mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 05:00:25 +00:00
Anso
57e2d98a62
* fix(docker): rebuild the Compose plugin from v5.6.0 The source-built Compose plugin moves from tag v5.1.3 to v5.6.0 (commit 42f48072). Its own go.mod resolves the module floors this stage used to carry by hand, otel/sdk v1.46.0, google.golang.org/grpc v1.84.0, moby/go-archive v0.3.3, moby/buildkit v0.33.1, and containerd/containerd/v2 v2.4.1, so the explicit go get list shrinks from twelve entries to three: golang.org/x/net v0.60.0, x/text v0.42.0, and x/crypto v0.57.0, which this tag still resolves below their fixed versions. The bump clears the two MEDIUM findings that remained in that binary (buildkit, and sigstore-go which this graph no longer contains) and drops github.com/docker/docker from the graph altogether. Five VEX statements that triaged docker/docker v28.5.2 as not_affected describe a module the built binary no longer links, and the in-toto-golang statement becomes a status: fixed record because v5.6.0 pulls v0.11.0, the version it was waiting for. Verified: the stage builds and the rebuilt plugin scans clean at MEDIUM and above against the database CI uses; its command surface, config and ps output shapes, and build fallback behavior match the previous tag on the same inputs; and a full compose lifecycle through the shipped CLI succeeds on a scratch stack. * chore(vex): name the shipped in-toto version in the resolution record An OpenVEX fixed statement describes the product version that carries the fix, so the statement for GHSA-pmwq-pjrm-6p5r now names github.com/in-toto/in-toto-golang v0.11.0 rather than the v0.10.0 build the Compose v5.6.0 tag replaced. The status note still records the version it supersedes.