This release keeps dependencies and maintenance posture current for teams operating this tool.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryMinor fixes and improvements.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Materialize uncompressed .dat.tar atomically in expandapk Materialize uncompressed .dat.tar atomically in expandapk Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
| Dependency | Low |
Bump actions/checkout from 6.0.2 to 6.0.3 Bump actions/checkout from 6.0.2 to 6.0.3 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump chainguard-dev/actions from 1.6.19 to 1.6.22 Bump chainguard-dev/actions from 1.6.19 to 1.6.22 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump chainguard.dev/sdk from 0.1.55 to 0.1.57 Bump chainguard.dev/sdk from 0.1.55 to 0.1.57 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump github/codeql-action from 4.36.0 to 4.36.2 Bump github/codeql-action from 4.36.0 to 4.36.2 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 Bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump go.opentelemetry.io/otel/trace from 1.43.0 to 1.44.0 Bump go.opentelemetry.io/otel/trace from 1.43.0 to 1.44.0 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump go.step.sm/crypto from 0.81.0 to 0.82.0 Bump go.step.sm/crypto from 0.81.0 to 0.82.0 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump golang.org/x/sync from 0.20.0 to 0.21.0 Bump golang.org/x/sync from 0.20.0 to 0.21.0 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump golang.org/x/sys from 0.45.0 to 0.46.0 Bump golang.org/x/sys from 0.45.0 to 0.46.0 Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Dependency | Low |
Bump gopkg.in/ini.v1 from 1.67.2 to 1.67.3 Bump gopkg.in/ini.v1 from 1.67.2 to 1.67.3 Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
| Bugfix | Medium |
Match apk-tools' provider comparison ordering in the solver Match apk-tools' provider comparison ordering in the solver Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
Allow chainctl to write to terminal for interactive login Allow chainctl to write to terminal for interactive login Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
| Bugfix | Low |
Preserve setuid/setgid/sticky bits in permissions handling Preserve setuid/setgid/sticky bits in permissions handling Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
Full changelog
Changelog
- 8a34ba83954913da4b79bd8a40ff124782f8f2cb Match apk-tools' provider comparison ordering in the solver (#2271)
- 6b57924d877dc28152db9f2da9ad3d0cb99ae7eb build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#2264)
- 5f564a223a51b616929ed196703913876c15a131 build(deps): bump chainguard-dev/actions from 1.6.19 to 1.6.22 (#2272)
- a12506c066e3bac80f79412cd1aa3b12a6880ad6 build(deps): bump chainguard.dev/sdk from 0.1.55 to 0.1.57 (#2275)
- b16043b42041f042965719cf4778895ed7cb5da5 build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 (#2267)
- 879c4e55e6e7cd73945e671c77ff0d322cd1f6bf build(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 (#2258)
- 301fd0d625c79684d29b2de779b7fd882e8fd822 build(deps): bump go.opentelemetry.io/otel/trace from 1.43.0 to 1.44.0 (#2256)
- cafdeae691a2964120fdf86389e3a794e38ccdb3 build(deps): bump go.step.sm/crypto from 0.81.0 to 0.82.0 (#2270)
- a3baa98fd9e4dcee50e3ba777a63bcdd134c24ad build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 (#2265)
- 7fd8b427838dbe812616e798ce884ed45c40c0fd build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 (#2266)
- 620f3009eac5282e006b8b319be3c6f13510a02f build(deps): bump google.golang.org/api from 0.280.0 to 0.283.0 (#2262)
- bdddef26c13348e24c8f2a274662f3bcd4def4e8 build(deps): bump gopkg.in/ini.v1 from 1.67.2 to 1.67.3 (#2273)
- 1fe85deeaca6ba534aec2f88a0f68e644725216e expandapk: materialize uncompressed .dat.tar atomically (#2269)
- ef578c30be29d5c1074cf6934e5dac58a84f6cc4 fix(auth): let chainctl write to terminal for interactive login (#2276)
- be89e64e9c769e8d9d5a2446e9bc65db2d2b194b paths: preserve setuid/setgid/sticky bits in permissions (#2274)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]