diff --git a/CHANGELOG.md b/CHANGELOG.md index 750dacc..51f690e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.1.2] - 2026-08-18 + +Security patch — Go 1.26.6 stdlib CVEs; golangci-lint v2.12.2. + ### Security - **Go 1.26.5 → 1.26.6** in `go.mod` and **`Dockerfile`** builder image (stdlib CVEs cleared by govulncheck): **GO-2026-6087** (`net/url`), **GO-2026-6091** (`html/template`), **GO-2026-6090** (`crypto/tls`), **GO-2026-6089** / **GO-2026-5026** (`net/http`), **GO-2026-6088** (`encoding/xml`), **GO-2026-5972** (`encoding/asn1`). @@ -14,7 +18,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed - **CI / lint:** `make lint` and the GitHub Actions lint job now run **golangci-lint** v2 (`.golangci.yml`: govet, staticcheck, ineffassign, misspell, revive, unused) instead of bare `go vet`. Cyclomatic complexity remains a separate `make gocyclo` gate. Pin bumped to **v2.12.2** (Go **1.26**-built binary; v2.5.0 failed CI with exit 3 against older `go 1.26.5`). -- **README:** Go version badge synced to **1.26.6**. +- **README / man pages / BSD ports:** version badge, image pin, and packaging synced to **1.1.2**. Go version badge synced to **1.26.6**. +- **Grype:** directory scan also excludes local `./.tmp-go/**` so leftover test binaries do not fail `make security`. ### Docs diff --git a/GNUmakefile b/GNUmakefile index 56e7c34..9835838 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -24,7 +24,7 @@ check-docker = @docker info >/dev/null 2>&1 || { echo "Error: Docker is not runn # Grype directory scan exclusions (see anchore/grype catalog rules for globs). GRYPE_FAIL_ON ?= high -GRYPE_DIR_EXCLUDES := --exclude './bin/**' --exclude './work/**' --exclude './dist/**' +GRYPE_DIR_EXCLUDES := --exclude './bin/**' --exclude './work/**' --exclude './dist/**' --exclude './.tmp-go/**' # Pin golangci-lint for reproducible `make lint` / CI (config is v2). # Must be ≥ v2.9.0 so the published binary is built with Go ≥ 1.26 (matches go.mod). diff --git a/README.md b/README.md index 6ce441d..dcc637f 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ **☸** _Collect Kubernetes logs and cluster context into one archive_ [![Release](https://img.shields.io/github/v/release/hrodrig/groot?display_name=tag&label=release&logo=github)](https://github.com/hrodrig/groot/releases) -[![Version](https://img.shields.io/badge/version-1.1.1-blue)](https://github.com/hrodrig/groot/releases) +[![Version](https://img.shields.io/badge/version-1.1.2-blue)](https://github.com/hrodrig/groot/releases) [![Go](https://img.shields.io/badge/Go-1.26.6-00ADD8?logo=go)](https://go.dev/) [![License](https://img.shields.io/badge/license-MIT-green)](./LICENSE) [![pkg.go.dev](https://pkg.go.dev/badge/github.com/hrodrig/groot)](https://pkg.go.dev/github.com/hrodrig/groot) @@ -957,10 +957,10 @@ This repository ships the **CLI**, **packages**, and **`ghcr.io/hrodrig/groot`** | On-demand collect (HTTP → Job) | **[groot-trigger](https://github.com/hrodrig/groot-trigger)** | | Archive catalog on a VPS (**gfs**) | **[groot-share](https://github.com/hrodrig/groot-share)** — deploy: **[groot-share-selfhosted](https://github.com/hrodrig/groot-share-selfhosted)** | -Pull the image from here (pin to the [version badge](#readme-top) — currently **`v1.1.1`**): +Pull the image from here (pin to the [version badge](#readme-top) — currently **`v1.1.2`**): ```bash -docker pull ghcr.io/hrodrig/groot:v1.1.1 +docker pull ghcr.io/hrodrig/groot:v1.1.2 ``` In-cluster behavior (CronJob, RBAC, `/out` volume) is documented in [SPEC §8](SPECIFICATIONS.md#8-runtime-and-kubernetes-access). See [Groot family](#groot-family) for the full companion map. diff --git a/ROADMAP.md b/ROADMAP.md index 9279708..d528c20 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -8,7 +8,7 @@ User-facing overview: **[README.md](README.md)** and **[configs/groot.yml.sample When a roadmap item ships, update **CHANGELOG** (reference **`(band #N)`** in bullets) and mark the item **Done** here—or move highlights into the **Shipped** table. -**Last reviewed:** 2026-08-11 (**v1.1.1** patch — kubeconfig `~` expansion, unique `sessionBase` short, S3 credential trim; Band 4 continues with `#32` / `#56`; backlog **`#97`** WebDAV/Nextcloud) +**Last reviewed:** 2026-08-18 (**v1.1.2** security patch — Go 1.26.6 stdlib CVEs, golangci-lint v2.12.2; Band 4 continues with `#32` / `#56`; backlog **`#97`** WebDAV/Nextcloud) ### Versioning note @@ -103,6 +103,9 @@ GROOT is a **read-only log and context collector**: one **`groot collect`** prod | **1.0.4** | 3 | **Security patch**: `grpc` **v1.82.1** (GHSA-hrxh-6v49-42gf); OpenTelemetry **v1.44.0** (GO-2026-5158); `-v` Usage dump fix; kubectl-groot Gatekeeper docs. | | **1.0.5** | 3 | **Docs**: Homebrew 6+ tap trust (`brew install --cask hrodrig/groot/groot`); README/BSD pins. | | **1.0.6** | 3 | **Packaging/docs**: man(1)+nfpm+BSD (#96), CONTRIBUTING collector guide (#47), examples beyond profiles (#46). | +| **1.1.0** | 4 | **offline `groot analyze`** (#69): heuristics + executive/LLM Markdown + golden fixtures. | +| **1.1.1** | 4 | Patch: kubeconfig `~` expansion, unique `sessionBase` short, S3 credential trim. | +| **1.1.2** | 4 | **Security:** Go **1.26.6** stdlib CVEs (govulncheck); golangci-lint **v2.12.2**; family companion repo docs. | --- diff --git a/VERSION b/VERSION index 524cb55..45a1b3f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.1.1 +1.1.2 diff --git a/contrib/freebsd/Makefile b/contrib/freebsd/Makefile index 4dcddc3..fd0fc3f 100644 --- a/contrib/freebsd/Makefile +++ b/contrib/freebsd/Makefile @@ -1,5 +1,5 @@ PORTNAME= groot -PORTVERSION= 1.1.1 +PORTVERSION= 1.1.2 DISTVERSIONPREFIX= v CATEGORIES= sysutils # Local test before release: copy the tarball into DISTDIR (see `make -V DISTDIR` diff --git a/contrib/man/man1/groot.1 b/contrib/man/man1/groot.1 index fc86c51..9f5c239 100644 --- a/contrib/man/man1/groot.1 +++ b/contrib/man/man1/groot.1 @@ -1,6 +1,6 @@ .\" Copyright (c) 2026 hrodrig .\" SPDX-License-Identifier: MIT -.TH GROOT 1 "2026-08-11" "groot v1.1.1" "User Commands" +.TH GROOT 1 "2026-08-18" "groot v1.1.2" "User Commands" .SH NAME groot \- collect Kubernetes logs and cluster context into one archive .SH SYNOPSIS diff --git a/contrib/man/man1/kubectl-groot.1 b/contrib/man/man1/kubectl-groot.1 index 864519d..d5a7744 100644 --- a/contrib/man/man1/kubectl-groot.1 +++ b/contrib/man/man1/kubectl-groot.1 @@ -1,6 +1,6 @@ .\" Copyright (c) 2026 hrodrig .\" SPDX-License-Identifier: MIT -.TH KUBECTL-GROOT 1 "2026-08-11" "groot v1.1.1" "User Commands" +.TH KUBECTL-GROOT 1 "2026-08-18" "groot v1.1.2" "User Commands" .SH NAME kubectl-groot \- kubectl plugin entry point for groot .SH SYNOPSIS diff --git a/contrib/openbsd/port/Makefile b/contrib/openbsd/port/Makefile index ff6294d..b35f7f6 100644 --- a/contrib/openbsd/port/Makefile +++ b/contrib/openbsd/port/Makefile @@ -3,8 +3,8 @@ # Submit: send diff to ports@openbsd.org COMMENT = read-only log and context collector for Kubernetes -DISTNAME = groot_v1.1.1_openbsd_${MACHINE_ARCH:S/aarch64/arm64/} -PKGNAME = groot-1.1.1 +DISTNAME = groot_v1.1.2_openbsd_${MACHINE_ARCH:S/aarch64/arm64/} +PKGNAME = groot-1.1.2 CATEGORIES = sysutils HOMEPAGE = https://github.com/hrodrig/groot MAINTAINER = hrodrig@usb.ve @@ -16,8 +16,8 @@ PERMIT_DISTFILES = Yes # Local test before release: copy tarball to DISTDIR or use # make fetch MASTER_SITES=file:///absolute/path/to/dir/ # See README.md "Test with a local tarball". -MASTER_SITES = https://github.com/hrodrig/groot/releases/download/v1.1.1/ -DISTFILES = groot_v1.1.1_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}.tar.gz +MASTER_SITES = https://github.com/hrodrig/groot/releases/download/v1.1.2/ +DISTFILES = groot_v1.1.2_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}.tar.gz EXTRACT_SUFX = .tar.gz ONLY_FOR_ARCHS = amd64 arm64 aarch64