diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fcd4a579fd..d82bd615dc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -96,6 +96,14 @@ updates: - "version-update:semver-major" - "version-update:semver-minor" - "version-update:semver-patch" + # TypeScript majors must land with the lint toolchain: + # @typescript-eslint/eslint-plugin@8.70.0, @typescript-eslint/parser@8.70.0 + # and typescript-eslint@8.70.0 each declare a peer dependency of + # "typescript": ">=4.8.4 <6.1.0". Keep TypeScript majors as explicit work + # rather than opening proposals the checked-in toolchain cannot build. + - dependency-name: "typescript" + update-types: + - "version-update:semver-major" - package-ecosystem: "docker" directories: diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 9b6a318bd3..ef91b37424 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -5619,3 +5619,44 @@ covers the recorded snapshot and its removal. Local shell suites (`test-pulse-auto-update.sh`, `test-install-update-resilience.sh`, `test-script-reference-integrity.sh`) pass; hosted Go installtest execution remains required and is not claimed here. + +### Governed dependency floors for the go-minor-patch group + +The managed `go-minor-patch` group advances three direct modules together with +their required transitives: `golang.org/x/crypto` 0.56.0 -> 0.57.0, +`golang.org/x/term` 0.45.0 -> 0.46.0 and `modernc.org/sqlite` 1.53.0 -> 1.59.0 +(which pins `modernc.org/libc` 1.75.7, `modernc.org/memory` 1.12.1 and +`golang.org/x/text` 0.42.0). No other direct version changes. The pure-Go SQLite +driver is the storage engine for the metrics, alert and audit stores, so the +1.59.0 release carries the upstream journal-rollback data-corruption fix and the +native-libc re-vendor that changes query CPU cost; the `modernc.org/libc` floor +must move with it because the driver requires the same pinned version. + +This is routine managed dependency maintenance and is independent of the +6 September 2026 SQLite SIGSEGV investigation exclusion: no crash is reproduced, +no database or executable is inspected, and no adverse evidence from that +investigation is cleared or relied upon here. + +The dev-runtime dependency-manifest floor proof now covers these modules. +`scripts/tests/test-hot-dev-runtime.sh` raises the `golang.org/x/crypto` floor to +v0.57.0, adds a `golang.org/x/term` floor of v0.46.0 and adds a +`test_go_storage_dependency_integrity_floor` case asserting +`modernc.org/sqlite` >= v1.59.0 and `modernc.org/libc` >= v1.75.7. These are +floors, not pins, so a later safe upgrade keeps passing while a downgrade below +the qualified release fails. The managed-backend manifest-invalidation fixtures +in `tests/integration/scripts/managed-local-backend.test.mjs` already prove that a +`go.mod`- or `go.sum`-only change rebuilds a stale backend binary. + +The Build and Test benchmark job reports a `NormalizeSegment` sec/op delta for +this batch. That is a code-layout/measurement artifact, not a product +regression: `normalizeSegment` is a pure function with no dependency calls, and +its caller-level benchmarks do not corroborate it (`NormalizeRoute` improved and +`FullMiddlewarePath` changed within its variance). The benchmark gate is +advisory for source landing; no threshold was changed and the failed advisory +result is preserved. + +Verification status: the exact-source Go build and package tests require the +offline dependency snapshot for the updated lockfile, which is not present in +the current assignment; a host dependency acquisition on the next launch is +required before this contract's Go evidence can be produced. No passing Go +suite, installed build or release acceptance is claimed here. diff --git a/go.mod b/go.mod index 8eb391d9b2..01846ea4ae 100644 --- a/go.mod +++ b/go.mod @@ -29,16 +29,16 @@ require ( github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 github.com/stripe/stripe-go/v82 v82.5.1 - golang.org/x/crypto v0.56.0 + golang.org/x/crypto v0.57.0 golang.org/x/oauth2 v0.37.0 golang.org/x/sync v0.23.0 golang.org/x/sys v0.48.0 - golang.org/x/term v0.45.0 + golang.org/x/term v0.46.0 gopkg.in/yaml.v3 v3.0.1 k8s.io/api v0.37.0 k8s.io/apimachinery v0.37.0 k8s.io/client-go v0.37.0 - modernc.org/sqlite v1.53.0 + modernc.org/sqlite v1.59.0 ) require ( @@ -77,14 +77,12 @@ require ( github.com/google/gnostic-models v0.7.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jonboulle/clockwork v0.5.0 // indirect - github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect - github.com/mailru/easyjson v0.7.7 // indirect github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mattn/go-isatty v0.0.24 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect @@ -92,7 +90,6 @@ require ( github.com/ncruces/go-strftime v1.0.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/prometheus/procfs v0.21.1 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect @@ -111,7 +108,7 @@ require ( go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/net v0.58.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/text v0.42.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect @@ -119,9 +116,9 @@ require ( k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect - modernc.org/libc v1.73.4 // indirect + modernc.org/libc v1.75.7 // indirect modernc.org/mathutil v1.7.1 // indirect - modernc.org/memory v1.11.0 // indirect + modernc.org/memory v1.12.1 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect diff --git a/go.sum b/go.sum index b768e5d944..dabc80e2e4 100644 --- a/go.sum +++ b/go.sum @@ -75,6 +75,8 @@ github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzr github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU= github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY= github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE= github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA= @@ -89,6 +91,10 @@ github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71U github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA= github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo= +github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0= +github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo= +github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug= +github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= github.com/go-pdf/fpdf v0.9.0 h1:PPvSaUuo1iMi9KkaAn90NuKi+P4gwMedWPHhj8YlJQw= github.com/go-pdf/fpdf v0.9.0/go.mod h1:oO8N111TkmKb9D7VvWGLvLJlaZUQVPM+6V42pp3iV4Y= github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= @@ -103,6 +109,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs= github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= +github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo= +github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo= @@ -144,6 +152,8 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= +github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ= @@ -211,9 +221,9 @@ github.com/shirou/gopsutil/v4 v4.26.8 h1:YQMTF/1J50B5+Y0vlo1eDRf5DoR7Gk69hY+8wjY github.com/shirou/gopsutil/v4 v4.26.8/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= @@ -221,15 +231,15 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= -github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/stripe/stripe-go/v82 v82.5.1 h1:05q6ZDKoe8PLMpQV072obF74HCgP4XJeJYoNuRSX2+8= github.com/stripe/stripe-go/v82 v82.5.1/go.mod h1:majCQX6AfObAvJiHraPi/5udwHi4ojRvJnnxckvHrX8= github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA= @@ -266,8 +276,12 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= @@ -283,25 +297,31 @@ golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= -google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= @@ -341,28 +361,40 @@ k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI0 k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c= modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI= +modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8= +modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI= modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws= modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE= +modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w= +modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I= modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM= modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU= modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI= modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito= modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc= modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY= +modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc= +modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY= modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks= modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI= modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA= modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8= +modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew= +modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ= modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU= modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg= modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI= modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw= +modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g= +modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw= modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg= modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns= modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w= modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE= modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M= modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s= +modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A= +modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k= modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 