From 224a0edf94dc942503107b9c4df3b54d7da0df9f Mon Sep 17 00:00:00 2001 From: nicodes Date: Thu, 29 Oct 2026 16:03:13 -0600 Subject: [PATCH 1/2] Move to komizo 0.2.6 0.2.6 builds the gate proxy's Caddy with golang.org/x/net 0.62.0 (GO-2026-6860, GO-2026-6866) and verifies nested dependency repairs. Relocked with the attested v0.2.6 release; setup/run action pins move to its source commit. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 4 ++-- .github/workflows/dependency-policy.yml | 2 +- komizo.lock | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7022133..37e3605 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: with: persist-credentials: false - name: Set up locked komizo - uses: nicodes/komizo/setup@40086036977a5fc0119d6c4c1d5eb6ae3ab3b4b9 + uses: nicodes/komizo/setup@54da2b6d20fda9febf3cd02039424a1a8249cffb env: GH_TOKEN: ${{ github.token }} timeout-minutes: 5 @@ -49,6 +49,6 @@ jobs: retention-days: 7 include-hidden-files: true - name: Check project - uses: nicodes/komizo/run@40086036977a5fc0119d6c4c1d5eb6ae3ab3b4b9 + uses: nicodes/komizo/run@54da2b6d20fda9febf3cd02039424a1a8249cffb with: target: check diff --git a/.github/workflows/dependency-policy.yml b/.github/workflows/dependency-policy.yml index db01d64..755ca95 100644 --- a/.github/workflows/dependency-policy.yml +++ b/.github/workflows/dependency-policy.yml @@ -45,7 +45,7 @@ jobs: ref: main timeout-minutes: 3 - name: Set up locked komizo - uses: nicodes/komizo/setup@40086036977a5fc0119d6c4c1d5eb6ae3ab3b4b9 + uses: nicodes/komizo/setup@54da2b6d20fda9febf3cd02039424a1a8249cffb env: GH_TOKEN: ${{ github.token }} timeout-minutes: 5 diff --git a/komizo.lock b/komizo.lock index c631ea8..1c698ca 100644 --- a/komizo.lock +++ b/komizo.lock @@ -1,8 +1,8 @@ { "version": 1, - "platform": "0.2.4", - "platform_revision": "40086036977a5fc0119d6c4c1d5eb6ae3ab3b4b9", + "platform": "0.2.6", + "platform_revision": "54da2b6d20fda9febf3cd02039424a1a8249cffb", "manifest_sha256": "65025749be58a049eacdcb50caf62fdfdec91c7bc73608244d33fa4c5ae28ed6", - "runtime_sha256": "000c1991c455b7e1269646e40c05ebf4a1b0717197c34838d2b7669430b3e862", + "runtime_sha256": "d4aee3bbfbc8c9253d1e1663790d58fd88374f61da2a68a7e558b5127bfb67fb", "recipe_sha256": "e519f5bc5d0100fcfe922762ea2a440ef09f1b45b4f25dc3488f14f3638ee2a6" } From 06ef85d30b164500dd38a7bd0bf7b54d88040398 Mon Sep 17 00:00:00 2001 From: nicodes Date: Thu, 29 Oct 2026 16:35:46 -0600 Subject: [PATCH 2/2] Move to komizo 0.2.7 0.2.7 also builds the gate proxy's Caddy with go-jose 4.1.6 (CVE-2026-116587). Relocked with the attested v0.2.7 release; setup/run action pins move to its source commit. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 4 ++-- .github/workflows/dependency-policy.yml | 2 +- komizo.lock | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 37e3605..0bbb1dc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: with: persist-credentials: false - name: Set up locked komizo - uses: nicodes/komizo/setup@54da2b6d20fda9febf3cd02039424a1a8249cffb + uses: nicodes/komizo/setup@1b740f28682948a2d5eb4613744bb262d2056e6c env: GH_TOKEN: ${{ github.token }} timeout-minutes: 5 @@ -49,6 +49,6 @@ jobs: retention-days: 7 include-hidden-files: true - name: Check project - uses: nicodes/komizo/run@54da2b6d20fda9febf3cd02039424a1a8249cffb + uses: nicodes/komizo/run@1b740f28682948a2d5eb4613744bb262d2056e6c with: target: check diff --git a/.github/workflows/dependency-policy.yml b/.github/workflows/dependency-policy.yml index 755ca95..80d4c19 100644 --- a/.github/workflows/dependency-policy.yml +++ b/.github/workflows/dependency-policy.yml @@ -45,7 +45,7 @@ jobs: ref: main timeout-minutes: 3 - name: Set up locked komizo - uses: nicodes/komizo/setup@54da2b6d20fda9febf3cd02039424a1a8249cffb + uses: nicodes/komizo/setup@1b740f28682948a2d5eb4613744bb262d2056e6c env: GH_TOKEN: ${{ github.token }} timeout-minutes: 5 diff --git a/komizo.lock b/komizo.lock index 1c698ca..25e43b0 100644 --- a/komizo.lock +++ b/komizo.lock @@ -1,8 +1,8 @@ { "version": 1, - "platform": "0.2.6", - "platform_revision": "54da2b6d20fda9febf3cd02039424a1a8249cffb", + "platform": "0.2.7", + "platform_revision": "1b740f28682948a2d5eb4613744bb262d2056e6c", "manifest_sha256": "65025749be58a049eacdcb50caf62fdfdec91c7bc73608244d33fa4c5ae28ed6", - "runtime_sha256": "d4aee3bbfbc8c9253d1e1663790d58fd88374f61da2a68a7e558b5127bfb67fb", + "runtime_sha256": "e85ed5057a15b6432600b5596aacbc967179122757378b61dc4247a101db8f9b", "recipe_sha256": "e519f5bc5d0100fcfe922762ea2a440ef09f1b45b4f25dc3488f14f3638ee2a6" }