From 59d6ec20188285cfe0681a72844bc23826c385d8 Mon Sep 17 00:00:00 2001 From: Nathan Broadbent Date: Sat, 7 Nov 2026 09:16:14 +1300 Subject: [PATCH 1/2] fix(deps): take the compress, x/net and zlib security fixes - github.com/klauspost/compress 1.20.2 fixes GO-2026-6865. v1.20.2 is the narrow security release; v1.20.3 also rewrites parts of the zstd decoder. - golang.org/x/net 0.62.0 fixes CVE-2026-78661, which Trivy reports on the gateway binary by module version. The binary doesn't compile x/net/html. - alpine 3.24.3 has zlib 1.3.2-r1, which fixes CVE-2026-85091. It's the oldest base with the fix, so it also meets the 7-day rule. --- Dockerfile | 2 +- Dockerfile.gateway-dev | 2 +- Dockerfile.mock-convox | 2 +- go.mod | 4 ++-- go.sum | 8 ++++---- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Dockerfile b/Dockerfile index f7c80892..d3e3cfda 100644 --- a/Dockerfile +++ b/Dockerfile @@ -44,7 +44,7 @@ RUN VERSION=$(node -p "require('./web/package.json').version") && \ -o /out/rack-gateway-api ./cmd/gateway \ && /out/rack-gateway-api build-info -FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 +FROM alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a # ca-certificates for outbound TLS. No curl: the compose healthcheck uses busybox wget. # /app/certs is made here because COPY --chmod would give a directory it creates the file's mode, which leaves no diff --git a/Dockerfile.gateway-dev b/Dockerfile.gateway-dev index 2680f47c..1bae5956 100644 --- a/Dockerfile.gateway-dev +++ b/Dockerfile.gateway-dev @@ -21,7 +21,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \ CGO_ENABLED=0 go build -tags testbypass -o /out/rack-gateway-api ./cmd/gateway \ && /out/rack-gateway-api build-info -FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 +FROM alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a RUN apk --no-cache add ca-certificates diff --git a/Dockerfile.mock-convox b/Dockerfile.mock-convox index fd6ec073..be44f652 100644 --- a/Dockerfile.mock-convox +++ b/Dockerfile.mock-convox @@ -26,7 +26,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \ && /out/mock-convox help # Final stage -FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 +FROM alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a RUN apk --no-cache add ca-certificates diff --git a/go.mod b/go.mod index fc69c080..83a86c53 100644 --- a/go.mod +++ b/go.mod @@ -201,7 +201,7 @@ require ( github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kedacore/keda/v2 v2.21.0 // indirect - github.com/klauspost/compress v1.20.1 // indirect + github.com/klauspost/compress v1.20.2 // indirect github.com/klauspost/cpuid/v2 v2.4.1 // indirect github.com/leodido/go-urn v1.5.0 // indirect github.com/letsencrypt/boulder v0.20260309.0 // indirect @@ -287,7 +287,7 @@ require ( go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/arch v0.32.0 // indirect golang.org/x/crypto v0.58.0 // indirect - golang.org/x/net v0.61.0 // indirect + golang.org/x/net v0.62.0 // indirect golang.org/x/text v0.43.0 // indirect golang.org/x/tools v0.52.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect diff --git a/go.sum b/go.sum index 2b38a5fc..75aee286 100644 --- a/go.sum +++ b/go.sum @@ -512,8 +512,8 @@ github.com/keys-pub/go-libfido2 v1.5.4-0.20250104233141-2534349bd685 h1:zSJ+Njvd github.com/keys-pub/go-libfido2 v1.5.4-0.20250104233141-2534349bd685/go.mod h1:92J9LtSBl0UyUWljElJpTbMMNhC6VeY8dshsu40qjjo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ= -github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= +github.com/klauspost/compress v1.20.2 h1:v5tiZvm1KGLyg5d5oXdXe3lsSPrbEUiKoXGia//I7Qo= +github.com/klauspost/compress v1.20.2/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U= github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= @@ -846,8 +846,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= -golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= From 56e92c627d4a9dfdc00f072a46345047f9031318 Mon Sep 17 00:00:00 2001 From: Nathan Broadbent Date: Sat, 7 Nov 2026 09:16:15 +1300 Subject: [PATCH 2/2] chore: bump version to v0.1.32 --- convox.yml | 4 ++-- web/package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/convox.yml b/convox.yml index 61a4c784..7c241f18 100644 --- a/convox.yml +++ b/convox.yml @@ -30,7 +30,7 @@ services: # Pinned to an immutable release tag. scripts/bump-version.sh sets it to the new # version (:vX.Y.Z); the release workflow publishes that tag when the v* git tag is pushed. # :e327add is the v0.1.1 release (identical to :latest when this was pinned). - image: docker.io/docspringcom/rack-gateway:v0.1.31 + image: docker.io/docspringcom/rack-gateway:v0.1.32 command: ./scripts/start-gateway.sh environment: - PORT=8080 @@ -54,7 +54,7 @@ services: admin: # Uses same image as gateway service (kept in sync by scripts/bump-version.sh) - image: docker.io/docspringcom/rack-gateway:v0.1.31 + image: docker.io/docspringcom/rack-gateway:v0.1.32 command: echo "Use this service to run migrations, database admin tasks, etc." environment: - PORT=8080 diff --git a/web/package.json b/web/package.json index 8ceb8cd3..1230100b 100644 --- a/web/package.json +++ b/web/package.json @@ -1,6 +1,6 @@ { "name": "web", - "version": "0.1.31", + "version": "0.1.32", "private": true, "type": "module", "scripts": {