Skip to content

Commit e7ee0c0

Browse files
CoderLuiiCoderLuii
committed
v1.2.6
Context: Refresh compatible official tools and locked Python dependencies from v1.2.5. What changed: Update OpenCode, Claude Code, pnpm, Vite, Wrangler and its owned native graph, Drizzle fixture, and four Python packages. Pin remaining Ubuntu jobs to 24.04 and preserve existing feature and compatibility holds. Clarify that Chromium issue #13 is not the complete current advisory inventory. Verification: 130 source tests, workflow pins, Chromium seccomp, JSON/YAML, both Compose configurations, Renovate 44.129.0 extraction, reproducible Python hash lock and clean consumer, npm lifecycle integrity and Drizzle install passed. Independent review approved. Native image checks remain required before publication. Release: Direct main v1.2.6 with v1.2.5 as its sole predecessor. Third-party findings remain accepted upstream vulnerabilities; own-code, secrets, provenance, malformed reports and scanner failures remain blocking.
1 parent 9a35169 commit e7ee0c0

28 files changed

Lines changed: 310 additions & 219 deletions

‎.github/SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ If you discover a security vulnerability in HolyCode:
2121

2222
HolyCode ships many third-party CLIs inside one Docker image. Tagged releases refresh the pinned Dockerfile tools. The supported Claude Auth plugin is packaged inside the image and installed from that offline payload when enabled. Plugins you install yourself remain outside the image SBOM. Renovate configuration covers images, Actions, npm, PyPI, GitHub releases, and plugin pins; release audits still record scanner findings and compatibility holds before publication.
2323

24-
Trivy and Docker Scout keep their full critical/high reports visible. Validated third-party package findings are accepted upstream vulnerabilities and remain listed by dependency, installed version, and vulnerability ID in the release evidence. They do not block delivery. Secret findings, project-owned package findings, unknown package provenance, invalid reports, and scanner failures still block delivery. A passing release does not mean the image has zero vulnerabilities. npm lifecycle scripts are disabled during installation, then checked against exact package versions, integrity values, script bodies, and architecture rules before approved scripts run. Current decisions and owner-guarded replacements are recorded in [`docs/dependency-audit-v1.2.5.md`](../docs/dependency-audit-v1.2.5.md); historical decisions remain in their dated audits.
24+
Trivy and Docker Scout keep their full critical/high reports visible. Validated third-party package findings are accepted upstream vulnerabilities and remain listed by dependency, installed version, and vulnerability ID in the release evidence. They do not block delivery. Secret findings, project-owned package findings, unknown package provenance, invalid reports, and scanner failures still block delivery. A passing release does not mean the image has zero vulnerabilities. npm lifecycle scripts are disabled during installation, then checked against exact package versions, integrity values, script bodies, and architecture rules before approved scripts run. Current decisions and owner-guarded replacements are recorded in [`docs/dependency-audit-v1.2.6.md`](../docs/dependency-audit-v1.2.6.md); historical decisions remain in their dated audits.
2525

2626
When `ENABLE_PAPERCLIP=true`, HolyCode exposes an authenticated local agent board on the configured Paperclip port. Keep that port on trusted LAN/private networks or behind a VPN, and do not publish it directly to the public internet.
2727

‎.github/workflows/docker-publish.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ env:
1414
DOCKERHUB_IMAGE: coderluii/holycode
1515
GHCR_IMAGE: ghcr.io/coderluii/holycode
1616
CANDIDATE_IMAGE: ghcr.io/coderluii/holycode
17-
PREVIOUS_IMAGE: coderluii/holycode:1.2.4@sha256:26dc14d6823573a0aa2b12469c93cbbf6492c1498bbb588a7a0b0c88c42c4a23
18-
PREVIOUS_VERSION: v1.2.4
19-
RELEASE_VERSION: v1.2.5
17+
PREVIOUS_IMAGE: coderluii/holycode:1.2.5@sha256:035b0d86aafd7cf52db7dbbbd9cb3ae53cc195a1aa0ab58843c2c2d3809eb9e3
18+
PREVIOUS_VERSION: v1.2.5
19+
RELEASE_VERSION: v1.2.6
2020

2121
# Required secrets:
2222
# DOCKERHUB_USERNAME - Docker Hub username with access to coderluii/holycode.
@@ -420,7 +420,7 @@ jobs:
420420
421421
promote-candidate:
422422
needs: protected-validation
423-
runs-on: ubuntu-latest
423+
runs-on: ubuntu-24.04
424424
permissions:
425425
actions: read
426426
contents: write
@@ -586,7 +586,7 @@ jobs:
586586
587587
update-dockerhub-description:
588588
needs: promote-candidate
589-
runs-on: ubuntu-latest
589+
runs-on: ubuntu-24.04
590590
if: startsWith(github.ref, 'refs/tags/v')
591591
permissions:
592592
contents: read

