Skip to content

v2.1.6

Choose a tag to compare

View all tags
@scottgigawatt scottgigawatt released this 11 Oct 01:59
· 3 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.1.6
32f655d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Buccaneerr returns to the official Compose 5.6.0 binary and Alpine actionlint package, reducing maintenance of custom Go builds. Docker CLI 29.9.0, smol-toml 1.9.1, virtualenv 21.14.6, filelock 4.1.0, and python-discovery 1.6.2 are retained or updated. The production Privateerr application and Dockerfile are unchanged; rebuilding refreshes artifact metadata and available Alpine packages.

The security guidance records three temporary, exact-path Go advisory exceptions for the supported test-tool invocation boundaries, expiring October 23, 2026. Full artifact reviews remain unfiltered; these exceptions do not mean all scanner findings are resolved.

Renovate now batches tooling maintenance monthly and Docker/PIA updates weekly in New York time. Major updates require separate dashboard approval; vulnerability fixes remain eligible for immediate manual review.

Documentation tooling and pinned CodeQL actions are updated. The release includes the full reviewed changes since v2.1.5.

Final artifact verification confirms zero unfiltered Trivy and Scout findings for production Privateerr on all three supported platforms. Buccaneerr retains 34 Trivy instances / 16 identifiers in comprehensive mode and 44 Scout instances / 36 identifiers per platform; all finding sets match the reviewed edge artifacts. Registry aliases, supported platforms, labels, SBOMs, provenance, and cryptographic attestations are verified against the annotated tag and source commit.

Trivy comprehensive mode includes APK-owned Go libraries that default mode treats through Alpine advisories. This exposes CVE-2026-78669 in actionlint; that finding remains unexcluded. Exact official actionlint 1.7.12 source reviews found no HTTP client/server path in its runtime CLI; networked generator scripts are separate programs. This is a package-version finding with no reachable supported path identified in the source review. No extracted-APK binary or callgraph proof was performed; this is not a confirmed false positive or proof that every dependency or unsupported invocation is safe.

Assets 3
Loading