Skip to content

Kassinão v1.4.9

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Jul 05:18
Immutable release. Only release title and notes can be modified.
v1.4.9
9f4e817
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • The production image now removes bundled package managers and their global dependency trees after the build stage. Kassinão executes only node at runtime, so npm, npx, Corepack, Yarn, and related unused shims no longer expand the image attack surface.
  • The v1.4.8 workflow passed source audit, multi-architecture build, OCI provenance, anonymous pulls, and hardened runtime execution, then stopped on fixable high-severity vulnerabilities inside the base image's unused npm installation. It produced no version or rolling image tags, operations bundle, checksum, or GitHub Release.

Imagem OCI multiarch por digest: ghcr.io/resolvicomai/kassinao@sha256:2141c4414d63abb1f24ce8a22d2dade4e1a700d0e10959d11ba139aa67aec0c3.

O kit operacional não contém source nem credenciais. Verifique checksum e attestations antes do deploy. A imagem final passou pelo gate Trivy atual em amd64 e arm64.

Assets 5
Loading