From 9117df2e27228f03f222c591766aed11f696eba0 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Sun, 25 Oct 2026 17:30:42 +0800
Subject: [PATCH] Release Server v1.6.553 with qualified Brotli decoder fix
---
.github/workflows/publish-current-server.yml | 21 +++++++++-
COMPATIBILITY.md | 25 +++++++++++
README.md | 31 +++++++-------
docs/performance/README.md | 8 ++--
docs/releases/server-1.6.553.md | 42 +++++++++++++++++++
scripts/check-server-api-explorer-patch.sh | 22 +++++-----
.../check-server-runtime-image-references.sh | 2 +-
.../test-current-server-packaging-contract.py | 36 ++++++++--------
.../test-server-backport-consumer-contract.py | 28 ++++++++++++-
server/Dockerfile.web-compose-release | 23 ++++++----
server/build-api-explorer-patch-image.sh | 21 ++++++----
server/build-component-candidate.sh | 2 +-
server/security/openvex.json | 4 +-
server/security/vendor-pending.json | 2 +-
14 files changed, 197 insertions(+), 70 deletions(-)
create mode 100644 docs/releases/server-1.6.553.md
diff --git a/.github/workflows/publish-current-server.yml b/.github/workflows/publish-current-server.yml
index ecfe1cf715..2c164ddc94 100644
--- a/.github/workflows/publish-current-server.yml
+++ b/.github/workflows/publish-current-server.yml
@@ -216,6 +216,21 @@ jobs:
printf 'SERVER_JAVA_SECURITY_RUNTIME_OK version=25.0.5+8 official_archive_sha256=68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb actual_candidate=1\n'
} |& tee "$RUNNER_TEMP/server-evidence/java-security-runtime.txt"
+ - name: Verify ordinary Brotli operations against the actual final image
+ shell: bash
+ run: |
+ set -Eeuo pipefail
+ evidence="$RUNNER_TEMP/server-evidence"
+ cc -O2 -Wall -Wextra -Werror \
+ source/server/security/ubuntu-backports/bundle/installer/testdata/consumer-brotli-probe.c \
+ -ldl -o "$evidence/brotli-runtime-probe"
+ docker run --rm --network none \
+ --mount "type=bind,source=$evidence/brotli-runtime-probe,target=/tmp/brotli-runtime-probe,readonly" \
+ --entrypoint /tmp/brotli-runtime-probe "$CANDIDATE_IMAGE" |
+ tee "$evidence/brotli-runtime.txt"
+ grep -Fx 'PASS: three installed Brotli SONAMEs RTLD_NOW, ordinary compression/decompression' \
+ "$evidence/brotli-runtime.txt"
+
- name: Start, restart, and export the candidate
shell: bash
run: |
@@ -575,8 +590,8 @@ jobs:
# before passing its exact-package VEX to native Trivy.
cp -a "$RUNNER_TEMP/server-rootfs/usr/share/pasturestack/security/ubuntu-backports" "$evidence/ubuntu-backports"
(cd "$evidence/ubuntu-backports" && sha256sum --check SHA256SUMS)
- bundle_image="$(sed -n 's/^FROM \(ghcr.io\/pasturestack\/ubuntu-security-backports:v0\.1\.0@sha256:[0-9a-f]\{64\}\) AS ubuntu_security_backports$/\1/p' source/server/Dockerfile.web-compose-release)"
- [[ "$bundle_image" =~ ^ghcr.io/pasturestack/ubuntu-security-backports:v0\.1\.0@sha256:[0-9a-f]{64}$ ]]
+ bundle_image="$(sed -n 's/^FROM \(ghcr.io\/pasturestack\/ubuntu-security-backports:v0\.1\.1@sha256:[0-9a-f]\{64\}\) AS ubuntu_security_backports$/\1/p' source/server/Dockerfile.web-compose-release)"
+ [[ "$bundle_image" =~ ^ghcr.io/pasturestack/ubuntu-security-backports:v0\.1\.1@sha256:[0-9a-f]{64}$ ]]
docker pull --platform linux/amd64 "$bundle_image"
mkdir -p "$evidence/bundle-tools"
bundle_container="$(docker create --entrypoint /unused "$bundle_image")"
@@ -771,6 +786,7 @@ jobs:
cd "$evidence"
sha256sum \
build.log \
+ brotli-runtime.txt \
candidate.log \
candidate-smoke.txt \
"host-api-${HOST_API_VERSION}.tar.gz" \
@@ -812,6 +828,7 @@ jobs:
--notes-file "$evidence/release-notes.md" \
"$evidence/SHA256SUMS" \
"$evidence/build.log" \
+ "$evidence/brotli-runtime.txt" \
"$evidence/candidate.log" \
"$evidence/candidate-smoke.txt" \
"$evidence/host-api-${HOST_API_VERSION}.tar.gz" \
diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 9c99398539..8671c8c7db 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,30 @@
# Compatibility Contract
+
+
+## Server v1.6.553 prepared, not published
+
+This candidate adds the exact accepted Google Brotli fix for CVE-2026-111497 to
+the Ubuntu runtime package. Ubuntu's distribution advisory remains under
+evaluation; the downstream package is a PastureStack rebuild, not a Canonical
+release. Original package ownership, ABI and ordinary compression/streaming
+tests must pass before consumers install it.
