From 1d93eb9169f31a2c304581e5ea28e851ad8d3d4e Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Thu, 15 Oct 2026 09:06:03 +0800 Subject: [PATCH] fix(release): package RTL onboarding step alignment --- COMPATIBILITY.md | 13 +++- README.md | 64 +++++-------------- docs/performance/README.md | 11 ++-- docs/releases/server-1.6.533.md | 11 +++- docs/releases/server-1.6.534.md | 24 +++++++ scripts/check-server-api-explorer-patch.sh | 28 ++++---- .../test-current-server-packaging-contract.py | 42 ++++++------ server/Dockerfile.web-compose-release | 14 ++-- server/build-api-explorer-patch-image.sh | 12 ++-- server/build-component-candidate.sh | 4 +- server/security/openvex.json | 4 +- server/security/vendor-pending.json | 2 +- 12 files changed, 118 insertions(+), 111 deletions(-) create mode 100644 docs/releases/server-1.6.534.md diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index c7122e3631..fd2e0fad35 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,6 +1,6 @@ # Compatibility Contract -## Server v1.6.533 candidate +## Server v1.6.533 published; RTL visual follow-up required This candidate packages immutable Web Console `1.6.188`, source `8e12216fd6f8d843ed043b4c0afcec995d33caeb`, archive SHA-256 @@ -9,8 +9,15 @@ Native non-bubbling pointer events are owned by the tooltip element lifecycle, with run-loop entry and listener cleanup. Existing action-menu overrides and static context forwarding are preserved. Four new actual-DOM focused cases passed. Engine `v0.183.348`, APIs, registration, authentication, permissions, -networking and all other component inputs are unchanged. Server publication, -deployment and 52 actual-browser views plus ordinary HTTP copy remain pending. +networking and all other component inputs are unchanged. Official publication, +QA startup and restart passed. Producer: `6ef201a937500f894f8ec0f5a589cb7f796b66c3`. +Artifact identity, not an installation command: +`ghcr.io/pasturestack/server:v1.6.533@sha256:f5bc5eb860bec0d6477d03da7e02ee3c683d23c67e9a3d850d36a2a256fb6216`. +The distinct OCI config is `sha256:011862871af1ac207f3ba72ba68c51e41faf7cfc15527ad9ea321b0d339289e4`. +All 52 actual-browser clipboard views and ordinary-HTTP copy passed; subsequent +visual review found the existing RTL step background remained left while its +number moved right. This is not complete whole-page layout acceptance; the +alignment repair requires a new immutable component and Server patch. See [the release note](docs/releases/server-1.6.533.md). ## Server v1.6.532 published; browser acceptance incomplete diff --git a/README.md b/README.md index 4e9fb5a1ac..054b106b53 100644 --- a/README.md +++ b/README.md @@ -13,51 +13,21 @@ upstream history, authorship, licenses, and notices. ## Current release -Server [`v1.6.532`](https://github.com/PastureStack/server/releases/tag/v1.6.532) -packages Web Console `1.6.187` and Orchestration Engine `v0.183.348`. -The console includes scoped clipboard message and feedback changes across all -13 supported locales; actual-browser acceptance remains incomplete. -The shared Default uses the configured public Native project template, with -system-stack definitions available before host registration and service -activation triggered by the first active host. Machine driver cards display -each driver's API name, including drivers sharing the generic icon; catalog -names retain localization and formatting. Personal API Keys are available -without an accessible environment. - -API Key permissions follow the actual operation and the owner's live authority. -Authorized compose exports and registered actions can load their exact target -without granting ordinary read/list access or broader resource scope. -Stack-scoped Container and Instance Link queries retain live ancestry checks -and work with MariaDB's default optimizer, including nullable Stack references. - -Subscription audit retains the first terminal close/failure outcome and bounded -delivery retry without restoring authorization. -The console labels event subscriptions even when a completion record has no -target ID; resource-picker and grant capabilities retain their existing boundaries. - -Registration tokens use dedicated Basic authentication. Native project creation -preserves the creator's initial membership and default networks. HA database -exports return a SQL ZIP only after successful, nonempty output; failures clean -up temporary files without returning command stderr or secrets. -See the [release note](docs/releases/server-1.6.532.md) for component identities -and acceptance limits. - -Official publication, immutable readback and QA 8080 deployment passed, including -startup and restart checks with preserved volumes and runtime overrides. -Actual-browser verification found a native hover event-lifecycle defect -in Web Console `1.6.187`. A new `1.6.188` candidate takes over those repairs; -the 52 locale/width/theme browser cases remain incomplete. - -The console supports OIDC, TOTP and passkeys, role-aware resource operations, -container resource/hardware settings, and movable terminal/log windows. -Hardware options require compatible node