From 87d8bfc426df887ecdd1ca911f2866fc868aa579 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 19:59:36 +0000 Subject: [PATCH 1/3] chore: update toolchain --- .github/workflows/codecov-upload.yml | 2 +- .github/workflows/docs-to-issues.yml | 2 +- .github/workflows/e2e-tests-split.yml | 2 +- .github/workflows/nightly-build.yml | 2 +- .github/workflows/propagate-changes.yml | 2 +- .github/workflows/quality-checks.yml | 2 +- .github/workflows/weekly-nightly-promotion.yml | 2 +- Dockerfile | 2 +- frontend/.nvmrc | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codecov-upload.yml b/.github/workflows/codecov-upload.yml index b71d4c882..c8f2ccf1c 100644 --- a/.github/workflows/codecov-upload.yml +++ b/.github/workflows/codecov-upload.yml @@ -28,7 +28,7 @@ concurrency: cancel-in-progress: true env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' GOTOOLCHAIN: auto permissions: diff --git a/.github/workflows/docs-to-issues.yml b/.github/workflows/docs-to-issues.yml index 66634577d..37f9fd024 100644 --- a/.github/workflows/docs-to-issues.yml +++ b/.github/workflows/docs-to-issues.yml @@ -23,7 +23,7 @@ concurrency: cancel-in-progress: false env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' permissions: contents: read diff --git a/.github/workflows/e2e-tests-split.yml b/.github/workflows/e2e-tests-split.yml index 00712823b..d4d07366c 100644 --- a/.github/workflows/e2e-tests-split.yml +++ b/.github/workflows/e2e-tests-split.yml @@ -114,7 +114,7 @@ on: - '.github/workflows/e2e-tests-split.yml' env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' GOTOOLCHAIN: auto DOCKERHUB_REGISTRY: docker.io IMAGE_NAME: ${{ github.repository_owner }}/charon diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 90fb617b0..43252cd3c 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -15,7 +15,7 @@ on: default: "false" env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' GOTOOLCHAIN: auto SYFT_VERSION: 'v1.57.1' GHCR_REGISTRY: ghcr.io diff --git a/.github/workflows/propagate-changes.yml b/.github/workflows/propagate-changes.yml index e814a8636..c2582efc1 100644 --- a/.github/workflows/propagate-changes.yml +++ b/.github/workflows/propagate-changes.yml @@ -25,7 +25,7 @@ concurrency: cancel-in-progress: false env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' permissions: contents: read diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml index 5aded59ac..5d3c39eac 100644 --- a/.github/workflows/quality-checks.yml +++ b/.github/workflows/quality-checks.yml @@ -16,7 +16,7 @@ permissions: checks: write env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' GOTOOLCHAIN: auto jobs: diff --git a/.github/workflows/weekly-nightly-promotion.yml b/.github/workflows/weekly-nightly-promotion.yml index f10dcec08..373852967 100644 --- a/.github/workflows/weekly-nightly-promotion.yml +++ b/.github/workflows/weekly-nightly-promotion.yml @@ -29,7 +29,7 @@ concurrency: cancel-in-progress: false env: - NODE_VERSION: '26.13.0' + NODE_VERSION: '26.13.1' SOURCE_BRANCH: 'nightly' TARGET_BRANCH: 'main' diff --git a/Dockerfile b/Dockerfile index cd981480e..ff3e2a1ab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -657,7 +657,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ _retry go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.47.0; \ # CVE-2026-41889: SQL Injection via placeholder confusion with dollar quoted string literals # renovate: datasource=go depName=github.com/jackc/pgx/v5 - _retry go get github.com/jackc/pgx/v5@v5.12.0; \ + _retry go get github.com/jackc/pgx/v5@v5.13.0; \ # renovate: datasource=go depName=github.com/russellhaering/goxmldsig _retry go get github.com/russellhaering/goxmldsig@v1.6.1; \ # CVE-2026-32952: go-ntlmssp DoS via malicious NTLM challenge response diff --git a/frontend/.nvmrc b/frontend/.nvmrc index 1dda03ddb..a2e8115a7 100644 --- a/frontend/.nvmrc +++ b/frontend/.nvmrc @@ -1 +1 @@ -26.13.0 +26.13.1 From be7c3e4faf91c7d53b8883f62cb83ea785ba1b31 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 20:17:26 +0000 Subject: [PATCH 2/3] chore(docker): sync toolchain image pin to caddy-crowdsec-5d9ab03bdfd93f5a --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index ff3e2a1ab..d376f4c25 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64. -ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-1937000e58add6a1 -ARG CHARON_TOOLCHAIN_DIGEST=sha256:7f516a69316ebac828933ca70598f44be0ff05ae186bd5ba481a54f2efbeb0d4 +ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-5d9ab03bdfd93f5a +ARG CHARON_TOOLCHAIN_DIGEST=sha256:89157c7db370ce1972ac8e89cafb8e1d2b5e137decae784d584663b8e4a81380 # Stage selector — default consumes the prebuilt toolchain image (no compile). # Fork PRs / bootstrap / offline builds pass From 5c9f8659abcc412d2b19f786d52a9d766ea7df5d Mon Sep 17 00:00:00 2001 From: Wikid82 Date: Wed, 11 Nov 2026 15:20:30 -0500 Subject: [PATCH 3/3] chore(deps): update crewjam/saml to version v0.5.1 --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d376f4c25..62be2d8ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -677,7 +677,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ _retry go get github.com/crowdsecurity/crowdsec@v${CROWDSEC_VERSION}; \ # CVE-2026-56864 / CVE-2026-56865: golang.org/x/mod/sumdb GOSUMDB tile-verification bypass # (a colluding GOPROXY+GOSUMDB pair could forge sumdb tiles / serve module content outside - # the transparency log). Affects /usr/bin/caddy — go mod tidy's MVS resolution otherwise + # the transparency log). Affects /usr/bin/caddy — go mod tidys MVS resolution otherwise # lands on an older, vulnerable version. Fix available at v0.40.0. Same pattern as the # crowdsec-builder pin below. _retry go get golang.org/x/mod@v${XMOD_VERSION}; \ @@ -704,7 +704,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ _retry go get github.com/caddyserver/caddy/v2@v${CADDY_VERSION}; \ # Final re-pin: grpc-go (CVE-2026-84304). MUST come after the OpenTelemetry # go.get block above: `go get .../otlp*http@v0.19.0 / v1.43.0` is a *downgrade*, - # and go get's downgrade cascade drags google.golang.org/grpc back down to the + # and go gets downgrade cascade drags google.golang.org/grpc back down to the # v1.83.0-dev that otel v1.43.0 requires (v1.83.1 => v1.83.0-dev => v1.83.0 in # the build log), silently undoing the earlier pin. Re-pinning here — with grpc # named on the command line so it is held fixed — and letting `go mod tidy`