+
+Publication requires the qualified immutable bundle, final-rootfs package and
+linkage readback, SBOM and the existing full-severity scan policy. Existing
+unfixed findings and the original raw reports remain separate. No publication,
+deployment or multi-Host acceptance is claimed by this source preparation.
+
+The candidate pins published Catalog `v0.3.18` source
+`00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and Node Agent `v1.2.34`, based on
+compatibility base `v0.3.8`. Their immutable publication identities remain
+separate from this Server candidate and its later deployment acceptance.
+
+Keep the existing environment, authentication, firewall backend, mounts,
+volumes and restart policy. Infrastructure Stacks and Host Agents adopt new
+images only through their normal upgrade lifecycle; changing Server defaults
+does not override an operator's existing database settings.
+
## Server v1.6.552 published
diff --git a/README.md b/README.md
index aba9149830..4848acf534 100644
--- a/README.md
+++ b/README.md
@@ -11,23 +11,25 @@ upstream history, authorship, licenses, and notices.
-## Current release
+## Current source candidate
-Server `v1.6.552` is the current published release.
-It includes Ubuntu security backports from verified upstream releases and accepted
-fixes. Each image updates only packages already installed, preserving its package
-set, coreutils provider, configuration and library interfaces. The compiler stages
-remain separate from the final runtime.
+Server `v1.6.553` is a prepared source candidate, not a published image.
+It adds the accepted Google Brotli fix for CVE-2026-111497 through the qualified
+Ubuntu backport bundle. Only already-installed packages are updated; package sets,
+providers, library interfaces and configuration are preserved.
Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`,
Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs.
-Node Agent `v1.2.33` uses compatibility base `v0.3.7`; Catalog `v0.3.17`
-references the corresponding verified component images.
+Node Agent `v1.2.34` uses compatibility base `v0.3.8`. Published Catalog
+`v0.3.18` is pinned to `00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and records
+the qualified component images and their publication evidence.
-See [Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552),
-its [release note](docs/releases/server-1.6.552.md) and the
-[compatibility contract](COMPATIBILITY.md#server-v16552-runtime-backports)
+See its [release note](docs/releases/server-1.6.553.md) and the
+[compatibility contract](COMPATIBILITY.md#server-v16553-brotli)
for producer identities, immutable image digests, SBOMs and remaining findings.
+The current published release remains
+[Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552),
+with its [release note](docs/releases/server-1.6.552.md).
Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
@@ -54,14 +56,15 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
## Quick start
Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the published numeric `v1.6.552` tag.
+This candidate is not yet available. The examples below use its numeric tag;
+run them only after its official release.
```sh
docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
-v pasturestack-cattle:/var/lib/cattle \
-v pasturestack-mysql:/var/lib/mysql \
-v pasturestack-mysqllog:/var/log/mysql \
- ghcr.io/pasturestack/server:v1.6.552
+ ghcr.io/pasturestack/server:v1.6.553
```
For HTTPS termination at a reverse proxy, set the exact public origin:
@@ -69,7 +72,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin:
```yaml
services:
pasturestack-server:
- image: ghcr.io/pasturestack/server:v1.6.552
+ image: ghcr.io/pasturestack/server:v1.6.553
restart: unless-stopped
ports:
- "8080:8080"
diff --git a/docs/performance/README.md b/docs/performance/README.md
index d65d23a714..fcedfc17b0 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -8,8 +8,10 @@ The following example is appropriate as a starting point for a dedicated
16-vCPU host with about 32 GiB of RAM. It is not a universal performance
profile; measure the real workload before increasing it further.
-The example uses the published numeric Server v1.6.552 tag.
