github-actions · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026
@@ -19,6 +19,9 @@
   the Inspector.
 - In planned changes and comparisons, a container without a change of its own
   shows a compact tally of the changes it holds, by kind of change.
+- Rootform is built with Go 1.26.9 and golang.org/x/net 0.61.0, which fix
+  denial-of-service vulnerabilities in HTTP and TLS handling (CVE-2026-78667,
+  CVE-2026-78669 and CVE-2026-97031).
 
 ## 0.2.0
 

@@ -3582,15 +3582,15 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ----- END LICENSE TEXT: go.lsp.dev/uri@v1.0.1 -----
 
 
-go-module: golang.org/x/mod@v0.38.0
+go-module: golang.org/x/mod@v0.41.0
 -----------------------------------
 Declared license: BSD-3-Clause
 Concluded license: BSD-3-Clause
 Upstream: https://golang.org/x/mod
 Copyright: Copyright 2009 The Go Authors.
 License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
 
------ BEGIN LICENSE TEXT: golang.org/x/mod@v0.38.0 -----
+----- BEGIN LICENSE TEXT: golang.org/x/mod@v0.41.0 -----
 Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
@@ -3618,18 +3618,18 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------ END LICENSE TEXT: golang.org/x/mod@v0.38.0 -----
+----- END LICENSE TEXT: golang.org/x/mod@v0.41.0 -----
 
 
-go-module: golang.org/x/net@v0.58.0
+go-module: golang.org/x/net@v0.61.0
 -----------------------------------
 Declared license: BSD-3-Clause
 Concluded license: BSD-3-Clause
 Upstream: https://golang.org/x/net
 Copyright: Copyright 2009 The Go Authors.
 License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
 
------ BEGIN LICENSE TEXT: golang.org/x/net@v0.58.0 -----
+----- BEGIN LICENSE TEXT: golang.org/x/net@v0.61.0 -----
 Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
@@ -3657,18 +3657,18 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------ END LICENSE TEXT: golang.org/x/net@v0.58.0 -----
+----- END LICENSE TEXT: golang.org/x/net@v0.61.0 -----
 
 
-go-module: golang.org/x/sync@v0.22.0
+go-module: golang.org/x/sync@v0.24.0
 ------------------------------------
 Declared license: BSD-3-Clause
 Concluded license: BSD-3-Clause
 Upstream: https://golang.org/x/sync
 Copyright: Copyright 2009 The Go Authors.
 License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
 
------ BEGIN LICENSE TEXT: golang.org/x/sync@v0.22.0 -----
+----- BEGIN LICENSE TEXT: golang.org/x/sync@v0.24.0 -----
 Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
@@ -3696,18 +3696,18 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------ END LICENSE TEXT: golang.org/x/sync@v0.22.0 -----
+----- END LICENSE TEXT: golang.org/x/sync@v0.24.0 -----
 
 
-go-module: golang.org/x/text@v0.41.0
+go-module: golang.org/x/text@v0.43.0
 ------------------------------------
 Declared license: BSD-3-Clause
 Concluded license: BSD-3-Clause
 Upstream: https://golang.org/x/text
 Copyright: Copyright 2009 The Go Authors.
 License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
 
------ BEGIN LICENSE TEXT: golang.org/x/text@v0.41.0 -----
+----- BEGIN LICENSE TEXT: golang.org/x/text@v0.43.0 -----
 Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
@@ -3735,18 +3735,18 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------ END LICENSE TEXT: golang.org/x/text@v0.41.0 -----
+----- END LICENSE TEXT: golang.org/x/text@v0.43.0 -----
 
 
-go-module: golang.org/x/tools@v0.48.0
+go-module: golang.org/x/tools@v0.51.0
 -------------------------------------
 Declared license: BSD-3-Clause
 Concluded license: BSD-3-Clause
 Upstream: https://golang.org/x/tools
 Copyright: Copyright 2009 The Go Authors.
 License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
 
------ BEGIN LICENSE TEXT: golang.org/x/tools@v0.48.0 -----
+----- BEGIN LICENSE TEXT: golang.org/x/tools@v0.51.0 -----
 Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
@@ -3774,7 +3774,7 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------ END LICENSE TEXT: golang.org/x/tools@v0.48.0 -----
+----- END LICENSE TEXT: golang.org/x/tools@v0.51.0 -----
 
 
 go-module: oras.land/oras-go/v2@v2.6.2
@@ -3990,16 +3990,16 @@ License text SHA-256: eccb04b94c71454ea03f00ecb518b997952c4f2f23aca50baab98230f5
 ----- END LICENSE TEXT: oras.land/oras-go/v2@v2.6.2 -----
 
 
-go-runtime: Go standard library@go1.26.7
+go-runtime: Go standard library@go1.26.9
 ----------------------------------------
 Declared license: BSD-3-Clause
 Concluded license: BSD-3-Clause
-Upstream: https://go.googlesource.com/go/+/refs/tags/go1.26.7
+Upstream: https://go.googlesource.com/go/+/refs/tags/go1.26.9
 Copyright: Copyright 2009 The Go Authors.
 License text SHA-256: 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
 Notice text SHA-256: 96f408bfae65bf137fc2525d3ecb030271c50c1e90799f87abf8846d8dd505cc
 
------ BEGIN LICENSE TEXT: Go standard library@go1.26.7 -----
+----- BEGIN LICENSE TEXT: Go standard library@go1.26.9 -----
 Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
@@ -4027,9 +4027,9 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
------ END LICENSE TEXT: Go standard library@go1.26.7 -----
+----- END LICENSE TEXT: Go standard library@go1.26.9 -----
 
------ BEGIN NOTICE TEXT: Go standard library@go1.26.7 -----
+----- BEGIN NOTICE TEXT: Go standard library@go1.26.9 -----
 Additional IP Rights Grant (Patents)
 
 "This implementation" means the copyrightable works distributed by
@@ -4052,7 +4052,7 @@ implementation of Go constitutes direct or contributory patent
 infringement, or inducement of patent infringement, then any patent
 rights granted to you under this License for this implementation of Go
 shall terminate as of the date such litigation is filed.
------ END NOTICE TEXT: Go standard library@go1.26.7 -----
+----- END NOTICE TEXT: Go standard library@go1.26.9 -----
 
 
 Embedded renderer notices

@@ -312,7 +312,7 @@
       "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad",
       "name": "golang.org/x/mod",
       "upstream": "https://golang.org/x/mod",
-      "version": "v0.38.0"
+      "version": "v0.41.0"
     },
     {
       "copyright_text": "Copyright 2009 The Go Authors.",
@@ -322,7 +322,7 @@
       "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad",
       "name": "golang.org/x/net",
       "upstream": "https://golang.org/x/net",
-      "version": "v0.58.0"
+      "version": "v0.61.0"
     },
     {
       "copyright_text": "Copyright 2009 The Go Authors.",
@@ -332,7 +332,7 @@
       "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad",
       "name": "golang.org/x/sync",
       "upstream": "https://golang.org/x/sync",
-      "version": "v0.22.0"
+      "version": "v0.24.0"
     },
     {
       "copyright_text": "Copyright 2009 The Go Authors.",
@@ -342,7 +342,7 @@
       "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad",
       "name": "golang.org/x/text",
       "upstream": "https://golang.org/x/text",
-      "version": "v0.41.0"
+      "version": "v0.43.0"
     },
     {
       "copyright_text": "Copyright 2009 The Go Authors.",
@@ -352,7 +352,7 @@
       "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad",
       "name": "golang.org/x/tools",
       "upstream": "https://golang.org/x/tools",
-      "version": "v0.48.0"
+      "version": "v0.51.0"
     },
     {
       "copyright_text": "(c) You must retain, in the Source form of any Derivative Works; Copyright 2021 ORAS Authors.",
@@ -372,8 +372,8 @@
       "license_text_sha256": "911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad",
       "name": "Go standard library",
       "notice_text_sha256": "96f408bfae65bf137fc2525d3ecb030271c50c1e90799f87abf8846d8dd505cc",
-      "upstream": "https://go.googlesource.com/go/+/refs/tags/go1.26.7",
-      "version": "go1.26.7"
+      "upstream": "https://go.googlesource.com/go/+/refs/tags/go1.26.9",
+      "version": "go1.26.9"
     },
     {
       "copyright_text": "Copyright (c) 2023 Hunter Johnston <https://github.com/huntabyte>; Copyright (c) 2023 CokaKoala <https://github.com/adriangonz97>; Copyright (c) 2023 shadcn",

@@ -2,7 +2,7 @@
   "format_version": "1",
   "binary": {
     "version": "rootform 0.2.1",
-    "sha256": "ffafc76ca3921762b0b83878266e1a06ac438a2104b41fbfb95f813ce6d9339b"
+    "sha256": "91fa9cb519aecc239f03ca7de3f44163628eadd1e89e045e488d9dd588ff5888"
   },
   "examples": {
     "commerce-platform": {

@@ -2,7 +2,7 @@
   "files": [
     {
       "path": "dependencies/runtime-components.json",
-      "sha256": "f7f5d8b1b42a4ba482493c47737549acd122aef80b6e0f100a346f3b843a1da0"
+      "sha256": "bb397a6fa55a99ac86bfea991bd9e1a9a1373278b1ada37dfacc25e17ca53e9b"
     },
     {
       "path": "schemas/compiled-policy-pack.schema.json",
@@ -14,10 +14,10 @@
     },
     {
       "path": "THIRD_PARTY_NOTICES.txt",
-      "sha256": "9184103a7af89b1682fbf416e7d33ae7aeaf0dd4c9923d8b18004506b9d78ee6"
+      "sha256": "c57f4f7975a62d1f24d5d9e1f95a9e4a0ac82c80136f73d871d0fe7c8fce3262"
     }
   ],
   "format_version": "1",
-  "source_commit": "e697b5fe84a3b377ba2d8a209e40046f8660f70b",
+  "source_commit": "de7c23b27fe34e9e8e2a97dd77b016078fd72421",
   "source_repository": "rootform-dev/engine"
 }