Repository navigation
fix(deps): patch x/net and refresh all CLI-bearing companions - #868
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The published codefly 0.0.5 executable still embeds x/net 0.61.0, affected by GO-2026-6860 and GO-2026-6866. This refresh selects x/net 0.62.0, gRPC 1.85.0 and the safe external updates produced by
codefly update deps, and prepares Core 0.19.12 plus new versions of all six CLI-bearing companions.Classification: fix at the owners. Core owns these dependency and companion selections; the actual CLI executable is fixed in codefly-dev/cli#1212. Publish only after that CLI change merges, using this PR's exact merged Core SHA. Existing tags remain immutable.
New companions: codefly 0.0.6, execution 0.0.2, go 0.0.13, node 0.0.15, proto 0.0.20 and python 0.0.7. Their base relationships still come from
companions.BuildSpecs(). No protocol change is introduced by this PR.Docs:
docs/runbooks/publish-companions.mdrecords the findings, publication order and required binary/image verification.Validation:
codefly update deps --dir .completed successfully, including both module audits with the existing reviewed suppressions. The initial automatic kustomize update failed TestCoreModuleGraphStaysOnStructuredMergeDiffV6. Restored kustomize 0.21.1 and the held kube-openapi version through the CLI selective update command; the targeted guard passes without weakening it. Final full suite, cgo guard, version guard and vet all passed (exit 0); hosted image-build and CI gates must pass before merge. Publication, FastAPI adoption and NYL scans have not yet been verified for this set.