394dda2a4a
Closes the medium-severity dependabot alert #7 on workspace-server's docker pin: "Moby firewalld reload makes published container ports accessible from remote hosts" — fixed in v28.3.3, pulling v28.5.2 (latest in the v28 line). Patch+minor bump within the v28 train; no client-API breaks (workspace-server only uses docker.Client for container exec / inspect, all stable since v20+). Verification: full workspace-server test suite passes (18/18 packages clean). Build clean. Out of scope: - Alerts #10 and #11 (the AuthZ bypass + plugin-priv off-by-one) require v29.3.1, which is not yet published to the Go module proxy (latest published is v28.5.2). They'll close in a follow-up PR once v29 lands as a Go module. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cmd/server | ||
| internal | ||
| migrations | ||
| pkg/provisionhook | ||
| .ci-force | ||
| .gitignore | ||
| .golangci.yaml | ||
| Dockerfile | ||
| Dockerfile.tenant | ||
| entrypoint-tenant.sh | ||
| go.mod | ||
| go.sum | ||