-See the [release note](../releases/server-1.6.552.md) and the
+The example uses the prepared numeric Server v1.6.553 tag. It
+is not yet available from GHCR;
+run it only after its official release and image have been published and read back.
+See the [release note](../releases/server-1.6.553.md) and the
[current release](../../README.md#current-release) for component versions and
release details. Preserve the existing runtime overrides and all three named
volumes during an upgrade or restart.
@@ -20,7 +22,7 @@ evidence is not a performance benchmark; measure the actual workload.
```yaml
services:
pasturestack-server:
- image: ghcr.io/pasturestack/server:v1.6.552
+ image: ghcr.io/pasturestack/server:v1.6.553
restart: unless-stopped
ports:
- "8080:8080"
diff --git a/docs/releases/server-1.6.553.md b/docs/releases/server-1.6.553.md
new file mode 100644
index 0000000000..74d18fd747
--- /dev/null
+++ b/docs/releases/server-1.6.553.md
@@ -0,0 +1,42 @@
+# Server v1.6.553 candidate
+
+Prepared source only; no Server image or release has been published.
+Deployment acceptance is not claimed until the normal protected release workflow
+and the affected runtime checks complete.
+
+## Scope
+
+CVE-2026-111497 affects the Brotli decoder. The accepted Google fix is applied
+to the pinned Ubuntu source without replacing Ubuntu packaging or adding
+packages to the runtime. The qualified shared bundle binds the official patch,
+native owning tests, ordinary compression/streaming tests, three-library ABI,
+package bytes, consumer installation receipts and exact-package OpenVEX.
+
+Web Console `1.6.195`, Engine `v0.183.354`, Host API `0.38.8`, Temurin
+`25.0.5+8` and their application behavior are retained. Node Agent `v1.2.34`
+uses published compatibility base `v0.3.8`. Catalog `v0.3.18`, source
+`00eec89e5fdeb9728c1c41babccad8b7dfc8b297`, references the separately published
+qualified component images. Node.js
+build SDK checks are separate from the static web runtime artifacts.
+
+## Upgrade and rollback
+
+Back up the database and all three named volumes. Preserve the existing Compose
+environment, HTTPS origin, ports, AppArmor, mounts and restart policy. After
+publication use the numeric `ghcr.io/pasturestack/server:v1.6.553` tag, then
+upgrade existing infrastructure Stacks and Host Agents normally. A new Server
+default does not override an explicit database setting.
+
+Keep the preceding immutable images and matching data checkpoint. Do not run
+`docker compose down -v` or retain an old runtime web-bundle override. A rollback
+may require restoring the matching database and volumes; never restore over
+the only copy of current data.
+
+## Acceptance boundary
+
+Only affected package installation, linkage, startup/restart and system-service
+functions require new evidence. Unchanged UI, language, RBAC and session tests
+retain their earlier results. Runtime adoption must identify the actual
+container digest on each eligible Host; registry publication alone is not
+deployment acceptance. Production, HAProxy and host firewall configuration are
+outside this QA deployment.
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 44a5d66dc7..53368a9229 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -570,7 +570,7 @@ python3 scripts/test-web-console-sbom.py
python3 server/security/test_web_console_sbom_scan.py
require_marker "$release_dockerfile" \
- 'ARG SERVER_RELEASE_TAG=v1.6.552' \
+ 'ARG SERVER_RELEASE_TAG=v1.6.553' \
SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
require_marker "$release_dockerfile" \
'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -1138,10 +1138,10 @@ require_marker "$build_script" \
'--file server/Dockerfile.web-compose-release' \
SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
require_marker "$build_script" \
- 'image=${IMAGE:-pasturestack-validation/server:v1.6.552}' \
+ 'image=${IMAGE:-pasturestack-validation/server:v1.6.553}' \
SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
require_marker "$build_script" \
- 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.552}' \
+ 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.553}' \
SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
require_marker "$build_script" \
'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
@@ -1597,13 +1597,13 @@ require_marker "$build_script" \
