Consume qualified Brotli decoder fix in v0.9.21

.github/scripts/check-image-policies.sh

@@ -32,7 +32,7 @@ for binary in helm kubectl kubectl-service; do
       .Type == "gobinary" and (.Target | split("/") | last) == $binary
       and (.Packages | length > 0))' dist/kubectl-service.security-raw.json >/dev/null
 done
-bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a'
+bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19'
 mkdir -p dist/bundle-tools
 bundle_container=$(docker create "$bundle_image" unused)
 if docker cp "$bundle_container:/out/verify-consumer-evidence.py" dist/bundle-tools/verify-consumer-evidence.py && \
@@ -48,7 +48,7 @@ fi
 python3 dist/bundle-tools/verify-consumer-evidence.py \
     --evidence-dir dist/ubuntu-backports --sbom dist/kubectl-service.cdx.json \
     --bundle-checksums dist/bundle-tools/SHA256SUMS \
-    --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > dist/ubuntu-backports-validation.json
+    --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > dist/ubuntu-backports-validation.json
 tar -cf dist/ubuntu-backports-evidence.tar -C dist ubuntu-backports ubuntu-backports-validation.json
 python3 .github/scripts/enforce-runtime-vulnerabilities.py --phase runtime --repository "$GITHUB_REPOSITORY"
 run_scan fs --cache-dir /tmp/trivy-cache --skip-db-update --scanners secret --exit-code 1 /workspace

.github/workflows/security-release-gate.yml

@@ -24,7 +24,7 @@ jobs:
     env:
       DAPPER_IMAGE: pasturestack-kubectl-service-dapper:security-gate
       DAPPER_TRIVY_CACHE: /tmp/pasturestack-trivy-cache
-      VERSION_OVERRIDE: v0.9.20
+      VERSION_OVERRIDE: v0.9.21
     steps:
       - name: Check out the complete source history
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

README.md

@@ -1,6 +1,8 @@
 # PastureStack Kubectl Service
 
-Linux runtime **`v0.9.20`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+Linux runtime **`v0.9.21`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+
+The shared bundle includes the official Brotli decoder fix for CVE-2026-111497.
 
 The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`.
 
@@ -12,7 +14,7 @@ PastureStack is an independent community project and is not affiliated with
 Rancher Labs or SUSE. The repository preserves the history and Apache-2.0
 license of the upstream `rancher/kubectld` project.
 
-Select `ghcr.io/pasturestack/kubectl-service:v0.9.20` through the reviewed Catalog
+Select `ghcr.io/pasturestack/kubectl-service:v0.9.21` through the reviewed Catalog
 package. OCI labels, SBOM and release attestations bind the published bytes.
 
 ## Runtime contract
@@ -40,7 +42,7 @@ WebSocket, and `x/sys` are pinned by `go.mod` and `go.sum`.
 ```sh
 make test
 make validate
-make package IMAGE_NAME=local/pasturestack/kubectl-service TAG=v0.9.20
+make package IMAGE_NAME=local/pasturestack/kubectl-service TAG=v0.9.21
 ```
 
 Packaging verifies both source archives and licenses, the upstream Git commits,

package/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7
-FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports
+FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports
 FROM docker:29.7.2-cli@sha256:000bb62ff495f986c9f5578eb67cc2cb98b91138eda81d7762d5371eb8a497fe AS snapshot-ca-certificates
 
 FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS helm-builder
@@ -206,7 +206,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/
     for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \
         cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \
     done; \
-    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \
+    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \
     (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \
     dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
     . /licenses/ubuntu-apt.lock; \