From 7f7d99c1c99373a4ac7057a09e489b4974840fd8 Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Thu, 15 Oct 2026 00:17:52 +0800 Subject: [PATCH] fix(release): package localized viewport-safe clipboard controls --- COMPATIBILITY.md | 18 +++++++- docs/releases/server-1.6.532.md | 45 +++++++++++++++++++ scripts/check-server-api-explorer-patch.sh | 28 ++++++------ .../test-current-server-packaging-contract.py | 42 ++++++++--------- server/Dockerfile.web-compose-release | 14 +++--- server/build-api-explorer-patch-image.sh | 12 ++--- server/build-component-candidate.sh | 4 +- server/security/openvex.json | 4 +- server/security/vendor-pending.json | 2 +- 9 files changed, 115 insertions(+), 54 deletions(-) create mode 100644 docs/releases/server-1.6.532.md diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index fdde9e0f81f..651c7e5ad24 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,6 +1,22 @@ # Compatibility Contract -## Current release: Server v1.6.531 published +## Server v1.6.532 candidate + +This candidate packages immutable Web Console `1.6.187` with unchanged Engine +`v0.183.348`. Shared clipboard messages initialize before rendering and report +success/failure in all 13 supported locales. Copy hints fit the viewport; Custom +host commands remain LTR in RTL interfaces. Commands, registration APIs, native +navigation, permissions, OIDC/MFA, networking and other component pins are unchanged. + +Thirteen focused rendered cases and one corrected-caption case passed; 32 keys +across 13 locales passed the targeted resource contract. The Web archive has +SHA-256 `b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3` +from signed normally merged source `b45f8ee73c72b5f58b010dd55c64d5aef7406c61`. +Its official immutable release and anonymous readback are complete. Server +publication and the real-browser locale/theme/viewport matrix are still separate +gates, not inferred from source tests. See [the release note](docs/releases/server-1.6.532.md). + +## Server v1.6.531 published This release packages immutable Engine `v0.183.348` and Web Console `1.6.186`. The shared Default uses the configured public Native project template; catalog diff --git a/docs/releases/server-1.6.532.md b/docs/releases/server-1.6.532.md new file mode 100644 index 00000000000..7d391424568 --- /dev/null +++ b/docs/releases/server-1.6.532.md @@ -0,0 +1,45 @@ +# Server v1.6.532 + +本版封裝正式不可變 Web Console `1.6.187`；Engine 維持 `v0.183.348`。 +修正共用複製元件在初次渲染、無滑鼠移入或鍵盤操作時讀到未定義翻譯鍵， +以及複製提示受按鈕窄寬度影響而成為直條、超出視窗的問題。 + +## 修改範圍 + +- 共用提示在初次渲染即有有效翻譯，複製成功或失敗後恢復正確提示。 +- 13 個支援語系都有原生預設、成功及失敗文字；俄文不再誤稱複製連結。 +- 非同步複製失敗顯示可操作的訊息，HTTP fallback 即使例外也清除暫存 textarea。 +- 已銷毀元件不接收遲到結果，個別按鈕的計時器不覆寫別人的提示。 +- 複製提示依文字寬度換行並限制在視窗內；重用一般 tooltip 時移除 copy 專用樣式。 +- Custom 主機的 Linux／Windows 指令在 RTL 語系仍為 LTR；窄版可換行長 URL。 + +不改註冊指令或密鑰、API 契約、權限、Authentication Service、OIDC、MFA、 +HAProxy、資料庫、plugin 或防火牆後端。其他元件及必要安全 gates 保留。 + +## 元件與證據 + +Web producer：`b45f8ee73c72b5f58b010dd55c64d5aef7406c61`。 +`web-console-1.6.187.tar.gz` 為 3,024,923 bytes，SHA-256： +`b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3`。 +正常必要檢查、簽章合併、正式不可變發行與匿名成品讀回已完成。 + +13 項相關整合案例通過。修正舊測試的非法翻譯 fixture 後，只重跑受影響的 +1 項案例並通過；沒有重跑其他已通過案例。語系資源檢查涵蓋 32 鍵 × 13 語系， +沒有缺鍵、空值或 ICU 參數契約錯誤。既有 MFA 的宣告英文 fallback 另列， +不聲稱所有頁面都已有 13 語系原生翻譯。 + +Server 正式發行、digest 讀回、部署及瀏覽器 13 語系 × 桌面／窄版 × 亮／暗色 +驗收仍為獨立必要 gate，完成後更新實際結果。既有較廣矩陣及 KVM 待驗不升格。 + +## 升級與回復 + +正式成品確認後，僅更新 Compose 的 Server 數字版本 tag，保留現有環境變數、 +named volumes、restart policy、AppArmor、HTTPS origin、OIDC 與效能設定。 +不使用 runtime patch。本版沒有資料庫遷移；回復可沿用同資料卷切回 +上一個正式 `v1.6.531` 映像。實際回復點及首次啟動／重啟結果在部署後記錄。 + +## 安全範圍 + +只更新發行識別，保留既有 OpenVEX 決策、vendor-pending 精確集合、嚴重性 +與無官方修補版的限制。正式發行依原 workflow 對成品執行必要掃描； +不為發行放寬檢查，也不將待 vendor 的 findings 宣稱為零。 diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh index 6b66f0e8faa..6c9fd26631b 100755 --- a/scripts/check-server-api-explorer-patch.sh +++ b/scripts/check-server-api-explorer-patch.sh @@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \ 'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \ SERVER_INCREMENTAL_RELEASE_BASE_MISSING require_marker "$release_dockerfile" \ - 'ARG SERVER_RELEASE_TAG=v1.6.531' \ + 'ARG SERVER_RELEASE_TAG=v1.6.532' \ SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING require_marker "$release_dockerfile" \ 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \ @@ -567,16 +567,16 @@ require_marker "$publish_workflow" \ 'bash source/server/artifacts/verify-host-api-package.sh' \ SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.186' \ + 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.187' \ SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.186.tar.gz' \ + 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.187.tar.gz' \ SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_ARTIFACT_SHA256=95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76' \ + 'ARG WEB_CONSOLE_ARTIFACT_SHA256=b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3' \ SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_COMMIT=236973cb28dd7600a697902e3e3445b1a210a87a' \ + 'ARG WEB_CONSOLE_COMMIT=b45f8ee73c72b5f58b010dd55c64d5aef7406c61' \ SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING require_marker "$release_dockerfile" \ "grep -aF 'hostsPage.permissionDenied'" \ @@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \ '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \ SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING require_marker "$build_script" \ - 'web_console_commit=${WEB_CONSOLE_COMMIT:-236973cb28dd7600a697902e3e3445b1a210a87a}' \ + 'web_console_commit=${WEB_CONSOLE_COMMIT:-b45f8ee73c72b5f58b010dd55c64d5aef7406c61}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING require_marker "$build_script" \ - 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.186}' \ + 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.187}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING require_marker "$build_script" \ - 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.186.tar.gz}' \ + 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.187.tar.gz}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING require_marker "$build_script" \ - 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76}' \ + 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING require_marker "$release_dockerfile" \ 'ARG CATALOG_SERVICE_VERSION=0.20.13' \ @@ -1059,10 +1059,10 @@ require_marker "$build_script" \ '--file server/Dockerfile.web-compose-release' \ SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING require_marker "$build_script" \ - 'image=${IMAGE:-pasturestack-validation/server:v1.6.531}' \ + 'image=${IMAGE:-pasturestack-validation/server:v1.6.532}' \ SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING require_marker "$build_script" \ - 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.531}' \ + 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.532}' \ SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING require_marker "$build_script" \ 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \ @@ -2146,7 +2146,7 @@ done jq -e ' .["@context"] == "https://openvex.dev/ns/v0.2.0" - and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.531" + and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.532" and (.statements | length) == 51 and ([.statements[].vulnerability.name] | length == (unique | length)) and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort) @@ -2172,7 +2172,7 @@ jq -r ' | @tsv ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture" bash "$vendor_pending_validator" "$runtime_vendor_pending" \ - "$vendor_pending_fixture" v1.6.531 >/dev/null + "$vendor_pending_fixture" v1.6.532 >/dev/null bash scripts/test-vendor-pending-findings.sh >/dev/null rm -f "$vendor_pending_fixture" trap - EXIT @@ -2261,4 +2261,4 @@ for release_readback_contract in \ fi done -printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.531 base=v1.6.460 engine=0.183.348 web_console=1.6.186 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n' +printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.532 base=v1.6.460 engine=0.183.348 web_console=1.6.187 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n' diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py index f3b67970cb6..47bbdd0e6e1 100644 --- a/scripts/test-current-server-packaging-contract.py +++ b/scripts/test-current-server-packaging-contract.py @@ -17,21 +17,21 @@ PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。' STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`' COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING' -WEB_SHA = '95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76' -WEB_SOURCE = '236973cb28dd7600a697902e3e3445b1a210a87a' +WEB_SHA = 'b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3' +WEB_SOURCE = 'b45f8ee73c72b5f58b010dd55c64d5aef7406c61' CATALOG_COMMIT = 'b6b658888fce50d3ec217eb4eba0f26ab0113baf' ENGINE_SHA = '72581f6eead8633b6bbafbe15512cd44561b9ff25df68d00dd7120ad507aa449' ENGINE_SOURCE = 'f19cd64183c0fa93464e9a9f9c2477c9e902b56d' OLD_COORDINATES = { - 'v1.6.531': 'v1.6.521', - '1.6.186': '1.6.181', + 'v1.6.532': 'v1.6.521', + '1.6.187': '1.6.181', WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03', WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550', CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3', } -# Engine348 and Web186 use the reviewed component input identities. +# Engine348 and Web187 use the reviewed component input identities. # Published521 component values remain mutation controls. -# Component coordinates do not establish Server531 artifact/runtime PASS. +# Component coordinates do not establish Server532 artifact/runtime PASS. CATALOG_FIELDS = ( ('VERSION', 'version', '0.20.13'), ('COMMIT', 'commit', '4c39c73a8131ba06e9ff0aaec3b95cc27e049324'), @@ -47,19 +47,19 @@ } EXPECTED = { COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508), - 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.531'), + 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.532'), 'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'), 'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.186'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.186.tar.gz'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.187'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.187.tar.gz'), 'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA), 'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.186}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.186.tar.gz}'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.187}'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.187.tar.gz}'), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'), - 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.531}'), - 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.531}'), + 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.532}'), + 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.532}'), 'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'), 'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'), 'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'), @@ -470,15 +470,15 @@ def verify(files, gate=GATE): pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))' if len(re.findall(pipeline, source)) != 1: raise AssertionError('CURRENT_CATALOG_HASH_BYPASS') - if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.531"' not in gate: + if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.532"' not in gate: raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH') - if '"$vendor_pending_fixture" v1.6.531 >/dev/null' not in gate: + if '"$vendor_pending_fixture" v1.6.532 >/dev/null' not in gate: raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH') - if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.531': + if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.532': raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH') - if json.loads(files[VENDOR]).get('release') != 'v1.6.531': + if json.loads(files[VENDOR]).get('release') != 'v1.6.532': raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH') - if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.531 base=v1.6.460 engine=0.183.348 web_console=1.6.186 catalog_service=0.20.13 ' not in gate: + if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.532 base=v1.6.460 engine=0.183.348 web_console=1.6.187 catalog_service=0.20.13 ' not in gate: raise AssertionError('CURRENT_SUMMARY_MISMATCH') verify_incremental_contract(files, gate) @@ -492,11 +492,11 @@ def previous_gate(gate=GATE): if stale(marker) != marker: replacements["'" + marker + "' "] = "'" + stale(marker) + "' " replacements.update({ - 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.531"': + 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.532"': 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"', - '"$vendor_pending_fixture" v1.6.531 >/dev/null': + '"$vendor_pending_fixture" v1.6.532 >/dev/null': '"$vendor_pending_fixture" v1.6.521 >/dev/null', - 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.531 base=v1.6.460 engine=0.183.348 web_console=1.6.186 catalog_service=0.20.13 ': + 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.532 base=v1.6.460 engine=0.183.348 web_console=1.6.187 catalog_service=0.20.13 ': 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ', }) for marker, stale_marker in replacements.items(): diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release index 3b57e9de2bd..33d6ba0db34 100644 --- a/server/Dockerfile.web-compose-release +++ b/server/Dockerfile.web-compose-release @@ -55,9 +55,9 @@ ARG NODE_AGENT_BINARY_SHA256=ce8342e10da07c50cc414b471cadc67db4dd390e6e2dcb632b3 ARG NODE_AGENT_APPLY_SHA256=dd8cb342518a43e7468cc121db5c4e44b16731f2620b77ea0fd03c02c03766a9 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download -ARG WEB_CONSOLE_RELEASE_TAG=1.6.186 -ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.186.tar.gz -ARG WEB_CONSOLE_ARTIFACT_SHA256=95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76 +ARG WEB_CONSOLE_RELEASE_TAG=1.6.187 +ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.187.tar.gz +ARG WEB_CONSOLE_ARTIFACT_SHA256=b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download ARG CATALOG_SERVICE_VERSION=0.20.13 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324 @@ -568,7 +568,7 @@ FROM ${BASE_IMAGE} ARG SOURCE_DATE_EPOCH ARG PASTURESTACK_SERVER_REVISION -ARG SERVER_RELEASE_TAG=v1.6.531 +ARG SERVER_RELEASE_TAG=v1.6.532 ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.348 ARG ORCHESTRATION_ENGINE_VERSION=0.183.348 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233 @@ -588,9 +588,9 @@ ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2 ARG LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1 ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3 -ARG WEB_CONSOLE_RELEASE_TAG=1.6.186 -ARG WEB_CONSOLE_ARTIFACT_SHA256=95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76 -ARG WEB_CONSOLE_COMMIT=236973cb28dd7600a697902e3e3445b1a210a87a +ARG WEB_CONSOLE_RELEASE_TAG=1.6.187 +ARG WEB_CONSOLE_ARTIFACT_SHA256=b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3 +ARG WEB_CONSOLE_COMMIT=b45f8ee73c72b5f58b010dd55c64d5aef7406c61 ARG CATALOG_SERVICE_VERSION=0.20.13 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324 ARG CATALOG_SERVICE_ARCHIVE_SHA256=29626181cb8489b016e5975ffaddc00b2a32d290b1c0066e833d27fa7a5edf83 diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh index 7a835c315c3..58ca1c4690a 100755 --- a/server/build-api-explorer-patch-image.sh +++ b/server/build-api-explorer-patch-image.sh @@ -14,7 +14,7 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then fi revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)} -server_release_tag=${SERVER_RELEASE_TAG:-v1.6.531} +server_release_tag=${SERVER_RELEASE_TAG:-v1.6.532} source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403} orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download} @@ -48,10 +48,10 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.18.tar.gz} api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-92b718c46163018ea40c008ac552911f0eb610647377725405f4046dcd411f2c} api_explorer_commit=${API_EXPLORER_COMMIT:-3b1c39e8a116f58649d94233a384a0362c02b43e} web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download} -web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.186} -web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.186.tar.gz} -web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76} -web_console_commit=${WEB_CONSOLE_COMMIT:-236973cb28dd7600a697902e3e3445b1a210a87a} +web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.187} +web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.187.tar.gz} +web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-b9797c08cf8c698e7cabac4bc9cd12fba0faa181c8781875d93a3de7109f2db3} +web_console_commit=${WEB_CONSOLE_COMMIT:-b45f8ee73c72b5f58b010dd55c64d5aef7406c61} catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download} catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.13} catalog_service_commit=${CATALOG_SERVICE_COMMIT:-4c39c73a8131ba06e9ff0aaec3b95cc27e049324} @@ -101,7 +101,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-5ce usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-e62a21270142181315293d7e11482288ffe8fc4d91cc8fe07dacc90b461f3709} supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0' newest_docker_version=v29.8.0 -image=${IMAGE:-pasturestack-validation/server:v1.6.531} +image=${IMAGE:-pasturestack-validation/server:v1.6.532} build_options=() [[ "$revision" =~ ^[0-9a-f]{40}$ ]] diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh index 6b573900632..c2b3a7554f2 100755 --- a/server/build-component-candidate.sh +++ b/server/build-component-candidate.sh @@ -14,10 +14,10 @@ for name in "${required[@]}"; do case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac export "$name" done -export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.531} +export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.532} export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.348} export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar -export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.186} +export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.187} export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz" export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.15} export HOST_API_VERSION=${HOST_API_VERSION:-0.38.5} diff --git a/server/security/openvex.json b/server/security/openvex.json index 5b9dfbfcfac..f220d2adbe3 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.531", + "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.532", "author": "PastureStack Security", "timestamp": "2026-10-02T22:05:00Z", - "version": 51, + "version": 52, "statements": [ { "vulnerability": { diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index 141f84e8be5..a19129cb1b9 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "release": "v1.6.531", + "release": "v1.6.532", "generatedAt": "2026-10-14T00:00:00Z", "policy": { "allowedSeverities": [