'grep -F "pasturestack-catalog-pinned-commit"' \
SERVER_CATALOG_PINNED_COMMIT_IMAGE_GATE_MISSING
require_marker "$release_dockerfile" \
- 'ENV PASTURESTACK_CATALOG_COMMIT=72b0d9767306baf7091fca021d0a2b6bdbca5d51' \
+ 'ENV PASTURESTACK_CATALOG_COMMIT=00eec89e5fdeb9728c1c41babccad8b7dfc8b297' \
SERVER_CATALOG_VERSION_LABEL_COMMIT_MISSING
require_marker "$release_dockerfile" \
- '"pinnedCommit":"72b0d9767306baf7091fca021d0a2b6bdbca5d51"' \
+ '"pinnedCommit":"00eec89e5fdeb9728c1c41babccad8b7dfc8b297"' \
SERVER_CATALOG_VERSION_LABEL_URL_MISSING
require_marker "$build_script" \
- 'PASTURESTACK_CATALOG_COMMIT=72b0d9767306baf7091fca021d0a2b6bdbca5d51' \
+ 'PASTURESTACK_CATALOG_COMMIT=00eec89e5fdeb9728c1c41babccad8b7dfc8b297' \
SERVER_CATALOG_VERSION_LABEL_IMAGE_GATE_MISSING
for previous_release_marker in \
'# Server v1.6.462' \
@@ -1691,10 +1691,10 @@ fi
if grep -Fxq '## Current source candidate' README.md; then
for candidate_readme_marker in \
'' \
- 'Server `v1.6.552` is a prepared source candidate, not a published image.' \
+ 'Server `v1.6.553` is a prepared source candidate, not a published image.' \
'run them only after its official release' \
'This candidate is not yet available' \
- 'ghcr.io/pasturestack/server:v1.6.552'; do
+ 'ghcr.io/pasturestack/server:v1.6.553'; do
require_marker README.md "$candidate_readme_marker" \
SERVER_CURRENT_CANDIDATE_README_MISSING
done
@@ -2300,7 +2300,7 @@ done
jq -e '
["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
| .["@context"] == "https://openvex.dev/ns/v0.2.0"
- and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.552"
+ and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.553"
and (.statements | length) == 56
and ([.statements[].vulnerability.name] | length == (unique | length))
and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2338,7 +2338,7 @@ jq -r '
| @tsv
' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
bash "$vendor_pending_validator" "$runtime_vendor_pending" \
- "$vendor_pending_fixture" v1.6.552 >/dev/null
+ "$vendor_pending_fixture" v1.6.553 >/dev/null
bash scripts/test-vendor-pending-findings.sh >/dev/null
rm -f "$vendor_pending_fixture"
trap - EXIT
@@ -2427,4 +2427,4 @@ for release_readback_contract in \
fi
done
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.552 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.553 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/check-server-runtime-image-references.sh b/scripts/check-server-runtime-image-references.sh
index 4d1d0c38c0..e438434ae8 100755
--- a/scripts/check-server-runtime-image-references.sh
+++ b/scripts/check-server-runtime-image-references.sh
@@ -6,7 +6,7 @@ cd "$repo_root"
approved_registry=ghcr.io/pasturestack
approved_agent="${approved_registry}/node-agent:v1.2.31"
-current_agent="${approved_registry}/node-agent:v1.2.33"
+current_agent="${approved_registry}/node-agent:v1.2.34"
approved_balancer="${approved_registry}/load-balancer-service:v0.9.33"
# Historical recipes and opt-in migration tools keep their reviewed coordinates.
historical_balancer="${approved_registry}/load-balancer-service:v0.9.27"
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index 1fbb9884e3..9832f94fde 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -38,11 +38,11 @@
WEB_SOURCE = 'f905bc12daae18d98a6ac65942625562fff2a424'
WEB_SBOM_SHA = 'ca31669f58aa342cd346e1d33ec7061d65f9b84d6a3afcbd132e09361425a88a'
WEB_LOCK_SHA = 'ae862be4519751895f74e552f036906d64be8371fdbbc6379c16e52518f9ee22'
-CATALOG_COMMIT = '72b0d9767306baf7091fca021d0a2b6bdbca5d51'
+CATALOG_COMMIT = '00eec89e5fdeb9728c1c41babccad8b7dfc8b297'
ENGINE_SHA = 'f4889bfb8759a7664f07524bb129d0cda19f35604a06c877b6ca7033246df6fa'
ENGINE_SOURCE = 'dc5a8d7bc44131f609f72a6504483b692d47ce16'
OLD_COORDINATES = {
- 'v1.6.552': 'v1.6.521',
+ 'v1.6.553': 'v1.6.521',
'1.6.195': '1.6.181',
WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
@@ -66,7 +66,7 @@
}
EXPECTED = {
COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
- 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.552'),
+ 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.553'),
'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.195'),
@@ -81,8 +81,8 @@
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING': (BUILD, 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-' + WEB_LOCK_SHA + '}'),
