Tags give the ability to mark specific points in history as being important
-
v1.9.3
61dc0360 · ·v1.9.3: fix reachable dependency vulnerabilities Closes reachable dependency vulnerabilities and removes a race from the retry test suite. - Updated `golang.org/x/crypto` to v0.57.0, fixing the reachable SSH authorization and certificate validation vulnerabilities GO-2026-6354 and GO-2026-6355. - Updated `github.com/moby/go-archive` to v0.3.3, fixing the reachable archive extraction vulnerability GO-2026-6253. - Retry tests now synchronize cancellation to observed service runs instead of relying on wall-clock sleeps that could expire before the service goroutine started under load.
-
v1.9.2
9e7b5481 · ·v1.9.2: remove make audit; make sec is the single scanner entry point Removes make audit; make sec is the single security-scan entry point. - make audit only ran govulncheck, and make sec already runs it (govulncheck + semgrep, merged into sec.sarif). Keeping both was a redundant second way to run the same scanner, so make audit is gone. Run make sec instead. CI already used make sec, so the security gate is unchanged.
-
v1.9.1
4a428cfd · ·v1.9.1: harden servicepack-update backup and gitignore handling Hardens make servicepack-update against two ways it could break a downstream. - The pre-update backup now archives only what git tracks plus untracked files that are not gitignored, instead of a blind tar . of the whole tree. The old backup swept in gitignored local state (build caches, a dev stack's runtime dirs, a privileged container's root-owned files) and failed outright when any of it was unreadable, cancelling the update on exactly the machines that run a dev stack. The new backup captures the same set the update can affect and never chokes on regenerable local state. - The update now fails before touching anything if the downstream's .gitignore hides a framework file the sync would deliver. rsync ignores .gitignore and writes the file, but the update's git add -A honors it and silently skips it, so the file would build locally yet never land in the commit, breaking CI and fresh clones. A dry run now checks the would-sync set with git check-ignore and stops with the offending paths.
-
v1.9.0
e748f672 · ·v1.9.0: always protect docs/ and tests/ during a framework update Framework updates now always protect a downstream's docs/ and tests/ trees. - make servicepack-update adds docs/ and tests/ to the rsync's mechanical exclude floor, so an update can never overwrite a project's own docs or its test tree (the testcontainers harness plus its service tests). Previously only tests/ was protected, and only as an optional line each project had to copy into its .servicepackupdateignore by hand. A project that had not copied it would have its tests/testinfra overwritten by the framework's baseline. - Removed the now-redundant tests/ opt-out from the shipped .servicepackupdateignore template. Pulling the framework's baseline test harness on update is no longer offered, because the floor always protects tests/. - Updated the ownership docs (README layout, getting-started, framework-updates, development, and the agent skill) to state that docs/ and tests/ are yours and are never touched by an update.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
v1.3.3
3e36006f · ·servicepack v1.3.3 — update first-party dependencies and fix vendored module updates
-
-