Skip to content

chore(release): v1.1.1 security patch (Go 1.26.6) #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hrodrig merged 1 commit into from
Sep 2, 2026
Merged

chore(release): v1.1.1 security patch (Go 1.26.6) #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

[↑ Back to top](#top)

## [1.1.1] - 2026-09-02

### Security

- **Go toolchain:** bump minimum Go to **1.26.6** (`go.mod`, `Dockerfile`) — addresses Grype **High** stdlib findings on **1.26.5** images: [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026), [GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972), [GO-2026-6088](https://pkg.go.dev/vuln/GO-2026-6088), [GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090), [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942), and [GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) (**Medium**).
Expand Down Expand Up @@ -476,7 +480,8 @@ First **pilot-ready** operator release: safe cluster identification, env overrid

[↑ Back to top](#top)

[Unreleased]: https://github.com/hrodrig/kzero/compare/v1.1.0...HEAD
[Unreleased]: https://github.com/hrodrig/kzero/compare/v1.1.1...HEAD
[1.1.1]: https://github.com/hrodrig/kzero/compare/v1.1.0...v1.1.1
[1.1.0]: https://github.com/hrodrig/kzero/compare/v1.0.2...v1.1.0
[1.0.2]: https://github.com/hrodrig/kzero/compare/v1.0.1...v1.0.2
[1.0.1]: https://github.com/hrodrig/kzero/compare/v1.0.0...v1.0.1
Expand Down
20 changes: 10 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<a id="top"></a>

[![Version](https://img.shields.io/badge/version-1.1.0-blue.svg)](https://github.com/hrodrig/kzero/releases)
[![Version](https://img.shields.io/badge/version-1.1.1-blue.svg)](https://github.com/hrodrig/kzero/releases)
[![GitHub release](https://img.shields.io/github/v/release/hrodrig/kzero)](https://github.com/hrodrig/kzero/releases)
[![Go](https://img.shields.io/badge/Go-1.26.6-00ADD8.svg)](https://go.dev/dl/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
Expand Down Expand Up @@ -45,7 +45,7 @@ Declarative **Kubernetes workload** orchestration: ordered **down** / **up** (an

**Releases** ([GitHub Releases](https://github.com/hrodrig/kzero/releases)) ship **binaries**, **`.deb`** / **`.rpm`**, **`ghcr.io/hrodrig/kzero`**, and **Homebrew**. **Supply chain (v0.7.0+):** SPDX / CycloneDX SBOMs + Cosign on **`checksums.txt`** and GHCR — see [verify Cosign](#verify-cosign-v070). No Helm charts as release artifacts.

Behavior and acceptance: **[SPECIFICATIONS.md](SPECIFICATIONS.md)**. **Shipped:** **v1.1.0** — Helm SDK **v4** (**#59**), native **`job`/`cronjob`** (**#29**), **`kzero diff`** (**#58**). Prior: **v1.0.2** (`command.shell` **#56**); **v1.0.0** — stable contract: default **`run.execution: native`** (**#32**), exit codes **0–4** (**#42**), product kind CI (**#34**), PVC/StatefulSet cookbook (**#33**) — [CHANGELOG.md](CHANGELOG.md). Mitigations: [pipeline-network-loss.md](docs/examples/pipeline-network-loss.md). Diagrams: **[docs/diagrams.md](docs/diagrams.md)**.
Behavior and acceptance: **[SPECIFICATIONS.md](SPECIFICATIONS.md)**. **Shipped:** **v1.1.1** — Go **1.26.6** security (stdlib Grype fixes). Prior: **v1.1.0** — Helm SDK **v4** (**#59**), native **`job`/`cronjob`** (**#29**), **`kzero diff`** (**#58**); **v1.0.2** (`command.shell` **#56**); **v1.0.0** — stable contract: default **`run.execution: native`** (**#32**), exit codes **0–4** (**#42**), product kind CI (**#34**), PVC/StatefulSet cookbook (**#33**) — [CHANGELOG.md](CHANGELOG.md). Mitigations: [pipeline-network-loss.md](docs/examples/pipeline-network-loss.md). Diagrams: **[docs/diagrams.md](docs/diagrams.md)**.