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING': (BUILD, 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-' + WEB_SBOM_SHA + '}'),
- 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.552}'),
- 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.552}'),
+ 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.553}'),
+ 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.553}'),
'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -472,7 +472,7 @@ def verify_runtime_layout(files, gate=GATE):
actual = [line for line in files[DOCKER].splitlines()
if line.startswith('COPY ') and re.search(r'/out/runtime-(?:bin|licenses)/', line)]
stages = re.findall(r'^FROM .+$', files[DOCKER], re.M)
- bundle_stages = re.findall(r'^FROM ghcr\.io/pasturestack/ubuntu-security-backports:v0\.1\.0@sha256:'
+ bundle_stages = re.findall(r'^FROM ghcr\.io/pasturestack/ubuntu-security-backports:v0\.1\.1@sha256:'
r'[0-9a-f]{64} AS ubuntu_security_backports$',
files[DOCKER], re.M)
if len(bundle_stages) != 1:
@@ -606,15 +606,15 @@ def verify(files, gate=GATE):
pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
if len(re.findall(pipeline, source)) != 1:
raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
- if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.552"' not in gate:
+ if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.553"' not in gate:
raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
- if '"$vendor_pending_fixture" v1.6.552 >/dev/null' not in gate:
+ if '"$vendor_pending_fixture" v1.6.553 >/dev/null' not in gate:
raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
- if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.552':
+ if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.553':
raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
- if json.loads(files[VENDOR]).get('release') != 'v1.6.552':
+ if json.loads(files[VENDOR]).get('release') != 'v1.6.553':
raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
- if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.552 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 ' not in gate:
+ if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.553 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 ' not in gate:
raise AssertionError('CURRENT_SUMMARY_MISMATCH')
verify_incremental_contract(files, gate)
verify_load_balancer_contract(files, gate)
@@ -629,11 +629,11 @@ def previous_gate(gate=GATE):
if stale(marker) != marker:
replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
replacements.update({
- 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.552"':
+ 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.553"':
'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
- '"$vendor_pending_fixture" v1.6.552 >/dev/null':
+ '"$vendor_pending_fixture" v1.6.553 >/dev/null':
'"$vendor_pending_fixture" v1.6.521 >/dev/null',
- 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.552 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 ':
+ 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.553 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 ':
'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
})
for marker, stale_marker in replacements.items():
@@ -646,7 +646,7 @@ def previous_gate(gate=GATE):
class Tests(unittest.TestCase):
def test_current_agent_defaults_keep_explicit_operator_overrides(self):
- image = 'ghcr.io/pasturestack/node-agent:v1.2.33'
+ image = 'ghcr.io/pasturestack/node-agent:v1.2.34'
final_stage = FILES[DOCKER].rsplit('\nFROM ', 1)[-1]
for name in ('DEFAULT_CATTLE_AGENT_IMAGE', 'DEFAULT_CATTLE_BOOTSTRAP_REQUIRED_IMAGE'):
self.assertEqual(final_stage.splitlines().count('ENV ' + name + '=' + image), 1)
@@ -1317,7 +1317,7 @@ def test_historical_engine340_cannot_be_packaged(self):
def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
candidate = (REPO / 'server/build-component-candidate.sh').read_text(encoding='utf-8')
- self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.552}', candidate)
+ self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.553}', candidate)
self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.354}', candidate)
for old in (
{'0.183.354': '0.183.351',
@@ -1625,7 +1625,7 @@ def test_machine_actual_binary_package_and_retired_boundary_are_verified(self):