‎.github/workflows/pr-validation.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ concurrency:
1313

1414
jobs:
1515
static-validation:
16-
runs-on: ubuntu-latest
16+
runs-on: ubuntu-24.04
1717
permissions:
1818
contents: read
1919

@@ -120,7 +120,7 @@ jobs:
120120
[ -n "$installed" ]
121121
[ -n "$available" ]
122122
bash scripts/validate_chromium_version.sh \
123-
"$installed" "${{ matrix.platform }}" v1.2.5 "$(date -u +%F)"
123+
"$installed" "${{ matrix.platform }}" v1.2.6 "$(date -u +%F)"
124124
dpkg --compare-versions "$installed" ge "$available"
125125
printf '%s installed=%s available=%s platform=%s\n' \
126126
"$package" "$installed" "$available" "${{ matrix.platform }}"
@@ -302,7 +302,7 @@ jobs:
302302
python scripts/validate_scanner_findings.py \
303303
--scanner scout \
304304
--report "$SCOUT_REPORT" \
305-
--release v1.2.5 \
305+
--release v1.2.6 \
306306
--platform "${{ matrix.platform }}" \
307307
--accept-upstream-vulnerabilities \
308308
--accepted-findings "holycode-${{ matrix.suffix }}.scout-accepted.json" \
@@ -346,7 +346,7 @@ jobs:
346346
python scripts/validate_scanner_findings.py \
347347
--scanner trivy \
348348
--report "holycode-${{ matrix.suffix }}.trivy.json" \
349-
--release v1.2.5 \
349+
--release v1.2.6 \
350350
--platform "${{ matrix.platform }}" \
351351
--accept-upstream-vulnerabilities \
352352
--accepted-findings "holycode-${{ matrix.suffix }}.trivy-accepted.json" \

‎Dockerfile‎

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ ARG DELTA_VERSION=0.20.1
2323
# renovate: datasource=github-releases depName=eza-community/eza
2424
ARG EZA_VERSION=0.23.5
2525
# renovate: datasource=npm depName=opencode-ai
26-
ARG OPENCODE_VERSION=1.18.34
26+
ARG OPENCODE_VERSION=1.18.35
2727
# renovate: datasource=npm depName=@anthropic-ai/claude-code
28-
ARG CLAUDE_CODE_VERSION=2.1.290
28+
ARG CLAUDE_CODE_VERSION=2.1.296
2929
# renovate: datasource=npm depName=paperclipai
3030
ARG PAPERCLIP_VERSION=2026.831.1
3131
# renovate: datasource=npm depName=@cursor/sdk
32-
ARG PAPERCLIP_CURSOR_SDK_VERSION=1.0.36
32+
ARG PAPERCLIP_CURSOR_SDK_VERSION=1.0.37
3333
# renovate: datasource=npm depName=jsdom
3434
ARG PAPERCLIP_JSDOM_VERSION=30.1.2
3535
# renovate: datasource=npm depName=@fission-ai/openspec
@@ -59,9 +59,9 @@ ARG PM2_BASIC_FTP_VERSION=6.2.1
5959
# renovate: datasource=npm depName=tsx
6060
ARG TSX_VERSION=4.23.15
6161
# renovate: datasource=npm depName=pnpm
62-
ARG PNPM_VERSION=12.9.1
62+
ARG PNPM_VERSION=12.10.1
6363
# renovate: datasource=npm depName=vite
64-
ARG VITE_VERSION=8.3.2
64+
ARG VITE_VERSION=8.3.4
6565
# renovate: datasource=npm depName=prettier
6666
ARG PRETTIER_VERSION=3.9.9
6767
# renovate: datasource=npm depName=prisma
@@ -77,13 +77,13 @@ ARG PRISMA_UNDICI_TYPES_VERSION=6.21.0
7777
# renovate: datasource=npm depName=lighthouse
7878
ARG LIGHTHOUSE_VERSION=13.5.0
7979
# renovate: datasource=npm depName=wrangler
80-
ARG WRANGLER_VERSION=4.147.0
80+
ARG WRANGLER_VERSION=4.149.0
8181
# renovate: datasource=npm depName=miniflare
82-
ARG WRANGLER_MINIFLARE_VERSION=5.20261001.0-alpha
82+
ARG WRANGLER_MINIFLARE_VERSION=5.20261006.1-alpha
8383
# renovate: datasource=npm depName=sharp
84-
ARG WRANGLER_SHARP_VERSION=0.35.4
84+
ARG WRANGLER_SHARP_VERSION=0.35.5
8585
# renovate: datasource=npm depName=@img/sharp-libvips-linux-x64
86-
ARG WRANGLER_SHARP_LIBVIPS_VERSION=1.3.3
86+
ARG WRANGLER_SHARP_LIBVIPS_VERSION=1.3.4
8787
# renovate: datasource=npm depName=eslint
8888
ARG ESLINT_VERSION=10.12.0
8989
# renovate: datasource=pypi depName=numpy
@@ -102,8 +102,8 @@ ARG PIP_VENDOR_URLLIB3_WHEEL_SHA256=0cf3cae568d36aa9576b28dfb35f11328f1cb974ca76
102102
ARG PIP_VENDOR_URLLIB3_ARCHIVE_SHA256=c64eb33b95a5cbd0afd35cadfb3778da6e7c979efa634312f39a392ca3cb11f2
103103
# renovate: datasource=pypi depName=setuptools
104104
ARG SETUPTOOLS_VERSION=84.0.0
105-
ARG RELEASE_APT_REFRESH=2026-10-05
106-
ARG RELEASE_VERSION=v1.2.5
105+
ARG RELEASE_APT_REFRESH=2026-10-10
106+
ARG RELEASE_VERSION=v1.2.6
107107
ARG TARGETARCH
108108

