Repository navigation
Release v0.12.0 - #339
Merged
Merged
Release v0.12.0#339
Conversation
…undry-toolchain 1.9.2 (#335) Lands four Dependabot PRs together, because each fails validate-inventory on its own: the licence inventory rows are hand-maintained. - express 5.2.1 -> 5.3.0 and jest 30.4.2 -> 30.5.2 in nb-bond-api - @vitejs/plugin-react 6.1.1 -> 6.1.2 in nb-ui - foundry-rs/foundry-toolchain 1.9.1 -> 1.9.2 (new pinned commit) in Contracts CI, still installing Foundry v1.8.6 The lockfile carries the entries Dependabot resolved for these three packages, with the workspace ranges kept exact, and the THIRD_PARTY_LICENSES.md rows move with the manifests.
…#336) Lands two Dependabot majors together, because each fails validate-inventory on its own: the licence inventory rows are hand-maintained. - vitest 4.1.12 -> 5.0.5 in nb-ui. 5.0.5 ships @vitest/mocker 5.0.5, above the 4.1.12 floor that cleared GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp. The nb-ui suite needs no source or config change. - @types/better-sqlite3 7.6.13 -> 9.6.0 in nb-bond-api. The tsc build and the jest suite need no source change. The lockfile carries the entries Dependabot resolved for these two packages, with the workspace ranges kept exact. vitest 5 folds several @vitest/* packages and a few small helpers into itself, so the lockfile removes entries and adds none.
…od 4.6.7 (#337) Fixes the advisories that npm audit raised on development, with the narrowest change for each: - undici (nine advisories, six moderate-to-high, fixed in 8.12.2): bump the root override pin 8.10.2 -> 8.12.3. It enters through jsdom in nb-ui. - qs (GHSA-6pq8-jhm2-2vcw, fixed in 6.17.0): bump the override pin 6.16.0 -> 6.17.0. It enters through express and body-parser. - body-parser (GHSA-27r3-jxmh-p828, fixed in 2.4.0): re-resolve the transitive entry under express 5.3.0, whose range allows it, together with the iconv-lite 0.7.3 it requires. No override needed. - zod (GHSA-mrhx-c7xc-m3w5, fixed in 4.6.6): nb-bond-api pin 4.6.5 -> 4.6.7, with the THIRD_PARTY_LICENSES.md row. The generated OpenAPI document is unchanged. Five low findings remain in the jest chain through deepmerge 4.3.1, which has no patched release; the only offered fix downgrades jest to 25.1.0.
Moves the pinned kindest/node image from v1.32.11 to v1.36.4 (the digest published for Kind v0.33.0) and the Kind version in the README from v0.27.0 to v0.33.0, which is also what the digest was built for. A throwaway cluster on the new image came up Ready in 16 seconds with the repo's containerd patch applied (registry config_path), and NGINX Gateway Fabric 2.8.0 with its Gateway API CRDs and the repo's gateway chart installed on it, with the Gateway programmed. The full sandbox lifecycle has not been run on it. The image's CA bundle still holds the distrusted eMudhra root, so the Known Issues row now names the new node image and what was checked. infra/DEVELOPMENT.md notes that an existing cluster keeps its old node image until it is deleted and recreated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release
Promote
developmentat5342c92dc83edf43c55e63165a7a3ae1fd05e902tomainfor sandbox v0.12.0.Included
express5.3.0,jest30.5.2 and@vitejs/plugin-react6.1.2.vitest5.0.5, with@vitest/mocker5.0.5 above the 4.1.12 floor that cleared GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp.@types/better-sqlite39.6.0.foundry-rs/foundry-toolchain1.9.2 in Contracts CI, still installing Foundry v1.8.6.undicioverride 8.10.2 → 8.12.3 and theqsoverride 6.16.0 → 6.17.0,body-parser2.4.0 under express, andzod4.6.7. This clears 3 high and 2 moderate findings (plus the two moderate findings that were only reachable through them). Five low findings remain in the dev-only jest chain:deepmerge4.3.1 has no patched release, and the only offered fix downgrades jest to 25.1.0.kindest/node:v1.36.4, pinned by digest, and Kind v0.33.0 in the README (Kind node v1.36.4 and Kind v0.33.0 #338).docs/KNOWN_ISSUES.mdrecords that the v1.36.4 image still trusts the distrusted eMudhra roots (Debian 13ca-certificates 20250419, not the fixed build), so the Kind node stays on the exposed list.Compatibility and live-release notes
Patch-level release for dependencies and the local cluster node. Since v0.11.0, the contracts and ABIs, the Helm charts, the Dockerfiles, the application source,
common/images.yamlandcommon/versions.yamlare unchanged. The only CI workflow change is the foundry-toolchain pin in Contracts CI.Contracts and the application
Platform
./sandbox.sh delete, which discards the chain and explorer state, and a fresh./sandbox.sh start. This is local-only.Verification
forge soldeer installwith a request error to the Soldeer registry (a network failure, before any build) and was not re-run. The Dependabot PR carrying the same foundry-toolchain pin (build(deps): bump foundry-rs/foundry-toolchain from 1.9.1 to 1.9.2 #317) passed Contracts CI, and this PR runs it again on the merged pin.developmentat5342c92:check-public-repo-hygiene.py,check-markdown-links.py,check-third-party-licenses.py,check-besu-qbft-baseline.py,check-node-version-consistency.pyandcheck-image-hash-inputs.shall pass.nb-bond-apipassed lint, format, build and 293 tests, andnb-uipassed format, lint, build and 139 tests, on the rollup and audit branches.No Besu node, chain, contract, deployment-environment, or live application change occurs by merging this PR. Artifact publication and GitOps promotion remain separate gated operations.