Skip to content

chore: Promote security and dependency updates - #173

Open
kylejschultz wants to merge 43 commits into
mainfrom
dev
Open

chore: Promote security and dependency updates#173
kylejschultz wants to merge 43 commits into
mainfrom
dev

Conversation

@kylejschultz

Copy link
Copy Markdown
Owner

Summary

  • Promote the v1.5.1 security remediation from dev to main.
  • Include the validated Dependabot refresh: FastAPI, Uvicorn, Starlette, Vite, React types, and Docker login Action.
  • Preserve the approved two-ID, time-bounded Trivy exception for the upstream Python base-image SBOM.

Validation

  • dev Test workflow passed
  • dev Security Scan passed
  • dev Publish (dev) passed for AMD64 and ARM64
  • Dev image: ghcr.io/kylejschultz/nestview:dev

Rollout and rollback

After this promotion merges, Release Please will update the release PR. Merge that generated PR to publish the release image. Roll back by pinning the deployment to the prior 1.5.0 image tag and recreating the service.

kylejschultz and others added 30 commits July 7, 2026 15:40
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...8207627)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#146)

Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 7.15.1 to 7.18.1.
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.1/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.1/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: react-router-dom
  dependency-version: 7.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
# Conflicts:
#	.release-please-manifest.json
* fix: Patch high-severity dependency findings

* fix: Replace vulnerable Python image packages

* chore: Document temporary image scan exceptions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant