diff --git a/CHANGELOG.md b/CHANGELOG.md index dc271a5..d7e0f32 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,9 @@ the Inspector. - In planned changes and comparisons, a container without a change of its own shows a compact tally of the changes it holds, by kind of change. +- Rootform is built with Go 1.26.9 and golang.org/x/net 0.61.0, which fix + denial-of-service vulnerabilities in HTTP and TLS handling (CVE-2026-78667, + CVE-2026-78669 and CVE-2026-97031). ## 0.2.0 diff --git a/THIRD_PARTY_NOTICES.txt b/THIRD_PARTY_NOTICES.txt index 7616529..811b8f2 100644 --- a/THIRD_PARTY_NOTICES.txt +++ b/THIRD_PARTY_NOTICES.txt @@ -3582,7 +3582,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ----- END LICENSE TEXT: go.lsp.dev/uri@v1.0.1 ----- -go-module: golang.org/x/mod@v0.38.0 +go-module: golang.org/x/mod@v0.41.0 ----------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3590,7 +3590,7 @@ Upstream: https://golang.org/x/mod Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/mod@v0.38.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/mod@v0.41.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3618,10 +3618,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/mod@v0.38.0 ----- +----- END LICENSE TEXT: golang.org/x/mod@v0.41.0 ----- -go-module: golang.org/x/net@v0.58.0 +go-module: golang.org/x/net@v0.61.0 ----------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3629,7 +3629,7 @@ Upstream: https://golang.org/x/net Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/net@v0.58.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/net@v0.61.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3657,10 +3657,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/net@v0.58.0 ----- +----- END LICENSE TEXT: golang.org/x/net@v0.61.0 ----- -go-module: golang.org/x/sync@v0.22.0 +go-module: golang.org/x/sync@v0.24.0 ------------------------------------ Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3668,7 +3668,7 @@ Upstream: https://golang.org/x/sync Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/sync@v0.22.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/sync@v0.24.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3696,10 +3696,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/sync@v0.22.0 ----- +----- END LICENSE TEXT: golang.org/x/sync@v0.24.0 ----- -go-module: golang.org/x/text@v0.41.0 +go-module: golang.org/x/text@v0.43.0 ------------------------------------ Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3707,7 +3707,7 @@ Upstream: https://golang.org/x/text Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/text@v0.41.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/text@v0.43.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3735,10 +3735,10 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/text@v0.41.0 ----- +----- END LICENSE TEXT: golang.org/x/text@v0.43.0 ----- -go-module: golang.org/x/tools@v0.48.0 +go-module: golang.org/x/tools@v0.51.0 ------------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause @@ -3746,7 +3746,7 @@ Upstream: https://golang.org/x/tools Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad ------ BEGIN LICENSE TEXT: golang.org/x/tools@v0.48.0 ----- +----- BEGIN LICENSE TEXT: golang.org/x/tools@v0.51.0 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -3774,7 +3774,7 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: golang.org/x/tools@v0.48.0 ----- +----- END LICENSE TEXT: golang.org/x/tools@v0.51.0 ----- go-module: oras.land/oras-go/v2@v2.6.2 @@ -3990,16 +3990,16 @@ License text SHA-256: eccb04b94c71454ea03f00ecb518b997952c4f2f23aca50baab98230f5 ----- END LICENSE TEXT: oras.land/oras-go/v2@v2.6.2 ----- -go-runtime: Go standard library@go1.26.7 +go-runtime: Go standard library@go1.26.9 ---------------------------------------- Declared license: BSD-3-Clause Concluded license: BSD-3-Clause -Upstream: https://go.googlesource.com/go/+/refs/tags/go1.26.7 +Upstream: https://go.googlesource.com/go/+/refs/tags/go1.26.9 Copyright: Copyright 2009 The Go Authors. License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad Notice text SHA-256: 96f408bfae65bf137fc2525d3ecb030271c50c1e90799f87abf8846d8dd505cc ------ BEGIN LICENSE TEXT: Go standard library@go1.26.7 ----- +----- BEGIN LICENSE TEXT: Go standard library@go1.26.9 ----- Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without @@ -4027,9 +4027,9 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ------ END LICENSE TEXT: Go standard library@go1.26.7 ----- +----- END LICENSE TEXT: Go standard library@go1.26.9 ----- ------ BEGIN NOTICE TEXT: Go standard library@go1.26.7 ----- +----- BEGIN NOTICE TEXT: Go standard library@go1.26.9 ----- Additional IP Rights Grant (Patents) "This implementation" means the copyrightable works distributed by @@ -4052,7 +4052,7 @@ implementation of Go constitutes direct or contributory patent infringement, or inducement of patent infringement, then any patent rights granted to you under this License for this implementation of Go shall terminate as of the date such litigation is filed. ------ END NOTICE TEXT: Go standard library@go1.26.7 ----- +----- END NOTICE TEXT: Go standard library@go1.26.9 ----- Embedded renderer notices diff --git a/dependencies/runtime-components.json b/dependencies/runtime-components.json index 15c1f33..2a5fa6b 100644 --- a/dependencies/runtime-components.json +++ b/dependencies/runtime-components.json @@ -312,7 +312,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/mod", "upstream": "https://golang.org/x/mod", - "version": "v0.38.0" + "version": "v0.41.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -322,7 +322,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/net", "upstream": "https://golang.org/x/net", - "version": "v0.58.0" + "version": "v0.61.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -332,7 +332,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/sync", "upstream": "https://golang.org/x/sync", - "version": "v0.22.0" + "version": "v0.24.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -342,7 +342,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/text", "upstream": "https://golang.org/x/text", - "version": "v0.41.0" + "version": "v0.43.0" }, { "copyright_text": "Copyright 2009 The Go Authors.", @@ -352,7 +352,7 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "golang.org/x/tools", "upstream": "https://golang.org/x/tools", - "version": "v0.48.0" + "version": "v0.51.0" }, { "copyright_text": "(c) You must retain, in the Source form of any Derivative Works; Copyright 2021 ORAS Authors.", @@ -372,8 +372,8 @@ "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad", "name": "Go standard library", "notice_text_sha256": "96f408bfae65bf137fc2525d3ecb030271c50c1e90799f87abf8846d8dd505cc", - "upstream": "https://go.googlesource.com/go/+/refs/tags/go1.26.7", - "version": "go1.26.7" + "upstream": "https://go.googlesource.com/go/+/refs/tags/go1.26.9", + "version": "go1.26.9" }, { "copyright_text": "Copyright (c) 2023 Hunter Johnston ; Copyright (c) 2023 CokaKoala ; Copyright (c) 2023 shadcn", diff --git a/examples/playground/forms/manifest.json b/examples/playground/forms/manifest.json index 631f282..a688c8c 100644 --- a/examples/playground/forms/manifest.json +++ b/examples/playground/forms/manifest.json @@ -2,7 +2,7 @@ "format_version": "1", "binary": { "version": "rootform 0.2.1", - "sha256": "ffafc76ca3921762b0b83878266e1a06ac438a2104b41fbfb95f813ce6d9339b" + "sha256": "91fa9cb519aecc239f03ca7de3f44163628eadd1e89e045e488d9dd588ff5888" }, "examples": { "commerce-platform": { diff --git a/public-export.json b/public-export.json index 40084be..e02d86a 100644 --- a/public-export.json +++ b/public-export.json @@ -2,7 +2,7 @@ "files": [ { "path": "dependencies/runtime-components.json", - "sha256": "f7f5d8b1b42a4ba482493c47737549acd122aef80b6e0f100a346f3b843a1da0" + "sha256": "bb397a6fa55a99ac86bfea991bd9e1a9a1373278b1ada37dfacc25e17ca53e9b" }, { "path": "schemas/compiled-policy-pack.schema.json", @@ -14,10 +14,10 @@ }, { "path": "THIRD_PARTY_NOTICES.txt", - "sha256": "9184103a7af89b1682fbf416e7d33ae7aeaf0dd4c9923d8b18004506b9d78ee6" + "sha256": "c57f4f7975a62d1f24d5d9e1f95a9e4a0ac82c80136f73d871d0fe7c8fce3262" } ], "format_version": "1", - "source_commit": "e697b5fe84a3b377ba2d8a209e40046f8660f70b", + "source_commit": "de7c23b27fe34e9e8e2a97dd77b016078fd72421", "source_repository": "rootform-dev/engine" }