch back to the branch the user started on.
+
+## Report
+
+Tell the user:
+- Which anycable checkout was used, and whether it was cloned, forked, or fast-forwarded
+- The old and new toolchain versions, plus notable dependency bumps
+- Test and vet results
+- The new binary sizes
+- The upstream anycable PR URL (or that it was skipped) and the COSMOS PR URL

.env

@@ -112,6 +112,12 @@ DEBIAN_POINT_RELEASE=13.7
 RUBY_VERSION=3.4
 APT_URL=http://deb.debian.org
 RUBYGEMS_URL=https://rubygems.org
+# A non-default PYPI_URL makes the build re-resolve the uv.lock files inside the
+# image against that mirror - a lockfile pins absolute pypi.org download URLs
+# that no index setting can redirect. The mirror must therefore serve every
+# Python dependency, dev dependency groups included.
+# Do not put user:token@ credentials in PYPI_URL: it is baked into the
+# environment of every image, visible to docker inspect and the image history.
 PYPI_URL=https://pypi.org
 NPM_URL=https://registry.npmjs.org
 MAVEN_URL=https://repo.maven.apache.org/maven2
@@ -121,8 +127,10 @@ OPENC3_AWS_ARN_PREFIX=arn:aws
 # Override based on deployed region
 AWS_REGION=us-east-1
 
-# Enables uv's --allow-insecure-host flag when downloading python packages from
-# the PYPI_URL, for a private index with a self signed certificate.
+# Trusts the PYPI_URL host for a private index with a self signed certificate,
+# or a plain-HTTP one: at build time pip installs uv with --trusted-host and the
+# uv relock and sync steps get UV_INSECURE_HOST, and at run time uv gets
+# --allow-insecure-host when installing plugin packages.
 # OPENC3_PYPI_ALLOW_INSECURE=1
 # Deprecated name for OPENC3_PYPI_ALLOW_INSECURE, still honored.
 # PIP_ENABLE_TRUSTED_HOST=1

.github/actions/build-cosmos/action.yml

@@ -197,8 +197,8 @@ runs:
         openc3-traefik|openc3-traefik|
         openc3-base|openc3|openc3-ruby
         openc3-node|openc3-node|openc3-base
-        openc3-cosmos-cmd-tlm-api|openc3-cosmos-cmd-tlm-api|openc3-base
-        openc3-cosmos-script-runner-api|openc3-cosmos-script-runner-api|openc3-base
+        openc3-cosmos-cmd-tlm-api|openc3-cosmos-cmd-tlm-api openc3-anycable|openc3-base
+        openc3-cosmos-script-runner-api|openc3-cosmos-script-runner-api openc3-anycable|openc3-base
         openc3-operator|openc3-operator|openc3-base
         openc3-cosmos-init|openc3-cosmos-init docs.openc3.com|openc3-node openc3-base
         EOF

.github/actions/fetch-vexhub/action.yml

@@ -0,0 +1,54 @@
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+name: Fetch VEX Hub
+description: |
+  Put a pinned commit of the Aqua VEX Hub into the trivy cache so trivy can
+  apply it without fetching it itself. Run trivy afterwards with
+  TRIVY_SKIP_VEX_REPO_UPDATE=true.
+
+  trivy reads vex-repository.json through the GitHub contents API. Without a
+  token that is rate limited per runner IP ("403 API rate limit exceeded");
+  with GITHUB_TOKEN it is rejected outright because the aquasecurity org has an
+  IP allow list. A git fetch hits neither limit.
+
+  The hub is pinned, not tracking main, because VEX statements suppress
+  findings: a tampered hub could hide real vulnerabilities. git verifies every
+  object against the commit hash, so the pin is also the integrity check. To
+  update, set VEXHUB_COMMIT to a newer commit on aquasecurity/vexhub main.
+
+  With the repo update skipped, trivy's pkg/vex/repo only reads
+  $CACHE_DIR/vex/repositories/default/0.1/index.json and the documents it
+  points to, so the hub checkout is all that is written.
+inputs:
+  cache-dir:
+    description: Trivy cache dir. The default matches trivy-action's cache-dir default.
+    required: false
+    default: ${{ github.workspace }}/.cache/trivy
+runs:
+  using: composite
+  steps:
+    - name: Download VEX Hub
+      shell: bash
+      env:
+        CACHE_DIR: ${{ inputs.cache-dir }}
+        VEXHUB_COMMIT: 8ae2a8c69e5958df726d228327a2c5fb13c2e640 # 2026-03-23
+      run: |
+        set -euo pipefail
+        dir="${CACHE_DIR}/vex/repositories/default/0.1"
+        rm -rf "$dir"
+        git init -q "$dir"
+        git -C "$dir" fetch -q --depth 1 https://github.com/aquasecurity/vexhub.git "$VEXHUB_COMMIT"
+        git -C "$dir" -c advice.detachedHead=false checkout -q FETCH_HEAD
+        test "$(git -C "$dir" rev-parse HEAD)" = "$VEXHUB_COMMIT"
+        rm -rf "$dir/.git"
+        test -s "$dir/index.json"
+        echo "VEX Hub ${VEXHUB_COMMIT}: $(grep -o '"id"' "$dir/index.json" | wc -l) packages"

.github/actions/setup-uv-python/action.yml

@@ -31,8 +31,8 @@ inputs:
       uv release to install. The default is the version this repository
       standardizes on; override only to test a candidate.
     required: false
-    # Matches UV_VERSION in openc3-ruby/Dockerfile and Dockerfile-ubi.
-    default: "0.12.5"
+    # Matches OPENC3_UV_VERSION in openc3-ruby/Dockerfile and Dockerfile-ubi.
+    default: "0.12.24"
   working-directory:
     description: |
       Directory holding pyproject.toml and uv.lock. Also given to setup-uv so

.github/scripts/check_tool_versions.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env -S uv run --script
 # /// script
-# requires-python = ">=3.10"
+# requires-python = ">=3.11"
 # dependencies = ["requests==2.34.2"]
 # ///
 
@@ -106,13 +106,13 @@ class Surface(NamedTuple):
     Surface(
         "uv (openc3-ruby image)",
         "openc3-ruby/Dockerfile",
-        r"ARG UV_VERSION=([\d.]+)",
+        r"ARG OPENC3_UV_VERSION=([\d.]+)",
         UV,
     ),
     Surface(
         "uv (openc3-ruby ubi image)",
         "openc3-ruby/Dockerfile-ubi",
-        r"ARG UV_VERSION=([\d.]+)",
+        r"ARG OPENC3_UV_VERSION=([\d.]+)",
         UV,
     ),
     # The trivy release the scan workflows install through setup-trivy, which