8c2678b9aa..4417d5955b 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -1142,6 +1142,7 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { t.Skip("current release is not a stable patch release") } releaseBranch := requiredReleaseBranchForVersion(t, version) + promotedTag, rcDerived := currentStablePatchPromotedPrerelease(t, version) releaseNotesPath := repoFile("docs", "releases", "RELEASE_NOTES_v"+version+".md") changelogPath := repoFile("docs", "releases", "V6_CHANGELOG_v"+version+".md") @@ -1152,17 +1153,30 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { "## What's improved", "not Authenticode-signed", "Unknown Publisher warning", - "This patch does not require a companion mobile release", + "does not require a companion mobile release", "rollback target is stable `v"+previous+"`", ) - assertFileContainsAllNormalized(t, changelogPath, + changelogRequired := make([]string, 0, 7) + changelogRequired = append(changelogRequired, "Version: `v"+version+"`", "Rollback target: `v"+previous+"`", - "Promotion path: emergency stable patch from `"+releaseBranch+"`", "Windows signing decision: the standing SignPath-unavailable policy publishes unsigned Windows Unified Agent binaries", "Unknown Publisher warning", "Mobile decision: `no-mobile-impact`", ) + if rcDerived { + // A stable patch with a same-version RC promotes the exercised + // candidate; the promotion resolver refuses the emergency no-RC path. + changelogRequired = append(changelogRequired, + "Promoted prerelease: `"+promotedTag+"`", + "Promotion path: exact-SHA single-build release candidate from `"+releaseBranch+"`", + ) + } else { + changelogRequired = append(changelogRequired, + "Promotion path: emergency stable patch from `"+releaseBranch+"`", + ) + } + assertFileContainsAllNormalized(t, changelogPath, changelogRequired...) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), "docs/releases/RELEASE_NOTES_v"+version+".md", "docs/releases/V6_CHANGELOG_v"+version+".md", @@ -1188,11 +1202,20 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"), `CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`, ) - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md") + installabilityRequired := make([]string, 0, 3) + installabilityRequired = append(installabilityRequired, "The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", - "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", "For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`", ) + if rcDerived { + installabilityRequired = append(installabilityRequired, "promoted_from_tag="+promotedTag) + } else { + installabilityRequired = append(installabilityRequired, + "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", + ) + } + assertFileContainsAllNormalized(t, installabilityPath, installabilityRequired...) } func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) { diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 1a55fb1289..fbd793a340 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -41,13 +41,20 @@ func isPrereleaseVersion(version string) bool { return strings.Contains(version, "-") } -// unpublishedStableVersions lists stable versions whose tag and packet exist in -// the repository but which never activated as a public GitHub release. They are -// not valid rollback targets and must not be treated as the previous stable. +// unpublishedStableVersions lists stable versions that never activated as a +// public GitHub release, whether or not a same-version tag or packet was +// staged. They are not valid rollback targets and must not be treated as the +// previous stable. var unpublishedStableVersions = map[string]bool{ // Tagged 2026-08-31; the private Pro build failed its memory gate and the // release commit verdict failed, so the packet shipped through v6.4.3 instead. "6.4.2": true, + // v6.4.3 and v6.4.4 were only ever published as prereleases + // (v6.4.3-rc.1, v6.4.4-beta.N). The v6.4.5 stable patch promotes the + // exercised v6.4.5-rc.N candidate, so the last published stable remains + // v6.4.1 and is the rollback