Repository navigation
Release Server v1.6.553 with qualified Brotli decoder fix - #376
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Server v1.6.553 updates the installed Brotli decoder for CVE-2026-111497 using the qualified Ubuntu security backport bundle v0.1.1. It retains the six previously qualified runtime-package fixes, original package sets, provider choices, configuration and application components. The publisher verifies the final package version and integrity, resolves all three Brotli SONAMEs and publishes an ordinary compression/decompression probe with checksummed release evidence.
The image defaults to published Node Agent v1.2.34 (base v0.3.8) and Catalog v0.3.18 at 00eec89e5fdeb9728c1c41babccad8b7dfc8b297. Explicit operator overrides remain effective; existing infrastructure Stacks still need their normal upgrade lifecycle. Source preparation is distinguished from actual image publication and runtime adoption.
Validation: 47 focused packaging contracts, 16 published-install documentation contracts and 7 backport consumer contracts pass. Qualified native package/ABI tests are reused without rebuilding the preceding six families. Required PR checks, CodeQL and the normal immutable image publisher remain mandatory. Deployment and affected service acceptance are limited to the authorized 8080 test fleet; production, HAProxy and host firewall configuration are unchanged.