diff --git a/CHANGELOG.md b/CHANGELOG.md index e23c0514..c2ca1778 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to the ld-find-code-refs program will be documented in this ## [Unreleased] +## [2.18.1] - 2026-09-23 + +### Fixed: +- GitHub release archives (Linux/macOS/Windows tarballs, deb, rpm) were missing from v2.18.0, and that tag name can no longer be used by a release, so the Homebrew formula pointed at download URLs that did not resolve. This patch republishes those assets under a usable tag. There are no code changes from 2.18.0 -- the Go toolchain pin and dependency bumps released there are unchanged. + ## [2.18.0] - 2026-09-23 ### Changed: @@ -14,6 +19,11 @@ All notable changes to the ld-find-code-refs program will be documented in this - resolved all 69 vulnerabilities reported by `govulncheck` against the v2.17.1 binary, including CVE-2025-68121 (`crypto/tls`), CVE-2026-39821 (Punycode validation in the standard library and `x/net/idna`), CVE-2026-45570 (`go-git` SSH transport) and CVE-2026-1229 (`circl` secp384r1). Dependencies bumped: `go-git/v5` to v5.19.2, `go-billy/v5` to v5.9.1, `x/net` to v0.59.0, `x/crypto` to v0.57.0, `x/text` to v0.42.0 and `circl` to v1.6.5 - the error message for an out-of-range `contextLines` value no longer renders the supplied number with a string format verb +## [2.17.1] - 2026-09-14 + +### Fixed: +- GitHub release archives (Linux/macOS/Windows tarballs, deb, rpm) were missing from the immutable v2.17.0 release. This patch publishes those assets. + ## [2.17.0] - 2026-08-13 ### Added: diff --git a/build/metadata/github-actions/Dockerfile b/build/metadata/github-actions/Dockerfile index f9b4ab4f..c50f77b3 100644 --- a/build/metadata/github-actions/Dockerfile +++ b/build/metadata/github-actions/Dockerfile @@ -1,4 +1,4 @@ -FROM launchdarkly/ld-find-code-refs-github-action:2.18.0 +FROM launchdarkly/ld-find-code-refs-github-action:2.18.1 LABEL com.github.actions.name="LaunchDarkly Code References" LABEL com.github.actions.description="Find references to feature flags in your code." diff --git a/build/metadata/github-actions/README.md b/build/metadata/github-actions/README.md index a2ab5ed6..05c02299 100644 --- a/build/metadata/github-actions/README.md +++ b/build/metadata/github-actions/README.md @@ -28,7 +28,7 @@ jobs: with: fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions - name: LaunchDarkly Code References - uses: launchdarkly/find-code-references@v2.18.0 + uses: launchdarkly/find-code-references@v2.18.1 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY @@ -64,11 +64,11 @@ jobs: password: ${{ secrets.REGISTRY_TOKEN }} - name: LaunchDarkly Code References # Pin to a release that includes the docker/ entry point (see changelog). - uses: launchdarkly/find-code-references/docker@v2.18.0 + uses: launchdarkly/find-code-references/docker@v2.18.1 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY - dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.0 + dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1 ``` Mirror the public image `launchdarkly/ld-find-code-refs-github-action` into your registry (pin `dockerImage` to the scanner image tag you mirrored; it can lag the Action tag). This entry point requires a Docker CLI on the runner (included on GitHub-hosted `ubuntu-*` runners). Existing workflows that use the root Action do not need to change. @@ -104,7 +104,7 @@ jobs: with: fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions - name: LaunchDarkly Code References - uses: launchdarkly/find-code-references@v2.18.0 + uses: launchdarkly/find-code-references@v2.18.1 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY diff --git a/build/metadata/github-actions/docker/action.yml b/build/metadata/github-actions/docker/action.yml index fecc3fb0..465d2d96 100644 --- a/build/metadata/github-actions/docker/action.yml +++ b/build/metadata/github-actions/docker/action.yml @@ -52,12 +52,12 @@ inputs: description: >- Container image to run. Defaults to the public Docker Hub image used by the root Action. Set this to your mirrored/proxy image (for example - your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.0). + your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1). Authenticate to private registries with docker/login-action (or equivalent) in a prior step. Requires a runner with a Docker CLI (GitHub-hosted ubuntu-* runners include one). required: false - default: "launchdarkly/ld-find-code-refs-github-action:2.18.0" + default: "launchdarkly/ld-find-code-refs-github-action:2.18.1" runs: using: composite steps: diff --git a/internal/version/version.go b/internal/version/version.go index 35604e25..ebb4ffa7 100644 --- a/internal/version/version.go +++ b/internal/version/version.go @@ -1,3 +1,3 @@ package version -const Version = "2.18.0" +const Version = "2.18.1"