Skip to content

v0.7.7 — Dependency and security update

Latest
Latest

Choose a tag to compare

View all tags
@puemos puemos released this 29 Oct 07:36
v0.7.7
d080086
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Updates application dependencies, documentation tooling, runtimes, and release infrastructure across Craftplan.

  • Update Ash to 3.37.2, AshPostgres to 2.15.2, Phoenix to 1.8.16, and LiveView to 1.2.13, including upstream authorization, validation, and URL-handling security fixes.
  • Upgrade Elixir to 1.20.4 and Erlang/OTP to 28.5.0.8. Replace end-of-life Node 20 with Node 24.22.2. Move application images to Debian 13 and ncurses 6.
  • Upgrade Money, Ecto, admin, storage clients, Astro, React, Tailwind, esbuild, and compatible transitive dependencies. Money formatting now uses Localize in place of the removed CLDR backend.
  • Update SeaweedFS to 4.51, rclone to 1.75.2, and the legacy migration binary. Rebuild storage tools with patched Go, JOSE, Chi, and x/net dependencies.
  • Update the vendored topbar 2 progress bar to managed topbar 3.0.1.
  • Add dependency audits, Phoenix static analysis, documentation builds, and image vulnerability gates for fixable high/critical advisories to CI. Pin GitHub Actions to reviewed release commits.

Validation:

  • 465 application tests passed with the standard parallel runner, plus all five isolated SMTP tests (one existing application test remains skipped).
  • GitHub reports zero open dependency alerts after the update.
  • Real MinIO-to-SeaweedFS migration, upload, signed URL, persistence, deletion, retry, and clean-install checks passed.
  • Documentation, frontend, production release builds, browser rendering, dependency/code audits, and migration consistency checks passed.

Upgrade notes:

  • The Docker entrypoint runs migrations automatically. For manual releases, run database migrations before starting v0.7.7. The included migration updates Ash's required-value SQL helper to extension version 7; it does not change application tables or remove data.
  • The Timex dependency still declares Gettext 0.x. A documented override uses API-compatible Gettext 1.x; calendar behavior is covered by the integration suite.
  • Two package advisories remain acknowledged because they affect unused Cloak AES-CTR/PBKDF2 functionality. Craftplan uses AES-GCM for encrypted fields, with a regression test confirming ciphertext authentication. See CVE-2026-95105 and CVE-2026-94206.
  • Assent remains on the latest version compatible with AshAuthentication. GraphQL tooling remains on GraphQL 16 for SpectaQL compatibility.

The Debian 13 base still has vendor-reported advisories without available fixes. These are retained in full audit results; release gates reject high/critical findings when a fixed version is available. The storage image has no high/critical findings.

Published app and storage images support Linux AMD64 and ARM64. All four complete audit reports are attached to this release. The verified image publishing run records the build, scan, and manifest checks.

Assets 6
Loading