v2.2.5

Features

• Note '(no communication)' in the report when a build has no outbound traffic (#202)
  • Previously a quiet build was indistinguishable from a report that failed to generate — both rendered nothing between the heading and footer. Adds a _(no communication)_ note whenever nothing passed and nothing was blocked.
• Fail the report when the proxy log shows no trace of a real run (#205)
  • determineBlockedOutcome treated an empty blocked count as an automatic pass, even when a log had been wiped down to nothing by a tampering or misbehaving step between setup/run and report. Adds a plausibility check requiring some non-decision log content before treating a build as genuinely quiet.

Security

• Harden IPv6 egress blocking and its documentation (#203)
  • Neither engine's init-iptables had a fallback for kernels without IPv6 support, so ip6tables running under set -e could fail container startup outright instead of degrading gracefully. Now checks /proc/net/if_inet6 first and only skips ip6tables when the kernel truly lacks IPv6 support.

Refactoring

• Consolidate core/lib, core/shared, and core/scripts/lib into core/lib (#192)
  • Library code was scattered across four locations with different runtime contracts, and telling which APIs a file could safely use required checking its directory rather than the file itself. Everything now lives in core/lib, tested under both Node and QuickJS by make test_core/make test_qjs.
• Bake report generation into the image to fix setup/report skew (#199)
  • setup and report are independent steps that can be pinned to different refs, so report-building logic could drift from the image setup actually built. Each engine's image now bakes in its own report script, which report fetches via docker cp and runs locally.
• Unify Docker-image script build pipeline (#200)
  • Merges the separate QuickJS and report-action Rolldown configs and Docker build stages into one, choosing each entry point's build settings by filename suffix instead of a hardcoded target.
• Reorganize Makefile targets and drop the node -e project-name lookup (#201)
  • Replaces a per-invocation node -e shell-out for COMPOSE_PROJECT_NAME with a fixed value pinned via Make pattern-specific variables, and renames every target into a consistent {verb}_{category}_... scheme grouped by Unit Tests / Integration Tests.
• Stream proxy log reads and aggregate them incrementally (#206)
  • Reading a proxy's traffic log meant buffering the whole file and re-scanning it up to three times; a build that hit the same host many times (e.g. a dependency-install retry loop) risked exceeding the buffer. Logs are now streamed and aggregated into host/port/rule/reason counts in a single forward pass.

Documentation

• Drop the unused step id and self-hosting cruft from setup examples (#207)
  • Removes the never-referenced id: buildcage step id, commented-out GHCR login steps, and unexplained DOCKER_BUILD_SUMMARY/DOCKER_BUILD_RECORD_UPLOAD env vars from the Quick Start and reference examples, since self-hosting already has its own dedicated guide.

Dependencies

• Bump golang.org/x/net to v0.56.0 and golang.org/x/text to v0.39.0 in buildkit-proxy, clearing known vulnerabilities in each (GO-2026-5942, GO-2026-5970) (#208)
• Bump self-referential dash14/buildcage action pin to v2.2.4 (#193)
• Bump @types/node to v24.13.3 (#194)
• Bump fast-check to v4.9.0 (#195)
• Bump github/codeql-action to v4.37.0 (#196)
• Bump golang Docker tag to v1.26 (#197)
• Bump pnpm to v11.11.0 (#198)

Full Changelog: v2.2.4...v2.2.5