Skip to content

Release v1.0.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jun 07:59
v1.0.5
236d0f4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bifrost v1.0.5

v1.0.5 expands the Solutions system into a fuller export/import and file-scoped packaging flow, then hardens the release with dependency updates and test stabilization. This release includes 26 commits since v1.0.0.

Features

  • Expanded Solution file storage with declared file locations, solution-scoped file metadata, read-only managed files, and Backup exports that include file payloads when selected (#406).
  • Added scheduler-backed Solution export jobs so larger exports run asynchronously and can be downloaded after completion (#406).
  • Refined Solution import/export UX, including entity counts, setup/readme polish, readonly lock affordances, and clearer Backup options (#406).
  • Shipped Solution source artifacts and manifest serialization improvements so deploys round-trip apps, workflows, configs, policy refs, events, schedules, and files more reliably (#391, #392, #393, #406).
  • Improved Solution deploy CLI behavior with async deploy status, clearer deploy phases, file-aware push help, and workflow execution fixes (#388, #389).

Reliability

  • Fixed the recurring form-RBAC E2E teardown flake by making teardown best-effort where stale state was polluting later tests (#385).
  • Fixed docs screenshot capture for passkey flows by shimming WebAuthn support in the docs capture runner (#407).
  • Updated docs tooling for js-yaml v5 namespace imports and refreshed Bifrost 1.0.5 docs screenshots in the docs repo.
  • Verified the release gate with release-check.sh v1.0.5: 5048 passed, 2 skipped, 19 deselected.

Security & Supply-Chain Hardening

  • Bumped esbuild in app-bundler/sdk-package/docs tooling, fixing GHSA-g7r4-m6w7-qqqr and GHSA-gv7w-rqvm-qjhr (#384).
  • Bumped DOMPurify from 3.4.1 to 3.4.10+ and locked transitive consumers through overrides, resolving the repo's DOMPurify alert set described in #386.
  • Landed Dependabot updates for Python/API images, Node, nginx, Playwright, GitHub Actions, Atlaskit drag-and-drop packages, jsdom, Babel standalone, js-yaml, and other npm minor/patch dependencies (#374, #375, #376, #383, #394-#405).
  • Updated release/plugin metadata to 1.0.5 so Claude/Codex plugin consumers receive the current skill content (#407).

Breaking Changes

None requiring operator action.

Behavioral note: Solution-managed resources are stricter about readonly behavior and declared file scope. Writes to undeclared Solution file locations are blocked, and Backup exports now run through export jobs rather than as a long synchronous request.

Contributors

None external in this release. Contributor scan found PRs from @jackmusick and app/dependabot only.

Fixed CVEs / Advisories

Docker Images

API:

docker pull ghcr.io/gobifrost/bifrost-api:v1.0.5

Client:

docker pull ghcr.io/gobifrost/bifrost-client:v1.0.5

Signed artifacts (Sigstore / cosign - keyless)

Each release asset has a matching .sigstore bundle: Sigstore's self-contained signature, certificate, and Rekor inclusion proof, produced via keyless OIDC.

Verify with cosign (>= v2.4):

cosign verify-blob \
  --bundle bifrost-v1.0.5-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/gobifrost/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v1.0.5-source.tar.gz

A SLSA build-provenance attestation is also published and verifiable via:

gh attestation verify bifrost-v1.0.5-source.tar.gz \
  --owner gobifrost
Assets 5
Loading