Skip to content

kit 1.31.0

Choose a tag to compare

View all tags
@sandstream sandstream released this 24 Jul 22:22
v1.31.0
9174052
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • JVM dependency CVE scan now covers Gradle + nested projects (#110, follow-up to #67). checkMavenAudit only detected pom.xml at depth ≤1, so Gradle projects (build.gradle/build.gradle.kts) and Maven/Gradle projects in monorepo subdirs (services/backend/pom.xml) passed the gate green — the exact false-green #67 set out to close, for the other half of the JVM ecosystem. Now: detects Maven and Gradle via a depth-≤3 BFS (skipping vendor/build dirs); a Gradle project without a gradle.lockfile warns (trivy sees only direct deps) instead of skipping green, mirroring the ~/.m2 handling. Pure jvmProjectKind + findJvmProject fixture-tested.

Full changelog: https://github.com/sandstream/kit/blob/v1.31.0/CHANGELOG.md

Verify this release:

git tag -v v1.31.0
npm audit signatures
Assets 4
Loading