From 19acf32750b4f03fc925b020c9c31cb1e8336084 Mon Sep 17 00:00:00 2001 From: "rootform-contribution-delivery[bot]" <339145970+rootform-contribution-delivery[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 04:33:08 +0000 Subject: [PATCH] chore(engine): pin engine de7c23b27fe3 --- CHANGELOG.md | 2 ++ THIRD_PARTY_NOTICES.txt | 42 ++++++++++++++-------------- dependencies/runtime-components.json | 14 +++++----- public-export.json | 6 ++-- 4 files changed, 33 insertions(+), 31 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dc271a5..273b32a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +- Rootform is built with Go 1.26.9 and golang.org/x/net 0.61.0, which fix denial-of-service vulnerabilities in HTTP and TLS handling (CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031). + ## 0.2.1 - The AWS Dialect presents AWS resources with the official AWS Architecture diff --git a/THIRD_PARTY_NOTICES.txt b/THIRD_PARTY_NOTICES.txt index 7616529..811b8f2 100644 --- a/THIRD_PARTY_NOTICES.txt +++ b/THIRD_PARTY_NOTICES.txt @@ -3582,7 +3582,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ----- END LICENSE TEXT: go.lsp.dev/uri@v1.0.1 ----- -go-module: golang.org/x/mod@v0.38.0 +go-module: golang.org/x/mod@v0.41.0 ----------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3590,7 +3590,7 @@ Upstream: https://golang.org/x/mod Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/mod@v0.38.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/mod@v0.41.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3618,10 +3618,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/mod@v0.38.0 ----- +----- END LICENSE TEXT: golang.org/x/mod@v0.41.0 ----- -go-module: golang.org/x/net@v0.58.0 +go-module: golang.org/x/net@v0.61.0 ----------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3629,7 +3629,7 @@ Upstream: https://golang.org/x/net Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/net@v0.58.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/net@v0.61.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3657,10 +3657,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/net@v0.58.0 ----- +----- END LICENSE TEXT: golang.org/x/net@v0.61.0 ----- -go-module: golang.org/x/sync@v0.22.0 +go-module: golang.org/x/sync@v0.24.0 ------------------------------------ Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3668,7 +3668,7 @@ Upstream: https://golang.org/x/sync Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/sync@v0.22.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/sync@v0.24.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3696,10 +3696,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/sync@v0.22.0 ----- +----- END LICENSE TEXT: golang.org/x/sync@v0.24.0 ----- -go-module: golang.org/x/text@v0.41.0 +go-module: golang.org/x/text@v0.43.0 ------------------------------------ Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3707,7 +3707,7 @@ Upstream: https://golang.org/x/text Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/text@v0.41.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/text@v0.43.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3735,10 +3735,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/text@v0.41.0 ----- +----- END LICENSE TEXT: golang.org/x/text@v0.43.0 ----- -go-module: golang.org/x/tools@v0.48.0 +go-module: golang.org/x/tools@v0.51.0 ------------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3746,7 +3746,7 @@ Upstream: https://golang.org/x/tools Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/tools@v0.48.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/tools@v0.51.