## Table of contents

Expand Down Expand Up @@ -143,18 +143,18 @@ Paste the block **as a whole**, or chain with `&&`, so **`apt` does not run** af

### Fixed-tag examples (copy from the release page if you prefer)

| Format | Example (tag **`v1.0.0`** in the URL path; artifact basename includes the same **`v1.0.0`**) |
| Format | Example (tag **`v1.1.1`** in the URL path; artifact basename includes the same **`v1.1.1`**) |
|--------|------------------------------------------------------------------|
| **`.deb`** | `curl -fsSL -o /tmp/kzero_v1.0.0_linux_amd64.deb https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_linux_amd64.deb` then `sudo apt install /tmp/kzero_v1.0.0_linux_amd64.deb` |
| **`.rpm`** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_linux_amd64.rpm` then `sudo rpm -Uvh kzero_v1.0.0_linux_amd64.rpm` or `sudo dnf install ./kzero_v1.0.0_linux_amd64.rpm` |
| **`.tar.gz` (Linux)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_linux_amd64.tar.gz` then `tar xzf kzero_v1.0.0_linux_amd64.tar.gz` and run **`./kzero`** from the extracted tree (see **`share/examples/kzero/kzero.sample.yml`**) |
| **`.tar.gz` (macOS)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.0.0/kzero_v1.0.0_darwin_amd64.tar.gz` (or **`…_darwin_arm64.tar.gz`** on Apple silicon) |
| **`.deb`** | `curl -fsSL -o /tmp/kzero_v1.1.1_linux_amd64.deb https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_linux_amd64.deb` then `sudo apt install /tmp/kzero_v1.1.1_linux_amd64.deb` |
| **`.rpm`** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_linux_amd64.rpm` then `sudo rpm -Uvh kzero_v1.1.1_linux_amd64.rpm` or `sudo dnf install ./kzero_v1.1.1_linux_amd64.rpm` |
| **`.tar.gz` (Linux)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_linux_amd64.tar.gz` then `tar xzf kzero_v1.1.1_linux_amd64.tar.gz` and run **`./kzero`** from the extracted tree (see **`share/examples/kzero/kzero.sample.yml`**) |
| **`.tar.gz` (macOS)** | `curl -fsSLO https://github.com/hrodrig/kzero/releases/download/v1.1.1/kzero_v1.1.1_darwin_amd64.tar.gz` (or **`…_darwin_arm64.tar.gz`** on Apple silicon) |

**Update:** download a newer release and run the same install command again (`rpm -Uvh`, `apt install` over the `.deb`, or replace the tarball tree).

**Windows:** use the **`.zip`** asset for your arch (for example **`kzero_v1.0.0_windows_amd64.zip`**), unpack, run **`kzero.exe`** where **`kubectl`** is available.
**Windows:** use the **`.zip`** asset for your arch (for example **`kzero_v1.1.1_windows_amd64.zip`**), unpack, run **`kzero.exe`** where **`kubectl`** is available.

**Docker:** `docker pull ghcr.io/hrodrig/kzero:v1.0.0` (match the image tag to the **[release](https://github.com/hrodrig/kzero/releases)** you want). Published images use **`gcr.io/distroless/static-debian13:nonroot`** (static **`kzero`** binary only: no shell, no BusyBox/Alpine runtime). **`Dockerfile`** in this repo uses the same final stage. Package: [ghcr.io/hrodrig/kzero](https://github.com/hrodrig/kzero/pkgs/container/kzero).
**Docker:** `docker pull ghcr.io/hrodrig/kzero:v1.1.1` (match the image tag to the **[release](https://github.com/hrodrig/kzero/releases)** you want). Published images use **`gcr.io/distroless/static-debian13:nonroot`** (static **`kzero`** binary only: no shell, no BusyBox/Alpine runtime). **`Dockerfile`** in this repo uses the same final stage. Package: [ghcr.io/hrodrig/kzero](https://github.com/hrodrig/kzero/pkgs/container/kzero).