software and actual host capabilities; -GPU device access is not exclusive GPU allocation. Audit queries and JSON, CSV -and XLSX exports preserve environment authorization, explicit date bounds and -bounded pagination. Query/export errors retain filters and successful query -results. See the [Host compatibility guide](docs/hosts/README.md) before enrolling -a host and the [API Key guide](docs/api-keys.md) for policy and audit behavior. -A packaged feature does not establish that every resource, role or hardware -combination has been tested. +Server [`v1.6.533`](https://github.com/PastureStack/server/releases/tag/v1.6.533) +packages Web Console `1.6.188` and Orchestration Engine `v0.183.348`. +It repairs native clipboard hover and localized feedback and includes Ubuntu's +official curl security update. Publication, immutable readback, QA startup and +restart passed with preserved volumes and runtime settings. + +The 52 clipboard locale/width/theme combinations and ordinary-HTTP copy passed. +Visual review found a separate RTL step-background alignment defect; its fix +requires a new immutable component and Server patch. This is not complete +whole-page or broader role/lifecycle acceptance. See the +[release note](docs/releases/server-1.6.533.md) for identities and evidence. + +Personal API Keys remain available without an accessible environment. Existing +API authorization, registration, OIDC/MFA and performance contracts are retained. +See the [Host guide](docs/hosts/README.md) before enrolling a host. ## API Keys @@ -88,7 +58,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.532 + ghcr.io/pasturestack/server:v1.6.533 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -96,7 +66,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.532 + image: ghcr.io/pasturestack/server:v1.6.533 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/performance/README.md b/docs/performance/README.md index e72ec26498..7ed7d84202 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,20 +8,21 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses the published `v1.6.532` image, packaging Web Console `1.6.187` -and Engine `v0.183.348`. See the [release note](../releases/server-1.6.532.md) +The example uses the published `v1.6.533` image, packaging Web Console `1.6.188` +and Engine `v0.183.348`. See the [release note](../releases/server-1.6.533.md) for exact identities and acceptance limits. This release does not change these settings. Official image publication and immutable readback passed. The QA 8080 switch preserved runtime overrides and volumes; startup and restart checks passed. A native hover event-lifecycle -defect remains in Web `1.6.187`, and the 52 actual-browser cases are -incomplete; the new Web `1.6.188` candidate takes over the browser repairs. +repair and 52 clipboard combinations passed in Web `1.6.188`. A separate RTL +step-background alignment defect remains pending; it does not change these +performance settings or establish a performance benchmark. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.532 + image: ghcr.io/pasturestack/server:v1.6.533 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.533.md b/docs/releases/server-1.6.533.md index 162e73330f..3308639949 100644 --- a/docs/releases/server-1.6.533.md +++ b/docs/releases/server-1.6.533.md @@ -1,4 +1,4 @@ -# Server v1.6.533 candidate +# Server v1.6.533 本版封裝正式不可變 Web Console `1.6.188`，Engine 維持 `v0.183.348`。 實際瀏覽器驗收187時發現：Ember5預設不再委派非冒泡的 @@ -19,8 +19,13 @@ Web producer `8e12216fd6f8d843ed043b4c0afcec995d33caeb`；正式tar為 `3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92`。 Web必要檢查、正常簽章合併、不可變發布與匿名讀回已完成。 -Server正式發行、成品讀回、8080部署、13語系×桌面／窄版×亮／暗色52組 -以及普通HTTP複製仍各自待完成，不將來源測試當成瀏覽器通過。 +Server正式發行、成品讀回與QA部署已完成，首次啟動與重啟通過。 +Producer `6ef201a937500f894f8ec0f5a589cb7f796b66c3`；正式成品識別（非安裝指令）： +`ghcr.io/pasturestack/server:v1.6.533@sha256:f5bc5eb860bec0d6477d03da7e02ee3c683d23c67e9a3d850d36a2a256fb6216`。 +13語系×桌面／窄版×亮／暗色52組複製與普通HTTP fallback通過， +頁面錯誤、缺翻譯及非預期資源寫入均0，偏好／呈現／剪貼簿恢復。 +其後視覺複核找到原有RTL步驟背景與數字分離，故不宣稱整頁版面無缺陷； +修正須新增189／534不可變成品，不覆寫188／533。 歷史矩陣與KVM待驗維持原狀。 正式成品安全 gate 發現 curl `8.18.0-1ubuntu2.7` 的 `CVE-2026-92392` HIGH。 diff --git a/docs/releases/server-1.6.534.md b/docs/releases/server-1.6.534.md new file mode 100644 index 0000000000..c278a5423d --- /dev/null +++ b/docs/releases/server-1.6.534.md @@ -0,0 +1,24 @@ +# Server v1.6.534 candidate + +This candidate packages the new immutable Web Console `1.6.189` RTL +host-onboarding step alignment repair. The step circle and timeline now follow +their number on the right in RTL output, using the existing RTL compiler. +LTR geometry, SVGs, copy controls, tooltip lifecycle and API behavior are retained. + +Server `v1.6.533` and Web `1.6.188` remain immutable published artifacts. Their +52 clipboard combinations and ordinary-HTTP copy passed, but subsequent visual +review found this existing step-background defect. This candidate is a focused +follow-up, not a replacement of those artifacts or a whole-site retest. + +Engine remains `v0.183.348`; other component versions, the official Ubuntu curl +security backport, all 69 evidence-backed VEX