def test_current_readme_status_specific_prose_does_not_block_publication_transition(self):
common = GATE.split('for current_readme_marker in ', 1)[1].split('; do', 1)[0]
self.assertNotIn('candidate', common)
- self.assertNotIn('v1.6.552', common)
+ self.assertNotIn('v1.6.553', common)
self.assertIn("grep -Fqi 'keep all three named volumes' README.md", GATE)
status = GATE.split("if grep -Fxq '## Current source candidate' README.md; then", 1)[1]
candidate, published = status.split("elif grep -Fxq '## Current release' README.md; then", 1)
@@ -1634,7 +1634,7 @@ def test_current_readme_status_specific_prose_does_not_block_publication_transit
self.assertIn('This candidate is not yet available', candidate)
self.assertIn('SERVER_CURRENT_PUBLISHED_README_MISSING', published)
self.assertNotIn('candidate', published)
- self.assertNotIn('v1.6.552', published)
+ self.assertNotIn('v1.6.553', published)
if __name__ == '__main__':
diff --git a/scripts/test-server-backport-consumer-contract.py b/scripts/test-server-backport-consumer-contract.py
index c2adf2af3b..d5c2e2d7bd 100644
--- a/scripts/test-server-backport-consumer-contract.py
+++ b/scripts/test-server-backport-consumer-contract.py
@@ -17,7 +17,7 @@ def require(value, message):
def verify(files):
docker, build, publisher = (files[name] for name in (DOCKER, BUILD, PUBLISH))
- image = re.findall(r'^FROM (ghcr.io/pasturestack/ubuntu-security-backports:v0\.1\.0@sha256:'
+ image = re.findall(r'^FROM (ghcr.io/pasturestack/ubuntu-security-backports:v0\.1\.1@sha256:'
r'[0-9a-f]{64}) AS ubuntu_security_backports$', docker, re.M)
require(len(image) == 1 and docker.count("'" + image[0] + "'") == 1, 'Bundle image/retained identity mismatch')
native = docker.split('AS runtime_security_packages', 1)[1].split('FROM ${BASE_IMAGE}', 1)[0]
@@ -56,6 +56,19 @@ def verify(files):
'Server absent-package boundary is missing')
require('install -m 0644 pcre2-backport-provenance.json pcre2-backport.lock.json pcre2-runtime.sha256 /usr/share/pasturestack/security/' in runtime,
'Legacy verifier metadata is not installed')
+ for marker in ["libbrotli1)\" = 1.2.0-3build1+pasturestack.1", 'dpkg --verify libbrotli1',
+ 'libbrotlicommon.so.1 libbrotlidec.so.1 libbrotlienc.so.1']:
+ require(marker in runtime and marker in build, 'Missing final-rootfs Brotli version/integrity/linkage: ' + marker)
+ require('brotli_linkage="$(ldd -r ' in build and 'require_resolved_linkage "$brotli_linkage"' in build,
+ 'Brotli ldd failure must propagate before the linkage text check')
+ require(all('brotli_integrity="$(dpkg --verify libbrotli1)"' in source
+ and 'test -z "$brotli_integrity"' in source for source in (runtime, build)),
+ 'Brotli dpkg verification failure must propagate before its empty-output check')
+ for marker in ['consumer-brotli-probe.c', '--entrypoint /tmp/brotli-runtime-probe "$CANDIDATE_IMAGE"',
+ 'PASS: three installed Brotli SONAMEs RTLD_NOW, ordinary compression/decompression']:
+ require(marker in publisher, 'Missing actual final-image ordinary Brotli probe: ' + marker)
+ require(' brotli-runtime.txt' in publisher and '"$evidence/brotli-runtime.txt"' in publisher,
+ 'Brotli runtime readback must be checksummed and published')
require('sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS' in runtime,
'Seven retained consumer evidence files are not bound')
require('/opt/java/openjdk/bin/java -version 2>&1 | grep -F' in runtime, 'Final Java/libc readback is missing')
@@ -111,11 +124,22 @@ def test_unbound_vex_or_narrowed_raw_scan_is_rejected(self):
verify(dict(FILES, **{PUBLISH: FILES[PUBLISH].replace(old, new)}))
def test_unresolved_bundle_identity_is_rejected(self):
- broken = re.sub(r'(ubuntu-security-backports:v0\.1\.0@sha256:)[0-9a-f]{64}',
+ broken = re.sub(r'(ubuntu-security-backports:v0\.1\.1@sha256:)[0-9a-f]{64}',
r'\1__BUNDLE_DIGEST_PENDING__', FILES[DOCKER])
with self.assertRaises(AssertionError):
verify(dict(FILES, **{DOCKER: broken}))
+ def test_missing_brotli_runtime_or_published_proof_is_rejected(self):
+ for name, marker in [(DOCKER, 'dpkg --verify libbrotli1'),
+ (BUILD, 'libbrotlicommon.so.1 libbrotlidec.so.1 libbrotlienc.so.1'),
+ (BUILD, 'brotli_linkage="$(ldd -r '),
+ (DOCKER, 'test -z "$brotli_integrity"'),
+ (BUILD, 'test -z "$brotli_integrity"'),
+ (PUBLISH, '--entrypoint /tmp/brotli-runtime-probe "$CANDIDATE_IMAGE"'),
