v3.6.5

Upgrading note: self-hosted Linux runners need glibc 2.34 or later for Semgrep

This release fixes the remaining HIGH advisories in the official image: golang.org/x/mod 0.40.0 and MCP 1.29.0, through Semgrep 1.182.1. No Semgrep release with the MCP fix publishes Linux wheels for glibc older than 2.34; they need manylinux_2_34, or musllinux_1_2 on musl. Semgrep 1.141.0, in v3.6.4, needed only glibc 2.17.

• Affected: the GitHub Action, or any other install of this release's Python dependencies, on a self-hosted Linux runner with glibc older than 2.34. Examples: Ubuntu 20.04, Debian 11, RHEL/Rocky/AlmaLinux 8, Amazon Linux 2.
• What happens: the install succeeds but Semgrep can't run (no semgrep-core). The scan records semgrep as failed and coverage as incomplete, and the gate is decided by the analyzers that ran.
• Not affected: GitHub-hosted runners, the official image (docker.io/fendixapp/fendix@sha256:ddf07e334b34ae40292e64aeb37a55e79eadc3e44461a13423b6127cc83017ef, Debian 13) and hosts with glibc 2.34 or later.
• What to do: use the official image or a runner with glibc 2.34 or later. Add extra-args: --require-analyzers semgrep to fail the job, with exit 2, when Semgrep doesn't run.

Full details: CHANGELOG.md, 3.6.5, including its Upgrading section.

What's Changed

• fix(security): v3.6.5 - x/mod 0.40.0, Semgrep 1.182.1 / MCP 1.29.0, lock-installed images by @Abdel-RahmanSaied in #134

Full Changelog: v3.6.4...v3.6.5