109109
LABEL org.opencontainers.image.source=https://github.com/CoderLuii/HolyCode \
@@ -632,37 +632,38 @@ RUN PM2_BASIC_FTP_INTEGRITY="sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k
632632
rm "/tmp/${PM2_BASIC_FTP_TARBALL}" /tmp/test_get_uri_ftp.mjs && \
633633
rm -rf /root/.npm
634634

635-
# Wrangler 4.147.0 owns Miniflare 5.20261001.0-alpha and workerd 1.20261001.1;
635+
# Wrangler 4.149.0 owns Miniflare 5.20261006.1-alpha and workerd 1.20261006.1;
636636
# Miniflare owns the same workerd and the fixed Sharp release. Bind each owner.
637-
RUN WRANGLER_SHARP_INTEGRITY="sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==" && \
637+
RUN WRANGLER_SHARP_INTEGRITY="sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==" && \
638638
test "$(npm view "sharp@${WRANGLER_SHARP_VERSION}" dist.integrity)" = "$WRANGLER_SHARP_INTEGRITY" && \
639639
test "$(npm view "wrangler@${WRANGLER_VERSION}" dependencies.miniflare)" = "${WRANGLER_MINIFLARE_VERSION}" && \
640-
test "$(npm view "wrangler@${WRANGLER_VERSION}" dependencies.workerd)" = "1.20261001.1" && \
640+
test "$(npm view "wrangler@${WRANGLER_VERSION}" dependencies.workerd)" = "1.20261006.1" && \
641+
test "$(npm view "wrangler@${WRANGLER_VERSION}" dependencies.esbuild)" = "0.28.2" && \
641642
test "$(npm view "miniflare@${WRANGLER_MINIFLARE_VERSION}" dependencies.sharp)" = "${WRANGLER_SHARP_VERSION}" && \
642-
test "$(npm view "miniflare@${WRANGLER_MINIFLARE_VERSION}" dependencies.workerd)" = "1.20261001.1" && \
643+
test "$(npm view "miniflare@${WRANGLER_MINIFLARE_VERSION}" dependencies.workerd)" = "1.20261006.1" && \
643644
WRANGLER_PACKAGE=/usr/local/lib/node_modules/wrangler/package.json && \
644645
WRANGLER_NODE_MODULES=/usr/local/lib/node_modules/wrangler/node_modules && \
645646
WRANGLER_MINIFLARE_PACKAGE="$WRANGLER_NODE_MODULES/miniflare/package.json" && \
646647
WRANGLER_WORKERD_PACKAGE="$WRANGLER_NODE_MODULES/workerd/package.json" && \
647648
WRANGLER_SHARP_DIR="$WRANGLER_NODE_MODULES/sharp" && \
648649
test "$(node -p 'require(process.argv[1]).version' "$WRANGLER_PACKAGE")" = "${WRANGLER_VERSION}" && \
649-
node -e 'const pkg=require(process.argv[1]); if(pkg.dependencies.miniflare!==process.argv[2] || pkg.dependencies.workerd!=="1.20261001.1") process.exit(1)' \
650+
node -e 'const pkg=require(process.argv[1]); if(pkg.dependencies.miniflare!==process.argv[2] || pkg.dependencies.workerd!=="1.20261006.1" || pkg.dependencies.esbuild!=="0.28.2") process.exit(1)' \
650651
"$WRANGLER_PACKAGE" "${WRANGLER_MINIFLARE_VERSION}" && \
651652
node -e 'const pkg=require(process.argv[1]); if(pkg.version!==process.argv[2] || pkg.dependencies.sharp!==process.argv[3]) process.exit(1)' \
652653
"$WRANGLER_MINIFLARE_PACKAGE" "${WRANGLER_MINIFLARE_VERSION}" "${WRANGLER_SHARP_VERSION}" && \
653-
node -e 'const pkg=require(process.argv[1]); if(pkg.dependencies.workerd!=="1.20261001.1") process.exit(1)' \
654+
node -e 'const pkg=require(process.argv[1]); if(pkg.dependencies.workerd!=="1.20261006.1") process.exit(1)' \
654655
"$WRANGLER_MINIFLARE_PACKAGE" && \
655656