+ (PUBLISH, ' brotli-runtime.txt')]:
+ with self.subTest(name=name), self.assertRaises(AssertionError):
+ verify(dict(FILES, **{name: FILES[name].replace(marker, 'MISSING_BROTLI_CONTROL')}))
+
if __name__ == '__main__':
unittest.main(verbosity=2)
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 9f04243ae9..2d3103fe85 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -3,7 +3,7 @@ ARG ARTIFACT_HELPER_IMAGE=golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31
ARG UBUNTU_SECURITY_IMAGE=ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403
-FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports
+FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports
FROM ${ARTIFACT_HELPER_IMAGE} AS temurin_security_runtime
ADD --checksum=sha256:68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb \
@@ -695,7 +695,7 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5
ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904
ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298
ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
-ARG SERVER_RELEASE_TAG=v1.6.552
+ARG SERVER_RELEASE_TAG=v1.6.553
ARG API_EXPLORER_RELEASE_TAG=v1.1.20
ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb
ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75
@@ -804,10 +804,17 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/
done; \
"${data}/install-existing-backports" --install-in-docker-build > "${evidence}/install.json"; \
"${data}/install-existing-backports" --verify-installed > "${evidence}/verify.json"; \
+ test "$(dpkg-query -W -f='${Version}' libbrotli1)" = 1.2.0-3build1+pasturestack.1; \
+ brotli_integrity="$(dpkg --verify libbrotli1)"; \
+ test -z "$brotli_integrity"; \
+ for library in libbrotlicommon.so.1 libbrotlidec.so.1 libbrotlienc.so.1; do \
+ linkage="$(ldd -r "/usr/lib/x86_64-linux-gnu/${library}" 2>&1)"; \
+ if printf '%s\n' "${linkage}" | grep -E 'not found|undefined symbol'; then exit 1; fi; \
+ done; \
for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \
install -m 0644 "${data}/${document}" "${evidence}/${document}"; \
done; \
- printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \
+ printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \
(cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \
for package in libc6 libc-bin libc-gconv-modules-extra; do \
test "$(dpkg-query -W -f='${Version}' "${package}")" = "${GLIBC_RUNTIME_PACKAGE_VERSION}"; \
@@ -1211,8 +1218,8 @@ ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}
ENV CATTLE_RANCHER_CLI_VERSION=v0.6.20
ENV PASTURESTACK_CLI_RELEASE_BASE_URL=https://github.com/PastureStack/cli/releases/download
ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}
-ENV DEFAULT_CATTLE_AGENT_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.33
-ENV DEFAULT_CATTLE_BOOTSTRAP_REQUIRED_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.33
+ENV DEFAULT_CATTLE_AGENT_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.34
+ENV DEFAULT_CATTLE_BOOTSTRAP_REQUIRED_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.34
ENV DEFAULT_CATTLE_LB_INSTANCE_IMAGE=ghcr.io/pasturestack/load-balancer-service:v0.9.33
ENV DEFAULT_CATTLE_LB_INSTANCE_IMAGE_UUID=docker:ghcr.io/pasturestack/load-balancer-service:v0.9.33
ENV CATTLE_API_UI_VERSION=1.1.20
@@ -1301,6 +1308,6 @@ ENV PASTURESTACK_VSPHERE_CLI_BUNDLE_VERSION=${VSPHERE_CLI_BUNDLE_VERSION}
ENV PASTURESTACK_VSPHERE_CLI_BUNDLE_COMMIT=${VSPHERE_CLI_BUNDLE_COMMIT}
ENV PASTURESTACK_VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=${VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256}
ENV PASTURESTACK_GOVC_BINARY_SHA256=${GOVC_BINARY_SHA256}
-ENV PASTURESTACK_CATALOG_COMMIT=72b0d9767306baf7091fca021d0a2b6bdbca5d51
-ENV DEFAULT_CATTLE_CATALOG_URL='{"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"72b0d9767306baf7091fca021d0a2b6bdbca5d51"}}}'
-ENV CATTLE_CATALOG_URL='{"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"72b0d9767306baf7091fca021d0a2b6bdbca5d51"}}}'
+ENV PASTURESTACK_CATALOG_COMMIT=00eec89e5fdeb9728c1c41babccad8b7dfc8b297
+ENV DEFAULT_CATTLE_CATALOG_URL='{"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"00eec89e5fdeb9728c1c41babccad8b7dfc8b297"}}}'
+ENV CATTLE_CATALOG_URL='{"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"00eec89e5fdeb9728c1c41babccad8b7dfc8b297"}}}'
