Skip to content

release: cut v0.1.2 - #22

Merged
arr-wf merged 7 commits into
mainfrom
release/v0.1.2
Oct 27, 2026
Merged

release: cut v0.1.2#22
arr-wf merged 7 commits into
mainfrom
release/v0.1.2

Conversation

@arr-wf

@arr-wf arr-wf commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Patch release. Clears every fixable govulncheck finding and bundles the open dependabot bumps. They can't merge on their own because security-scan fails on main's Go 1.26.9.

Security

  • Go 1.26.9 → 1.26.10 for GO-2026-6809 (crypto/x509). It is reachable from our code and is why security-scan fails on build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.2 #21 and on any new PR.
  • Indirect module bumps for findings that aren't reachable but are fixable:
    • cel-go v0.30.0 (GO-2026-6094)
    • x/text v0.41.0 (GO-2026-5970, GO-2026-6629)
    • klauspost/compress v1.18.7 (GO-2026-5841)
    • x/crypto v0.56.0 (GO-2026-6303, -6354, -6355)
    • x/sync moves to v0.22.0 as a side effect of go mod tidy.
  • Remaining: GO-2026-5932 (x/crypto/openpgp, unmaintained) has no fixed version, and ctxcop doesn't import it.

Added: Redis AUTH detection (from #18)

Cherry-picked from #18 (-x) so it ships in this release. It adds four embedded rules for Redis AUTH credential leak shapes: the plain AUTH line, the node-redis error form, redis-cli -a/--pass, and RESP dumps. The rules are ported from webflow/secrets-scrubber. @santi-webflow, please review the JS→RE2 fidelity, as requested on #18. Review discussion stays on #18.

Bundled dependabot PRs (cherry-picked with -x)

Supersedes #12, #15, #16, #20 and #21. Dependabot closes them on its own after this merges.

Changelog

Moves [Unreleased] to [0.1.2] — 2026-10-27 (Security, Added, Fixed), which also picks up the stdin-drain fix from #17. Adds the missing [0.1.1] link ref.

Verification (local, GOTOOLCHAIN=go1.26.10)

  • go build ./..., go vet ./... and go test ./... all pass, including the 22 Redis rule tests.
  • govulncheck ./... reports 0 called, 0 in imported packages, and 1 in required modules (GO-2026-5932, no fix).

After merge

Push the signed annotated v0.1.2 tag. A second maintainer approves the release environment.

🤖 Generated with Claude Code

@socket-security

socket-security Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgolang/​golang.org/​x/​sys@​v0.47.0 ⏵ v0.49.084 +1100100100100
Updatedgithub/​ossf/​scorecard-action@​2d1146689b8cda280b9bc96326124645441f03bc ⏵ fa7117db83c52d787ae5a89f350999701505d78e93 +1100100100100
Updatedpypi/​mcp@​2.0.0 ⏵ 2.2.099100 +2100100100

View full report

@arr-wf
arr-wf requested a review from santi-webflow October 27, 2026 18:49
@arr-wf arr-wf mentioned this pull request Oct 27, 2026
Closed
4 of 5 tasks
dependabot Bot and others added 7 commits October 27, 2026 11:51
@dependabot @arr-wf
build(deps): bump mcp
f79a8a9 
Bumps the test-fixture-deps group with 1 update in the /testing/elicit-mcp directory: [mcp](https://github.com/modelcontextprotocol/python-sdk).

Updates `mcp` from 2.0.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.0.0...v2.2.0)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-fixture-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 19534e6)
@dependabot @arr-wf
build(deps): bump the codeql-action group across 1 directory with 3 u…
4c85b24 
…pdates

Bumps the codeql-action group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit befd670)
@dependabot @arr-wf
build(deps): bump golang.org/x/sys
87373c9 
Bumps the indirect-and-patch group with 1 update in the / directory: [golang.org/x/sys](https://github.com/golang/sys).

Updates `golang.org/x/sys` from 0.47.0 to 0.49.0
- [Commits](golang/sys@v0.47.0...v0.49.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: indirect-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit de03da1)
@dependabot @arr-wf
build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0
8c1371e 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@2d11466...fa7117d)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 459aa5b)
@dependabot @arr-wf
build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.2
c16f3ad 
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.1 to 2.22.2.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@e14015d...dc2769a)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 5302571)
Andrew Rose @claude @arr-wf
release: cut v0.1.2
80218fa 
Go 1.26.10 for GO-2026-6809 (crypto/x509, reachable). Bump indirect
cel-go, x/text, klauspost/compress and x/crypto to clear the remaining
govulncheck module findings; GO-2026-5932 (x/crypto/openpgp) has no fix.

Bundles dependabot #12, #15, #16, #20 and #21, which fail security-scan
on main's Go 1.26.9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@arr-wf @pi-mono
feat(rules): detect Redis AUTH credentials across four leak shapes
74895a0 
Upstream betterleaks has a structural gap for Redis: a bare AUTH
password carries no token prefix and no key=value shape, so the plain
AUTH command line, the node-redis structured error form, redis-cli
-a/--pass invocations, and RESP protocol dumps all passed through
unredacted. Port the four redis-auth rules from
webflow/secrets-scrubber (built around a real Redis key leak into an
AI session), adapted from JS to RE2 + CEL-filter semantics: its
reference-value heuristic becomes a per-rule filter, its tempered-dot
becomes a whitespace/backslash-excluding class, and the RESP rule
additionally requires the *N array header (all of its fixtures carry
it) to keep prose dollar-amounts from matching.

Every rule carries a minimum-length floor: a sub-8-char finding trips
Splices over-redact backstop against unrelated lines carrying the
same short form, which is a worse failure than over-redacting a short
password.

Co-authored-by: Pi <noreply@pi.dev>
Signed-off-by: Andrew Rose <andrew.rose@webflow.com>
(cherry picked from commit dbc2f21)
@arr-wf
arr-wf merged commit 01ad3ad into main Oct 27, 2026
14 checks passed
This was referenced Oct 27, 2026
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@santi-webflow santi-webflow Awaiting requested review from santi-webflow

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@arr-wf