target. + "6.4.3": true, + "6.4.4": true, } func previousStablePatchVersion(version string) (string, bool) { @@ -72,6 +79,50 @@ func previousStablePatchVersion(version string) (string, bool) { return "", false } +// stablePatchPromotedPrerelease reports the same-version release candidate a +// stable patch promotes, if one exists. A stable patch with a same-version RC +// is RC-derived: the promotion resolver selects promotion_mode +// "stable-rc-promotion" and refuses the emergency no-RC hotfix path, so the +// install-metadata contract must assert that shape instead of the emergency +// one. Detection reads the published candidate notes so it stays offline and +// matches the release line's retained metadata. +func stablePatchPromotedPrerelease(docsReleasesDir, version string) (string, bool) { + if isPrereleaseVersion(version) { + return "", false + } + matches, err := filepath.Glob(filepath.Join(docsReleasesDir, "RELEASE_NOTES_v"+version+"-rc.*.md")) + if err != nil { + return "", false + } + best := "" + bestNumber := -1 + for _, match := range matches { + filename := filepath.Base(match) + tag := strings.TrimSuffix(strings.TrimPrefix(filename, "RELEASE_NOTES_v"), ".md") + marker := strings.LastIndex(tag, "-rc.") + if marker < 0 { + continue + } + number, err := strconv.Atoi(tag[marker+len("-rc."):]) + if err != nil { + continue + } + if number > bestNumber { + bestNumber = number + best = "v" + tag + } + } + if best == "" { + return "", false + } + return best, true +} + +func currentStablePatchPromotedPrerelease(t *testing.T, version string) (string, bool) { + t.Helper() + return stablePatchPromotedPrerelease(repoFile("docs", "releases"), version) +} + func previousStableForPrereleaseVersion(version string) (string, bool) { if !isPrereleaseVersion(version) { return "", false @@ -185,6 +236,53 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T) } } +func TestPreviousStablePatchVersionSkipsUnpublishedStables(t *testing.T) { + tests := []struct { + version string + want string + ok bool + }{ + {version: "6.4.1", want: "6.4.0", ok: true}, + {version: "6.4.2", want: "6.4.1", ok: true}, + // v6.4.2 was tagged but never published; v6.4.3 and v6.4.4 only ever + // shipped as prereleases, so v6.4.5 rolls back to the published v6.4.1. + {version: "6.4.5", want: "6.4.1", ok: true}, + {version: "6.4.0", ok: false}, + {version: "6.4.5-rc.2", ok: false}, + } + for _, test := range tests { + t.Run(test.version, func(t *testing.T) { + got, ok := previousStablePatchVersion(test.version) + if ok != test.ok || got != test.want { + t.Fatalf("previousStablePatchVersion(%q) = %q, %v; want %q, %v", test.version, got, ok, test.want, test.ok) + } + }) + } +} + +func TestStablePatchPromotedPrereleaseDetectsSameVersionCandidate(t *testing.T) { + dir := t.TempDir() + for _, name := range []string{ + "RELEASE_NOTES_v6.4.5-rc.1.md", + "RELEASE_NOTES_v6.4.5-rc.2.md", + "RELEASE_NOTES_v6.4.4-beta.4.md", + "RELEASE_NOTES_v6.4.5-beta.1.md", + } { + if err := os.WriteFile(filepath.Join(dir, name), []byte("x"), 0o600); err != nil { + t.Fatalf("write %s: %v", name, err) + } + } + if got, ok := stablePatchPromotedPrerelease(dir, "6.4.5"); !ok || got != "v6.4.5-rc.2" { + t.Fatalf("stablePatchPromotedPrerelease(6.4.5) = %q, %v; want v6.4.5-rc.2, true", got, ok) + } + if got, ok := stablePatchPromotedPrerelease(dir, "6.4.6"); ok { + t.Fatalf("stablePatchPromotedPrerelease(6.4.6) = %q, true; want no same-version candidate", got) + } + if got, ok := stablePatchPromotedPrerelease(dir, "6.4.5-rc.2"); ok { + t.Fatalf("stablePatchPromotedPrerelease(6.4.5-rc.2) = %q, true; want prerelease ignored", got) + } +} + func previousPrereleaseVersion(version string) (string, bool) { base, suffix, ok := strings.Cut(version, "-rc.") if !ok { @@ -325,28 +423,42 @@ func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) { if !ok { t.Skip("current release is not a stable patch release") } + promotedTag, rcDerived := currentStablePatchPromotedPrerelease(t, version) + installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md") - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + required := make([]string, 0, 5) + required = append(required, "The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", - "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", - "active customer harm", "`no-mobile-impact`", "For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`", ) + if rcDerived { + // An RC-derived stable patch promotes the exercised same-version + // candidate, so the active-stable paragraph names the promoted tag + // instead of the emergency no-RC hotfix path. + required = append(required, "promoted_from_tag="+promotedTag) + } else { + required = append(required, + "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", + "active customer harm", + ) + } + assertFileContainsAllNormalized(t, installabilityPath, required...) + if version == "6.3.1" { - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + assertFileContainsAllNormalized(t, installabilityPath, "the prior `v"+previous+"` decision could not be reused for this patch", "the release owner recorded that separate `v6.3.1` exception", "public Unknown Publisher disclosure", ) - } else { - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + } else if !rcDerived { + assertFileContainsAllNormalized(t, installabilityPath, "standing SignPath-unavailable policy from `v6.3.2` onward", "Public Unknown Publisher disclosure", ) } if version == "6.4.2" { - assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), + assertFileContainsAllNormalized(t, installabilityPath, "The governed branch is `main`", "authenticated non-administrator organization members can reach infrastructure action control", "SSO-only deployments can treat every authenticated IdP user as an instance administrator without an explicit grant", diff --git a/scripts/tests/test-hot-dev-runtime.sh b/scripts/tests/test-hot-dev-runtime.sh index 6f6fa6dda9..f3b2b548a2 100755 --- a/scripts/tests/test-hot-dev-runtime.sh +++ b/scripts/tests/test-hot-dev-runtime.sh @@ -352,13 +352,26 @@ assert_module_at_least() { test_go_module_security_dependency_floors() { local output - output="$(cd "${ROOT_DIR}" && go list -m golang.org/x/net golang.org/x/crypto golang.org/x/sys)" + output="$(cd "${ROOT_DIR}" && go list -m golang.org/x/net golang.org/x/crypto golang.org/x/term golang.org/x/sys)" assert_module_at_least "Go module floor keeps x/net past restricted-outbound advisories" "${output}" "golang.org/x/net" "v0.56.0" - assert_module_at_least "Go module floor excludes SSH connection deadlock advisories" "${output}" "golang.org/x/crypto" "v0.56.0" + assert_module_at_least "Go module floor excludes SSH connection deadlock advisories" "${output}" "golang.org/x/crypto" "v0.57.0" + assert_module_at_least "Go module floor keeps x/term past the read-error handling release" "${output}" "golang.org/x/term" "v0.46.0" assert_module_at_least "Go module floor keeps x/sys aligned with security module graph" "${output}" "golang.org/x/sys" "v0.47.0" } +# The metrics and alerting stores run on the pure-Go SQLite driver, so a +# downgrade past the qualified storage release would silently drop the +# upstream journal-rollback corruption fix. Keep the driver and the libc +# version it requires aligned as floors, not pins. +test_go_storage_dependency_integrity_floor() { + local output + output="$(cd "${ROOT_DIR}" && go list -m modernc.org/sqlite modernc.org/libc)" + + assert_module_at_least "Go storage floor keeps sqlite past the journal-rollback corruption fix" "${output}" "modernc.org/sqlite" "v1.59.0" + assert_module_at_least "Go storage floor keeps libc aligned with the pinned sqlite driver" "${output}" "modernc.org/libc" "v1.75.7" +} + # Kubernetes publishes these generated APIs as a coordinated release. A grouped # update must not leave the native agent compiling against mixed minor versions. kubernetes_module_cohort_is_aligned() { @@ -427,6 +440,7 @@ test_hot_dev_lab_agent_mode_enables_lan_and_guest_docker_inventory_defaults test_hot_dev_remembers_explicit_lab_agent_mode_for_later_managed_starts test_hot_dev_browser_urls_distinguish_bind_and_browser_hosts test_go_module_security_dependency_floors +test_go_storage_dependency_integrity_floor test_go_kubernetes_module_cohort test_go_release_toolchain_floor test_backend_race_suite_keeps_hosted_runner_timeout_headroom diff --git a/scripts/tests/test_dependabot_config.py b/scripts/tests/test_dependabot_config.py index ce8b6a1802..2052a3af9b 100644 --- a/scripts/tests/test_dependabot_config.py +++ b/scripts/tests/test_dependabot_config.py @@ -148,9 +148,16 @@ class DependabotConfigTest(unittest.TestCase): } self.assertEqual( set(ignored), - {"playwright", "playwright-core", "@playwright/test"}, + {"playwright", "playwright-core", "@playwright/test", "typescript"}, + ) + for browser_runtime in ("playwright", "playwright-core", "@playwright/test"): + self.assertEqual(ignored[browser_runtime], all_semver) + # TypeScript majors must land with the @typescript-eslint peer range + # (">=4.8.4 <6.1.0"), so keep them as explicit work. + self.assertEqual( + ignored["typescript"], + {"version-update:semver-major"}, ) - self.assertTrue(all(types == all_semver for types in ignored.values())) def test_weekly_scan_covers_the_same_lockfiles(self) -> None: workflow = yaml.safe_load(SECURITY_SCAN.read_text(encoding="utf-8"))