Release v1.1.2

CHANGELOG.md

@@ -7,14 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.2] - 2026-08-18
+
+Security patch — Go 1.26.6 stdlib CVEs; golangci-lint v2.12.2.
+
 ### Security
 
 - **Go 1.26.5 → 1.26.6** in `go.mod` and **`Dockerfile`** builder image (stdlib CVEs cleared by govulncheck): **GO-2026-6087** (`net/url`), **GO-2026-6091** (`html/template`), **GO-2026-6090** (`crypto/tls`), **GO-2026-6089** / **GO-2026-5026** (`net/http`), **GO-2026-6088** (`encoding/xml`), **GO-2026-5972** (`encoding/asn1`).
 
 ### Changed
 
 - **CI / lint:** `make lint` and the GitHub Actions lint job now run **golangci-lint** v2 (`.golangci.yml`: govet, staticcheck, ineffassign, misspell, revive, unused) instead of bare `go vet`. Cyclomatic complexity remains a separate `make gocyclo` gate. Pin bumped to **v2.12.2** (Go **1.26**-built binary; v2.5.0 failed CI with exit 3 against older `go 1.26.5`).
-- **README:** Go version badge synced to **1.26.6**.
+- **README / man pages / BSD ports:** version badge, image pin, and packaging synced to **1.1.2**. Go version badge synced to **1.26.6**.
+- **Grype:** directory scan also excludes local `./.tmp-go/**` so leftover test binaries do not fail `make security`.
 
 ### Docs
 

GNUmakefile

@@ -24,7 +24,7 @@ check-docker = @docker info >/dev/null 2>&1 || { echo "Error: Docker is not runn
 
 # Grype directory scan exclusions (see anchore/grype catalog rules for globs).
 GRYPE_FAIL_ON ?= high
-GRYPE_DIR_EXCLUDES := --exclude './bin/**' --exclude './work/**' --exclude './dist/**'
+GRYPE_DIR_EXCLUDES := --exclude './bin/**' --exclude './work/**' --exclude './dist/**' --exclude './.tmp-go/**'
 
 # Pin golangci-lint for reproducible `make lint` / CI (config is v2).
 # Must be ≥ v2.9.0 so the published binary is built with Go ≥ 1.26 (matches go.mod).

README.md

@@ -5,7 +5,7 @@
 **☸** _Collect Kubernetes logs and cluster context into one archive_
 
 [![Release](https://img.shields.io/github/v/release/hrodrig/groot?display_name=tag&label=release&logo=github)](https://github.com/hrodrig/groot/releases)
-[![Version](https://img.shields.io/badge/version-1.1.1-blue)](https://github.com/hrodrig/groot/releases)
+[![Version](https://img.shields.io/badge/version-1.1.2-blue)](https://github.com/hrodrig/groot/releases)
 [![Go](https://img.shields.io/badge/Go-1.26.6-00ADD8?logo=go)](https://go.dev/)
 [![License](https://img.shields.io/badge/license-MIT-green)](./LICENSE)
 [![pkg.go.dev](https://pkg.go.dev/badge/github.com/hrodrig/groot)](https://pkg.go.dev/github.com/hrodrig/groot)
@@ -957,10 +957,10 @@ This repository ships the **CLI**, **packages**, and **`ghcr.io/hrodrig/groot`**
 | On-demand collect (HTTP → Job) | **[groot-trigger](https://github.com/hrodrig/groot-trigger)** |
 | Archive catalog on a VPS (**gfs**) | **[groot-share](https://github.com/hrodrig/groot-share)** — deploy: **[groot-share-selfhosted](https://github.com/hrodrig/groot-share-selfhosted)** |
 
-Pull the image from here (pin to the [version badge](#readme-top) — currently **`v1.1.1`**):
+Pull the image from here (pin to the [version badge](#readme-top) — currently **`v1.1.2`**):
 
 ```bash
-docker pull ghcr.io/hrodrig/groot:v1.1.1
+docker pull ghcr.io/hrodrig/groot:v1.1.2
 ```
 
 In-cluster behavior (CronJob, RBAC, `/out` volume) is documented in [SPEC §8](SPECIFICATIONS.md#8-runtime-and-kubernetes-access). See [Groot family](#groot-family) for the full companion map.

ROADMAP.md

@@ -8,7 +8,7 @@ User-facing overview: **[README.md](README.md)** and **[configs/groot.yml.sample
 
 When a roadmap item ships, update **CHANGELOG** (reference **`(band #N)`** in bullets) and mark the item **Done** here—or move highlights into the **Shipped** table.
 
