mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
5c75a93484
Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run in a real release (v2.1.0 had no archive-security job). archive-security asserted tsx at the workspace root, but tsx is a prod dependency of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the Docker CMD runs it. The root path never existed and failed the extract step on both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64 artifact. The blocking Trivy scans would then have failed on CVE-2026-56852, golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image, compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules, verified building in the golang:1.25.12 toolchain with -mod=readonly and linking v0.39.0, with a clean Trivy rescan. Guards added for both the tsx path and the x/text pin. Non-releasable type so a re-dispatch re-runs 2.2.0.
11 lines
194 B
AMPL
11 lines
194 B
AMPL
module github.com/snapotter/snapotter/docker/go-tools/pdfcpu
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/pdfcpu/pdfcpu v0.13.0
|
|
golang.org/x/image v0.43.0
|
|
)
|
|
|
|
require golang.org/x/text v0.39.0 // indirect
|