decisions and the exact 20 +vendor-pending MEDIUM findings are retained. See the +[533 release note](server-1.6.533.md) for the security evidence. + +Native acceptance will rerun the four RTL combinations and four LTR controls, +plus a separate ordinary-HTTP native copy. The unaffected 44 combinations retain +their immutable 188 evidence. Publication, deployment and the new eight views +remain pending; historical matrix HOLDs and KVM are not promoted to PASS. + +No authentication, authorization, database, HAProxy, networking backend, volume +or performance-setting change. Preserve the previous working Server as rollback. diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh index 6226a9ed6b..95956a7349 100755 --- a/scripts/check-server-api-explorer-patch.sh +++ b/scripts/check-server-api-explorer-patch.sh @@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \ 'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \ SERVER_INCREMENTAL_RELEASE_BASE_MISSING require_marker "$release_dockerfile" \ - 'ARG SERVER_RELEASE_TAG=v1.6.533' \ + 'ARG SERVER_RELEASE_TAG=v1.6.534' \ SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING require_marker "$release_dockerfile" \ 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \ @@ -567,16 +567,16 @@ require_marker "$publish_workflow" \ 'bash source/server/artifacts/verify-host-api-package.sh' \ SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.188' \ + 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.189' \ SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz' \ + 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.189.tar.gz' \ SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92' \ + 'ARG WEB_CONSOLE_ARTIFACT_SHA256=1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc' \ SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_COMMIT=8e12216fd6f8d843ed043b4c0afcec995d33caeb' \ + 'ARG WEB_CONSOLE_COMMIT=f30f5e81dd9ee25878c3aff681eed5bb61883453' \ SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING require_marker "$release_dockerfile" \ "grep -aF 'hostsPage.permissionDenied'" \ @@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \ '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \ SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING require_marker "$build_script" \ - 'web_console_commit=${WEB_CONSOLE_COMMIT:-8e12216fd6f8d843ed043b4c0afcec995d33caeb}' \ + 'web_console_commit=${WEB_CONSOLE_COMMIT:-f30f5e81dd9ee25878c3aff681eed5bb61883453}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING require_marker "$build_script" \ - 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}' \ + 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.189}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING require_marker "$build_script" \ - 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz}' \ + 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.189.tar.gz}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING require_marker "$build_script" \ - 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92}' \ + 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING require_marker "$release_dockerfile" \ 'ARG CATALOG_SERVICE_VERSION=0.20.13' \ @@ -1059,10 +1059,10 @@ require_marker "$build_script" \ '--file server/Dockerfile.web-compose-release' \ SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING require_marker "$build_script" \ - 'image=${IMAGE:-pasturestack-validation/server:v1.6.533}' \ + 'image=${IMAGE:-pasturestack-validation/server:v1.6.534}' \ SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING require_marker "$build_script" \ - 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533}' \ + 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.534}' \ SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING require_marker "$build_script" \ 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \ @@ -2158,7 +2158,7 @@ done jq -e ' ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves | .["@context"] == "https://openvex.dev/ns/v0.2.0" - and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533" + and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.534" and (.statements | length) == 69 and ([.statements[].vulnerability.name] | length == (unique | length)) and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort) @@ -2196,7 +2196,7 @@ jq -r ' | @tsv ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture" bash "$vendor_pending_validator" "$runtime_vendor_pending" \ - "$vendor_pending_fixture" v1.6.533 >/dev/null + "$vendor_pending_fixture" v1.6.534 >/dev/null bash scripts/test-vendor-pending-findings.sh >/dev/null rm -f "$vendor_pending_fixture" trap - EXIT @@ -2285,4 +2285,4 @@ for release_readback_contract in \ fi done -printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n' +printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.534 base=v1.6.460 engine=0.183.348 web_console=1.6.189 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n' diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py index 9bc1d84858..0ebe964e48 100644 --- a/scripts/test-current-server-packaging-contract.py +++ b/scripts/test-current-server-packaging-contract.py @@ -17,21 +17,21 @@ PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。' STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`' COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING' -WEB_SHA = '3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92' -WEB_SOURCE = '8e12216fd6f8d843ed043b4c0afcec995d33caeb' +WEB_SHA = '1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc' +WEB_SOURCE = 'f30f5e81dd9ee25878c3aff681eed5bb61883453' CATALOG_COMMIT = 'b6b658888fce50d3ec217eb4eba0f26ab0113baf' ENGINE_SHA = '72581f6eead8633b6bbafbe15512cd44561b9ff25df68d00dd7120ad507aa449' ENGINE_SOURCE = 'f19cd64183c0fa93464e9a9f9c2477c9e902b56d' OLD_COORDINATES = { - 'v1.6.533': 'v1.6.521', - '1.6.188': '1.6.181', + 'v1.6.534': 'v1.6.521', + '1.6.189': '1.6.181', WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03', WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550', CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3', } -# Engine348 and Web188 use the reviewed component input identities. +# Engine348 and Web189 use the reviewed component input identities. # Published521 component values remain mutation controls. -# Component coordinates do not establish Server533 artifact/runtime PASS. +# Component coordinates do not establish Server534 artifact/runtime PASS. CATALOG_FIELDS = ( ('VERSION', 'version', '0.20.13'), ('COMMIT', 'commit', '4c39c73a8131ba06e9ff0aaec3b95cc27e049324'), @@ -47,19 +47,19 @@ } EXPECTED = { COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508), - 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.533'), + 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.534'), 'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'), 'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.188'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.189'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.189.tar.gz'), 'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA), 'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz}'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.189}'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.189.tar.gz}'), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'), - 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.533}'), - 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533}'), + 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.534}'), + 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.534}'), 'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'), 'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'), 'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'), @@ -470,15 +470,15 @@ def verify(files, gate=GATE): pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))' if len(re.findall(pipeline, source)) != 1: raise AssertionError('CURRENT_CATALOG_HASH_BYPASS') - if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533"' not in gate: + if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.534"' not in gate: raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH') - if '"$vendor_pending_fixture" v1.6.533 >/dev/null' not in gate: + if '"$vendor_pending_fixture" v1.6.534 >/dev/null' not in gate: raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH') - if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.533': + if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.534': raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH') - if json.loads(files[VENDOR]).get('release') != 'v1.6.533': + if json.loads(files[VENDOR]).get('release') != 'v1.6.534': raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH') - if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 ' not in gate: + if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.534 base=v1.6.460 engine=0.183.348 web_console=1.6.189 catalog_service=0.20.13 ' not in gate: raise AssertionError('CURRENT_SUMMARY_MISMATCH') verify_incremental_contract(files, gate) @@ -492,11 +492,11 @@ def previous_gate(gate=GATE): if stale(marker) != marker: replacements["'" + marker + "' "] = "'" + stale(marker) + "' " replacements.update({ - 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533"': + 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.534"': 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"', - '"$vendor_pending_fixture" v1.6.533 >/dev/null': + '"$vendor_pending_fixture" v1.6.534 >/dev/null': '"$vendor_pending_fixture" v1.6.521 >/dev/null', - 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 ': + 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.534 base=v1.6.460 engine=0.183.348 web_console=1.6.189 catalog_service=0.20.13 ': 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ', }) for marker, stale_marker in replacements.items(): diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release index bc05b7e003..0a70d0ad2d 100644 --- a/server/Dockerfile.web-compose-release +++ b/server/Dockerfile.web-compose-release @@ -55,9 +55,9 @@ ARG NODE_AGENT_BINARY_SHA256=ce8342e10da07c50cc414b471cadc67db4dd390e6e2dcb632b3 ARG NODE_AGENT_APPLY_SHA256=dd8cb342518a43e7468cc121db5c4e44b16731f2620b77ea0fd03c02c03766a9 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download -ARG WEB_CONSOLE_RELEASE_TAG=1.6.188 -ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz -ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92 +ARG WEB_CONSOLE_RELEASE_TAG=1.6.189 +ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.189.tar.gz +ARG WEB_CONSOLE_ARTIFACT_SHA256=1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download ARG CATALOG_SERVICE_VERSION=0.20.13 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324 @@ -574,7 +574,7 @@ FROM ${BASE_IMAGE} ARG SOURCE_DATE_EPOCH ARG PASTURESTACK_SERVER_REVISION -ARG SERVER_RELEASE_TAG=v1.6.533 +ARG SERVER_RELEASE_TAG=v1.6.534 ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.348 ARG ORCHESTRATION_ENGINE_VERSION=0.183.348 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233 @@ -594,9 +594,9 @@ ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2 ARG LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1 ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3 -ARG WEB_CONSOLE_RELEASE_TAG=1.6.188 -ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92 -ARG WEB_CONSOLE_COMMIT=8e12216fd6f8d843ed043b4c0afcec995d33caeb +ARG WEB_CONSOLE_RELEASE_TAG=1.6.189 +ARG WEB_CONSOLE_ARTIFACT_SHA256=1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc +ARG WEB_CONSOLE_COMMIT=f30f5e81dd9ee25878c3aff681eed5bb61883453 ARG CATALOG_SERVICE_VERSION=0.20.13 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324 ARG CATALOG_SERVICE_ARCHIVE_SHA256=29626181cb8489b016e5975ffaddc00b2a32d290b1c0066e833d27fa7a5edf83 diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh index 218f5f3dfd..2a52ab1621 100755 --- a/server/build-api-explorer-patch-image.sh +++ b/server/build-api-explorer-patch-image.sh @@ -14,7 +14,7 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then fi revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)} -server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533} +server_release_tag=${SERVER_RELEASE_TAG:-v1.6.534} source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403} orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download} @@ -48,10 +48,10 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.18.tar.gz} api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-92b718c46163018ea40c008ac552911f0eb610647377725405f4046dcd411f2c} api_explorer_commit=${API_EXPLORER_COMMIT:-3b1c39e8a116f58649d94233a384a0362c02b43e} web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download} -web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188} -web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz} -web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92} -web_console_commit=${WEB_CONSOLE_COMMIT:-8e12216fd6f8d843ed043b4c0afcec995d33caeb} +web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.189} +web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.189.tar.gz} +web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc} +web_console_commit=${WEB_CONSOLE_COMMIT:-f30f5e81dd9ee25878c3aff681eed5bb61883453} catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download} catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.13} catalog_service_commit=${CATALOG_SERVICE_COMMIT:-4c39c73a8131ba06e9ff0aaec3b95cc27e049324} @@ -101,7 +101,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-5ce usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-e62a21270142181315293d7e11482288ffe8fc4d91cc8fe07dacc90b461f3709} supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0' newest_docker_version=v29.8.0 -image=${IMAGE:-pasturestack-validation/server:v1.6.533} +image=${IMAGE:-pasturestack-validation/server:v1.6.534} build_options=() [[ "$revision" =~ ^[0-9a-f]{40}$ ]] diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh index 9f369538e2..27a5af2c89 100755 --- a/server/build-component-candidate.sh +++ b/server/build-component-candidate.sh @@ -14,10 +14,10 @@ for name in "${required[@]}"; do case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac export "$name" done -export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.533} +export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.534} export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.348} export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar -export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.188} +export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.189} export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz" export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.15} export HOST_API_VERSION=${HOST_API_VERSION:-0.38.5} diff --git a/server/security/openvex.json b/server/security/openvex.json index d65c535614..4070c04354 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.533", + "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.534", "author": "PastureStack Security", "timestamp": "2026-10-15T00:38:08Z", - "version": 54, + "version": 55, "statements": [ { "vulnerability": { diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index cd3e54b349..d5f76e38c8 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "release": "v1.6.533", + "release": "v1.6.534", "generatedAt": "2026-10-14T00:00:00Z", "policy": { "allowedSeverities": [