From 038ccacf10d025a8c62364d57a1bf7b7ae87e7f7 Mon Sep 17 00:00:00 2001 From: Yurii Kostiuk Date: Sun, 25 Oct 2026 23:54:00 +0000 Subject: [PATCH] docs(release): qryx 1.1.1 The qryx binaries and image are built on Go 1.27.3, which fixes GO-2026-6809 in crypto/x509. Since v1.1.0 two commits land: #78, the toolchain bump, and #77, the agent-stack-go v2.0.1 pin, which changes no Go code. The compat status carries the surface into 1.1.1. Co-Authored-By: Claude Sonnet 5.5 --- COMPATIBILITY.md | 2 +- compat/1.0.json | 2 +- docs/releases/v1.1.1.md | 16 ++++++++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 docs/releases/v1.1.1.md diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index db2e5ea..3a13e92 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -2,7 +2,7 @@ `TAIPANBOX/qryx` promises the surface below from its 1.0 (`compat/1.0.json`, held by `scripts/compat-surface.sh` on every push). A frozen name is not removed or renamed within a major; an additive thing may appear as a minor; an experimental thing may change in any release. -Status: frozen at 1.0.0 (2026-09-13), carried unchanged into 1.1.0 (2026-10-19): the surface below is the promise of this major; the gate has held it since the manifest was written ahead of the tag +Status: frozen at 1.0.0 (2026-09-13), carried unchanged into 1.1.0 (2026-10-19) and into 1.1.1 (2026-10-26): the surface below is the promise of this major; the gate has held it since the manifest was written ahead of the tag ## Frozen diff --git a/compat/1.0.json b/compat/1.0.json index 9eb0332..0c902a8 100644 --- a/compat/1.0.json +++ b/compat/1.0.json @@ -2,7 +2,7 @@ "schema": "taipanbox.dev/compat/v1", "repo": "TAIPANBOX/qryx", "major": 1, - "status": "frozen at 1.0.0 (2026-09-13), carried unchanged into 1.1.0 (2026-10-19): the surface below is the promise of this major; the gate has held it since the manifest was written ahead of the tag", + "status": "frozen at 1.0.0 (2026-09-13), carried unchanged into 1.1.0 (2026-10-19) and into 1.1.1 (2026-10-26): the surface below is the promise of this major; the gate has held it since the manifest was written ahead of the tag", "frozen": { "cli.subcommands": ["scan", "fix", "trend", "verify-evidence", "tls", "bin", "image", "aws", "gcp", "azure", "agents", "version"], "events.emitted": ["crypto_finding", "crypto_drift", "policy_violation", "evidence_signed"], diff --git a/docs/releases/v1.1.1.md b/docs/releases/v1.1.1.md new file mode 100644 index 0000000..c461682 --- /dev/null +++ b/docs/releases/v1.1.1.md @@ -0,0 +1,16 @@ +# Qryx 1.1.1 + +The `qryx` binaries and the image, `ghcr.io/taipanbox/qryx`, are built on Go 1.27.3. Go 1.27.3 fixes GO-2026-6809, a vulnerability in `crypto/x509`, and the 1.1.0 release was built on Go 1.27.2. Nothing else changes in behaviour: no finding, flag, exit status or file format moves, and no name `compat/1.0.json` freezes is removed or renamed. + +## Changed since 1.1.0 + +- #78, `build: Go 1.27.3 for GO-2026-6809 in crypto/x509`. The `go.mod` toolchain, the Go version of CI and of the release workflow, and the Dockerfile's Go version move to 1.27.3, and the gate anchors that named the old pin move with them. +- #77, `chore(deps): bump agent-stack-go to v2.0.1`. v2.0.1 changes no Go code: it is the agent-stack-go release whose own image is signed in the legacy format. `go.mod` and `go.sum` move to it and nothing else changes. + +No other commit lies between the 1.1.0 tag and this release. + +## Upgrade + +Pull `ghcr.io/taipanbox/qryx:v1.1.1` in place of `v1.1.0`, or download the binary for your platform from this release. No setting, stored state or wire format changes, so there is nothing to migrate. To roll back, run 1.1.0 again. + +Whether a given 1.1.0 binary reached the affected `crypto/x509` code was not measured. This release makes the question moot by moving the toolchain, and it is the way to close GO-2026-6809 in the published artifacts.