**Homebrew** and **BSD packaging** helpers: see **[Install or update](#install-or-update)** and **`contrib/README.md`**.

Expand Down Expand Up @@ -231,7 +231,7 @@ From any machine with Go **1.26.6+** (installs to `$(go env GOPATH)/bin`; ensure
go install github.com/hrodrig/kzero/cmd/kzero@latest
```

Use a **release tag** instead of `@latest` if you want a pinned version (for example `@v1.0.0`). Module reference: [pkg.go.dev/github.com/hrodrig/kzero](https://pkg.go.dev/github.com/hrodrig/kzero).
Use a **release tag** instead of `@latest` if you want a pinned version (for example `@v1.1.1`). Module reference: [pkg.go.dev/github.com/hrodrig/kzero](https://pkg.go.dev/github.com/hrodrig/kzero).

**End-to-end operator profile** (maintenance reset: truncate, Helm infra, PVC wipe, **`infra_probe`**, notify): **[kzero-selfhosted — full-reset-example](https://github.com/hrodrig/kzero-selfhosted/tree/main/run/examples/full-reset-example)** with [validation runbook](https://github.com/hrodrig/kzero-selfhosted/blob/main/run/docs/full-reset-validation.md).

Expand Down
3 changes: 2 additions & 1 deletion ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ This file is the **in-repo** source of truth for **planned** work and known gaps

When a roadmap item ships, update **CHANGELOG** and tick or remove the item here (or move it to a “Completed” subsection with the release tag).

**Last reviewed:** 2026-08-01 (**v1.1.0** shipped on develop: **#59** Helm v4, **#29** job/cronjob MVP, **#58** `diff`, grpc **v1.82.1**; next: tag **`v1.1.0`**; follow-ups **#29b** / **#57** deferred / **#55** parked)
**Last reviewed:** 2026-09-02 (**v1.1.1** security: Go **1.26.6**; **v1.1.0** shipped **#59** Helm v4, **#29** job/cronjob MVP, **#58** `diff`; follow-ups **#29b** / **#57** deferred / **#55** parked; brainstorm backlog TBD)

### Versioning note

Expand Down Expand Up @@ -78,6 +78,7 @@ The v1 engine runs **`deployment` / `statefulset`** steps via **`run.execution`*
| **1.0.1** | **Retry:** classify **`connection lost`** / **`http2: client connection lost`** as transient for live step retry and shell **`ErrTransient`**. |
| **1.0.2** | **`command.shell`** (#56) opt-in hook/script interpreter; pin **`golang.org/x/crypto` v0.54.0** + Grype ignore hygiene (GO-2026-5932 until Helm v4 #59); README badge/docs hygiene. |
| **1.1.0** | **Helm SDK v4** (#59); native **`job`/`cronjob`** (#29 MVP); **`kzero diff --phase`** (#58); **`google.golang.org/grpc` v1.82.1** (Dependabot #8). |
| **1.1.1** | **Security patch:** Go **1.26.6** (stdlib Grype **High**/**Medium** on **1.26.5** images). |

---

Expand Down
2 changes: 1 addition & 1 deletion VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.1.0
1.1.1
2 changes: 1 addition & 1 deletion contrib/freebsd/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
PORTNAME= kzero
PORTVERSION= 1.1.0
PORTVERSION= 1.1.1
DISTVERSIONPREFIX= v
CATEGORIES= sysutils
# Local test before release: copy the tarball into DISTDIR (see `make -V DISTDIR`
Expand Down
2 changes: 1 addition & 1 deletion contrib/man/man1/kzero.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" kzero(1) - declarative Kubernetes workload pipelines
.\" Manual page for kzero
.TH KZERO 1 "2026-08-01" "kzero v1.1.0" "User Commands"
.TH KZERO 1 "2026-09-02" "kzero v1.1.1" "User Commands"
.SH NAME
kzero \- declarative Kubernetes workload shutdown and startup pipelines
.SH SYNOPSIS
Expand Down
8 changes: 4 additions & 4 deletions contrib/openbsd/port/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
# Submit: send diff to ports@openbsd.org

COMMENT = declarative Kubernetes workload pipelines (CLI)
DISTNAME = kzero_v1.1.0_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}
PKGNAME = kzero-1.1.0
DISTNAME = kzero_v1.1.1_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}
PKGNAME = kzero-1.1.1
CATEGORIES = sysutils
HOMEPAGE = https://github.com/hrodrig/kzero
MAINTAINER = hrodrig@usb.ve
Expand All @@ -16,8 +16,8 @@ PERMIT_DISTFILES = Yes
# Local test before release: copy tarball to DISTDIR or use
# make fetch MASTER_SITES=file:///absolute/path/to/dir/
# See README.md "Test with a local tarball".
MASTER_SITES = https://github.com/hrodrig/kzero/releases/download/v1.1.0/
DISTFILES = kzero_v1.1.0_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}.tar.gz
MASTER_SITES = https://github.com/hrodrig/kzero/releases/download/v1.1.1/
DISTFILES = kzero_v1.1.1_openbsd_${MACHINE_ARCH:S/aarch64/arm64/}.tar.gz
EXTRACT_SUFX = .tar.gz

ONLY_FOR_ARCHS = amd64 arm64 aarch64
Expand Down
Binary file modified docs/demo.gif
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading