Skip to content

PastureStack Compose CLI v0.14.33

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 14 Aug 03:41
v0.14.33
af47214

PastureStack maintenance release for the Compose compatibility toolchain.

Security and reliability changes:

  • confines local env_file and secret reads to the selected Compose-file directories;
  • rejects traversal, absolute-path, and symbolic-link escapes while preserving valid local files;
  • keeps remote executor requests fail-closed without a local resource root;
  • updates the reproducible toolchain to Go 1.26.6 and Python 3.14.6;
  • removes the unused Docker CLI and Docker socket from the isolated Dapper builder;
  • validates normal and malicious resource-boundary cases, race detection, vet, integration compatibility, and two identical builds;
  • publishes source and product CycloneDX SBOMs with deterministic release archives.

Source commit: af47214c648857d31c993a4e1aaf612c876a7376

Security results:

  • CodeQL Critical/High: 0/0
  • source Critical/High/secrets: 0/0/0
  • product Critical/High/secrets: 0/0/0
  • applicable builder Critical/High: 0/0

Asset SHA-256 values are recorded in SHA256SUMS.

This release has not been deployed to an operator control plane.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

Assets 9
Loading