Skip to content

Colonizer v0.2.23

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 21:35
Immutable release. Only release title and notes can be modified.
v0.2.23
88dcf22
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Colonizer v0.2.23

What's new

  • Dependency audit fixes supply-chain vulnerabilities. The Claude Code module's ip-address (10.7.3 → 10.7.4) fixes GHSA-rxp7-6hxx-x8q5: Address6 zone identifier parsing that ran in quadratic time (a single long string could stall the process); it comes in through @modelcontextprotocol/sdk → express-rate-limit as a runtime dependency of the agent module. The cockpit's dompurify override goes 3.4.16 → 3.4.17, clearing GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr. The bundled DOMPurify 3.4.15 in monaco-editor 0.57.0 still runs in the cockpit, since monaco imports its own copy and sets neither SAFE_FOR_TEMPLATES nor IN_PLACE, so neither advisory is reachable through it; the bundled copy updates when monaco releases a newer version.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 88dcf22.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

aeab18f273e7b2f54297250b8f0c6d7f3d0f8fbfcada75b60cac219f449e11b7  colonizer-darwin-arm64.tar.gz
8723d1b9ede4bbed2660e265f986ecacce8475752f01313fdee541e070873cd1  colonizer-linux-x86_64.tar.gz
cb29fe3a8ec4cb8f30f64e0450e58a43bae3b67b978e00bf9109b33dff1f8bdb  colonizer-observability-darwin-arm64.tar.gz
3e5571a59e8dde8d8ef4c53a36cc663184da23c62280ef984671c10dcc216b1c  colonizer-observability-linux-x86_64.tar.gz
197288486132125d7e0036883f8dde42cb9c1ae5e5b86f7310b754c37931d7db  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh
Assets 10
Loading