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3774,7 +3774,7 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/tools@v0.48.0 ----- +----- END LICENSE TEXT: golang.org/x/tools@v0.51.0 ----- go-module: oras.land/oras-go/v2@v2.6.2 @@ -3990,16 +3990,16 @@ License text SHA-256: eccb04b94c71454ea03f00ecb518b997952c4f2f23aca50baab98230f5 ----- END LICENSE TEXT: oras.land/oras-go/v2@v2.6.2 ----- -go-runtime: Go standard library@go1.26.7 +go-runtime: Go standard library@go1.26.9 ---------------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause -Upstream: https://go.googlesource.com/go/+/refs/tags/go1.26.7 +Upstream: https://go.googlesource.com/go/+/refs/tags/go1.26.9 Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad Notice text SHA-256: 96f408bfae65bf137fc2525d3ecb030271c50c1e90799f87abf8846d8dd505cc ------ BEGIN LICENSE TEXT: Go standard library@go1.26.7 ----- +----- BEGIN LICENSE TEXT: Go standard library@go1.26.9 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -4027,9 +4027,9 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: Go standard library@go1.26.7 ----- +----- END LICENSE TEXT: Go standard library@go1.26.9 ----- ------ BEGIN NOTICE TEXT: Go standard library@go1.26.7 ----- +----- BEGIN NOTICE TEXT: Go standard library@go1.26.9 ----- Additional IP Rights Grant (Patents) "This implementation" means the copyrightable works distributed by @@ -4052,7 +4052,7 @@ implementation of Go constitutes direct or contributory patent infringement, or inducement of patent infringement, then any patent rights granted to you under this License for this implementation of Go shall terminate as of the date such litigation is filed. ------ END NOTICE TEXT: Go standard library@go1.26.7 ----- +----- END NOTICE TEXT: Go standard library@go1.26.9 ----- Embedded renderer notices diff --git a/dependencies/runtime-components.json b/dependencies/runtime-components.json index 15c1f33..2a5fa6b 100644 --- a/dependencies/runtime-components.json +++ b/dependencies/runtime-components.json @@ -312,7 +312,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/mod", "upstream": "https://golang.org/x/mod", - "version": "v0.38.0" + "version": "v0.41.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -322,7 +322,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/net", "upstream": "https://golang.org/x/net", - "version": "v0.58.0" + "version": "v0.61.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -332,7 +332,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/sync", "upstream": "https://golang.org/x/sync", - "version": "v0.22.0" + "version": "v0.24.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -342,7 +342,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/text", "upstream": "https://golang.org/x/text", - "version": "v0.41.0" + "version": "v0.43.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -352,7 +352,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/tools", "upstream": "https://golang.org/x/tools", - "version": "v0.48.0" + "version": "v0.51.0" }, { "copyright_text": "(c) You must retain, in the Source form of any Derivative Works; Copyright 2021 ORAS Authors.", @@ -372,8 +372,8 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "Go standard library", "notice_text_sha256": "96f408bfae65bf137fc2525d3ecb030271c50c1e90799f87abf8846d8dd505cc", - "upstream": "https://go.googlesource.com/go/+/refs/tags/go1.26.7", - "version": "go1.26.7" + "upstream": "https://go.googlesource.com/go/+/refs/tags/go1.26.9", + "version": "go1.26.9" }, { "copyright_text": "Copyright (c) 2023 Hunter Johnston ; Copyright (c) 2023 CokaKoala ; Copyright (c) 2023 shadcn", diff --git a/public-export.json b/public-export.json index 40084be..e02d86a 100644 --- a/public-export.json +++ b/public-export.json @@ -2,7 +2,7 @@ "files": [ { "path": "dependencies/runtime-components.json", - "sha256": "f7f5d8b1b42a4ba482493c47737549acd122aef80b6e0f100a346f3b843a1da0" + "sha256": "bb397a6fa55a99ac86bfea991bd9e1a9a1373278b1ada37dfacc25e17ca53e9b" }, { "path": "schemas/compiled-policy-pack.schema.json", @@ -14,10 +14,10 @@ }, { "path": "THIRD_PARTY_NOTICES.txt", - "sha256": "9184103a7af89b1682fbf416e7d33ae7aeaf0dd4c9923d8b18004506b9d78ee6" + "sha256": "c57f4f7975a62d1f24d5d9e1f95a9e4a0ac82c80136f73d871d0fe7c8fce3262" } ], "format_version": "1", - "source_commit": "e697b5fe84a3b377ba2d8a209e40046f8660f70b", + "source_commit": "de7c23b27fe34e9e8e2a97dd77b016078fd72421", "source_repository": "rootform-dev/engine" }