-**Last reviewed:** 2026-08-11 (**v1.1.1** patch — kubeconfig `~` expansion, unique `sessionBase` short, S3 credential trim; Band 4 continues with `#32` / `#56`; backlog **`#97`** WebDAV/Nextcloud)
+**Last reviewed:** 2026-08-18 (**v1.1.2** security patch — Go 1.26.6 stdlib CVEs, golangci-lint v2.12.2; Band 4 continues with `#32` / `#56`; backlog **`#97`** WebDAV/Nextcloud)
 
 ### Versioning note
 
@@ -103,6 +103,9 @@ GROOT is a **read-only log and context collector**: one **`groot collect`** prod
 | **1.0.4** | 3 | **Security patch**: `grpc` **v1.82.1** (GHSA-hrxh-6v49-42gf); OpenTelemetry **v1.44.0** (GO-2026-5158); `-v` Usage dump fix; kubectl-groot Gatekeeper docs. |
 | **1.0.5** | 3 | **Docs**: Homebrew 6+ tap trust (`brew install --cask hrodrig/groot/groot`); README/BSD pins. |
 | **1.0.6** | 3 | **Packaging/docs**: man(1)+nfpm+BSD (#96), CONTRIBUTING collector guide (#47), examples beyond profiles (#46). |
+| **1.1.0** | 4 | **offline `groot analyze`** (#69): heuristics + executive/LLM Markdown + golden fixtures. |
+| **1.1.1** | 4 | Patch: kubeconfig `~` expansion, unique `sessionBase` short, S3 credential trim. |
+| **1.1.2** | 4 | **Security:** Go **1.26.6** stdlib CVEs (govulncheck); golangci-lint **v2.12.2**; family companion repo docs. |
 
 ---
 

VERSION

@@ -1 +1 @@
-1.1.1
+1.1.2

contrib/freebsd/Makefile

@@ -1,5 +1,5 @@
 PORTNAME=	groot
-PORTVERSION=	1.1.1
+PORTVERSION=	1.1.2
 DISTVERSIONPREFIX=	v
 CATEGORIES=	sysutils
 # Local test before release: copy the tarball into DISTDIR (see `make -V DISTDIR`

contrib/man/man1/groot.1

@@ -1,6 +1,6 @@
 .\" Copyright (c) 2026 hrodrig
 .\" SPDX-License-Identifier: MIT
-.TH GROOT 1 "2026-08-11" "groot v1.1.1" "User Commands"
+.TH GROOT 1 "2026-08-18" "groot v1.1.2" "User Commands"
 .SH NAME
 groot \- collect Kubernetes logs and cluster context into one archive
 .SH SYNOPSIS

contrib/man/man1/kubectl-groot.1

@@ -1,6 +1,6 @@
 .\" Copyright (c) 2026 hrodrig
 .\" SPDX-License-Identifier: MIT
-.TH KUBECTL-GROOT 1 "2026-08-11" "groot v1.1.1" "User Commands"
+.TH KUBECTL-GROOT 1 "2026-08-18" "groot v1.1.2" "User Commands"
 .SH NAME
 kubectl-groot \- kubectl plugin entry point for groot
 .SH SYNOPSIS

contrib/openbsd/port/Makefile

@@ -3,8 +3,8 @@
 # Submit: send diff to ports@openbsd.org
 
 COMMENT =	read-only log and context collector for Kubernetes
-DISTNAME =	groot_v1.1.1_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}
-PKGNAME =	groot-1.1.1
+DISTNAME =	groot_v1.1.2_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}
+PKGNAME =	groot-1.1.2
 CATEGORIES =	sysutils
 HOMEPAGE =	https://github.com/hrodrig/groot
 MAINTAINER =	hrodrig@usb.ve
@@ -16,8 +16,8 @@ PERMIT_DISTFILES =	Yes
 # Local test before release: copy tarball to DISTDIR or use
 #   make fetch MASTER_SITES=file:///absolute/path/to/dir/
 # See README.md "Test with a local tarball".
-MASTER_SITES =	https://github.com/hrodrig/groot/releases/download/v1.1.1/
-DISTFILES =	groot_v1.1.1_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}.tar.gz
+MASTER_SITES =	https://github.com/hrodrig/groot/releases/download/v1.1.2/
+DISTFILES =	groot_v1.1.2_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}.tar.gz
 EXTRACT_SUFX =	.tar.gz
 
 ONLY_FOR_ARCHS =	amd64 arm64 aarch64