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index ec56262659..55a1b2bf73 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,7 +14,7 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
fi
revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.552}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.553}
source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
@@ -130,7 +130,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d4
usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}
supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.552}
+image=${IMAGE:-pasturestack-validation/server:v1.6.553}
build_options=()
[[ "$revision" =~ ^[0-9a-f]{40}$ ]]
@@ -399,8 +399,8 @@ for marker in \
PASTURESTACK_CLI_RELEASE_BASE_URL=https://github.com/PastureStack/cli/releases/download \
CATTLE_API_UI_VERSION=1.1.20 \
CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}" \
- DEFAULT_CATTLE_AGENT_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.33 \
- DEFAULT_CATTLE_BOOTSTRAP_REQUIRED_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.33 \
+ DEFAULT_CATTLE_AGENT_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.34 \
+ DEFAULT_CATTLE_BOOTSTRAP_REQUIRED_IMAGE=ghcr.io/pasturestack/node-agent:v1.2.34 \
DEFAULT_CATTLE_LB_INSTANCE_IMAGE=ghcr.io/pasturestack/load-balancer-service:v0.9.33 \
DEFAULT_CATTLE_LB_INSTANCE_IMAGE_UUID=docker:ghcr.io/pasturestack/load-balancer-service:v0.9.33 \
RC16_GO_AGENT_VERSION="${node_agent_version}" \
@@ -496,9 +496,9 @@ for marker in \
PASTURESTACK_MACHINE_DRIVER_BINARY_SHA256="${machine_driver_binary_sha256}" \
PASTURESTACK_PACKET_DRIVER_BINARY_SHA256="${packet_driver_binary_sha256}" \
PASTURESTACK_DOCKER_SUPPORT_POLICY=2026-08-28 \
- PASTURESTACK_CATALOG_COMMIT=72b0d9767306baf7091fca021d0a2b6bdbca5d51 \
- 'DEFAULT_CATTLE_CATALOG_URL={"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"72b0d9767306baf7091fca021d0a2b6bdbca5d51"}}}' \
- 'CATTLE_CATALOG_URL={"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"72b0d9767306baf7091fca021d0a2b6bdbca5d51"}}}'; do
+ PASTURESTACK_CATALOG_COMMIT=00eec89e5fdeb9728c1c41babccad8b7dfc8b297 \
+ 'DEFAULT_CATTLE_CATALOG_URL={"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"00eec89e5fdeb9728c1c41babccad8b7dfc8b297"}}}' \
+ 'CATTLE_CATALOG_URL={"catalogs":{"pasturestack":{"url":"https://github.com/PastureStack/catalog-templates.git","branch":"main","pinnedCommit":"00eec89e5fdeb9728c1c41babccad8b7dfc8b297"}}}'; do
test "$(grep -Fxc "$marker" <<<"$image_environment")" = 1
done
@@ -963,6 +963,13 @@ EOF
return 1
fi
}
+ test "$(dpkg-query -W -f='"'"'${Version}'"'"' libbrotli1)" = 1.2.0-3build1+pasturestack.1
+ brotli_integrity="$(dpkg --verify libbrotli1)"
+ test -z "$brotli_integrity"
+ for brotli_library in libbrotlicommon.so.1 libbrotlidec.so.1 libbrotlienc.so.1; do
+ brotli_linkage="$(ldd -r "/usr/lib/x86_64-linux-gnu/${brotli_library}" 2>&1)"
+ require_resolved_linkage "$brotli_linkage"
+ done
for curl_package in curl libcurl3t64-gnutls libcurl4t64; do
test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${curl_package}")" = \
"8.18.0-1ubuntu2.8"
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index 4261aec0dc..f2c2f03dcd 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -18,7 +18,7 @@ for name in "${required[@]}"; do
case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
export "$name"
done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.552}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.553}
export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.354}
export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.195}
diff --git a/server/security/openvex.json b/server/security/openvex.json
index 7ff7aa0f6a..5b76737c8c 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,9 +1,9 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
- "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.552",
+ "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.553",
"author": "PastureStack Security",
"timestamp": "2026-10-25T00:00:00Z",
- "version": 64,
+ "version": 65,
"statements": [
{
"vulnerability": {
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index 29763330a2..ee28181f01 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
{
"schemaVersion": 1,
- "release": "v1.6.552",
+ "release": "v1.6.553",
"generatedAt": "2026-10-25T00:00:00Z",
"policy": {
"allowedSeverities": [