test "$(node -p 'require(process.argv[1]).version' "$WRANGLER_WORKERD_PACKAGE")" = \
656-
"1.20261001.1" && \
657+
"1.20261006.1" && \
657658
test "$(node -p 'require(process.argv[1]).version' "$WRANGLER_SHARP_DIR/package.json")" = \
658659
"${WRANGLER_SHARP_VERSION}" && \
659660
case "${TARGETARCH}" in \
660661
amd64) WRANGLER_SHARP_ARCH=x64; \
661-
WRANGLER_SHARP_NATIVE_INTEGRITY="sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="; \
662-
WRANGLER_SHARP_LIBVIPS_INTEGRITY="sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==";; \
662+
WRANGLER_SHARP_NATIVE_INTEGRITY="sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog=="; \
663+
WRANGLER_SHARP_LIBVIPS_INTEGRITY="sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==";; \
663664
arm64) WRANGLER_SHARP_ARCH=arm64; \
664-
WRANGLER_SHARP_NATIVE_INTEGRITY="sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="; \
665-
WRANGLER_SHARP_LIBVIPS_INTEGRITY="sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==";; \
665+
WRANGLER_SHARP_NATIVE_INTEGRITY="sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ=="; \
666+
WRANGLER_SHARP_LIBVIPS_INTEGRITY="sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A==";; \
666667
*) echo "unsupported Sharp target architecture: ${TARGETARCH}" >&2; exit 1;; \
667668
esac && \
668669
WRANGLER_SHARP_NATIVE_PACKAGE="@img/sharp-linux-${WRANGLER_SHARP_ARCH}" && \
@@ -709,7 +710,7 @@ RUN WRANGLER_SHARP_INTEGRITY="sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn
709710
test "$(find /usr/local/lib/node_modules/wrangler -path "*/@img/sharp-linux-${WRANGLER_SHARP_ARCH}/package.json" -type f | wc -l)" -eq 1 && \
710711
test "$(find /usr/local/lib/node_modules/wrangler -path "*/@img/sharp-libvips-linux-${WRANGLER_SHARP_ARCH}/package.json" -type f | wc -l)" -eq 1 && \
711712
(cd /usr/local/lib/node_modules/wrangler && npm ls sharp --all >/dev/null) && \
712-
node -e 'const sharp=require(process.argv[1]); if(sharp.versions.sharp!==process.argv[2] || sharp.versions.heif!=="1.23.2") process.exit(1); sharp({create:{width:2,height:2,channels:4,background:{r:220,g:30,b:30,alpha:1}}}).avif().toBuffer().then(buffer=>sharp(buffer).raw().toBuffer({resolveWithObject:true})).then(({data,info})=>{if(info.width!==2 || info.height!==2 || info.channels!==4 || data.length!==16) process.exit(1)}).catch(error=>{console.error(error);process.exit(1)})' \
713+
node -e 'const sharp=require(process.argv[1]); if(sharp.versions.sharp!==process.argv[2] || sharp.versions.heif!=="1.23.5") process.exit(1); sharp({create:{width:2,height:2,channels:4,background:{r:220,g:30,b:30,alpha:1}}}).avif().toBuffer().then(buffer=>sharp(buffer).raw().toBuffer({resolveWithObject:true})).then(({data,info})=>{if(info.width!==2 || info.height!==2 || info.channels!==4 || data.length!==16) process.exit(1)}).catch(error=>{console.error(error);process.exit(1)})' \
713714
"$WRANGLER_SHARP_DIR" "${WRANGLER_SHARP_VERSION}" && \
714715
! command -v sharp && \
715716
rm -rf /root/.npm
@@ -720,7 +721,7 @@ RUN npm i -g --ignore-scripts \
720721
# Paperclip's current Cursor SDK no longer installs Connect's Node transport.
721722
# The remaining Undici is jsdom's 8.x dependency; guard the resolved owners.
722723
RUN test "$(npm view "@cursor/sdk@${PAPERCLIP_CURSOR_SDK_VERSION}" dist.integrity)" = \
723-
"sha512-1Fpd644iTGNEoH5nEp5oYVlWgxSObL0VZfTZcCXhOB5MSJLc34vIvP6yx1udqSnpN+Rbpejvmxd9yoyjxhFVuw==" && \
724+
"sha512-MWKMeqtkCOHOOi8uZqI7CYeUtOwwdWke1B4GEllERIGMsoKuxbk++tP/KzOXXxtOD9EUD1z3AQL6os6m3M1gIw==" && \
724725
test "$(npm view "jsdom@${PAPERCLIP_JSDOM_VERSION}" dist.integrity)" = \
725726
"sha512-0FFE/jE1rppmVfUrJUgxqXjcwolZYIGtAgj1pTussMhNZxIxi7W/PvfWaMNroGi2B36X1IKHbexpZ9DhkoOPiQ==" && \
726727
test "$(npm view "undici@${PAPERCLIP_UNDICI_VERSION}" dist.integrity)" = \
@@ -729,7 +730,7 @@ RUN test "$(npm view "@cursor/sdk@${PAPERCLIP_CURSOR_SDK_VERSION}" dist.integrit
729730
test ! -e "$CONNECT_NODE_PACKAGE" && \
730731
test "$(find /usr/local/lib/node_modules/paperclipai -path '*/@connectrpc/connect-node/package.json' -type f | wc -l)" -eq 0 && \
731732
test "$(find /usr/local/lib/node_modules/paperclipai -path '*/undici/package.json' -type f | wc -l)" -eq 1 && \
732-
node -e 'const root="/usr/local/lib/node_modules/paperclipai/node_modules"; const adapter=require(`${root}/@paperclipai/adapter-cursor-cloud/package.json`); const sdk=require(`${root}/@cursor/sdk/package.json`); const server=require(`${root}/@paperclipai/server/package.json`); const jsdom=require(`${root}/jsdom/package.json`); const undici=require(`${root}/undici/package.json`); if(adapter.dependencies["@cursor/sdk"]!=="^1.0.28" || sdk.version!==process.argv[1] || sdk.dependencies["@connectrpc/connect-node"]!==undefined || server.dependencies.jsdom!=="^30.0.1" || jsdom.version!==process.argv[2] || jsdom.dependencies.undici!=="^8.11.2" || undici.version!==process.argv[3]) process.exit(1)' \
733+
node -e 'const root="/usr/local/lib/node_modules/paperclipai/node_modules"; const adapter=require(`${root}/@paperclipai/adapter-cursor-cloud/package.json`); const sdk=require(`${root}/@cursor/sdk/package.json`); const server=require(`${root}/@paperclipai/server/package.json`); const jsdom=require(`${root}/jsdom/package.json`); const undici=require(`${root}/undici/package.json`); if(sdk.version!==process.argv[1]) { console.error(`Paperclip Cursor SDK version mismatch: expected ${process.argv[1]}, got ${sdk.version}`); process.exit(1) } if(adapter.dependencies["@cursor/sdk"]!=="^1.0.28" || sdk.dependencies["@connectrpc/connect-node"]!==undefined || server.dependencies.jsdom!=="^30.0.1" || jsdom.version!==process.argv[2] || jsdom.dependencies.undici!=="^8.11.2" || undici.version!==process.argv[3]) process.exit(1)' \
733734
"${PAPERCLIP_CURSOR_SDK_VERSION}" "${PAPERCLIP_JSDOM_VERSION}" "${PAPERCLIP_UNDICI_VERSION}" && \
734735
node -e 'const root="/usr/local/lib/node_modules/paperclipai/node_modules"; if(require.resolve("undici/package.json",{paths:[`${root}/jsdom`]})!==`${root}/undici/package.json`) process.exit(1)' && \
735736
(cd /usr/local/lib/node_modules/paperclipai && npm ls @cursor/sdk jsdom undici --omit=dev --all >/dev/null) && \

0 commit comments

Comments
 (0)