From 2616ac235cdb9141ca653becb723e4b66d77899a Mon Sep 17 00:00:00 2001 From: Cody Spath Date: Fri, 25 Sep 2026 14:00:45 -0400 Subject: [PATCH] chore: prepare release 2.18.2 Prepares the 2.18.2 release by hand, same approach as 2.18.1 in #620 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Ships the pelletier/go-toml/v2 v2.4.3 bump from #621, which clears the XRAY-1033007 finding Procore reported against the 2.18.1 binary. Also realigns the Action tag and the scanner version at 2.18.2. The 2.18.1 prep replaced every 2.17.0 reference in the Action metadata README, including the `uses: launchdarkly/find-code-references@v2.17.0` examples, but the Action repo was tagged v2.18.0 rather than v2.18.1. That left the README -- here and, after the #67 sync, live in the Action repo -- pointing at a tag that does not exist, so the examples 404 when copy-pasted. Both streams now read 2.18.2. Publish order, unchanged from 2.18.1 and worth repeating because immutable releases allow one attempt per tag name: - do not push the tag before running the release workflow - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify the count, then publish - sync find-code-references and tag it v2.18.2 so the README examples resolve, then move its v2 tag Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 6 ++++++ build/metadata/github-actions/Dockerfile | 2 +- build/metadata/github-actions/README.md | 8 ++++---- build/metadata/github-actions/docker/action.yml | 4 ++-- internal/version/version.go | 2 +- 5 files changed, 14 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c2ca1778..c3eb6256 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to the ld-find-code-refs program will be documented in this ## [Unreleased] +## [2.18.2] - 2026-09-25 + +### Fixed: +- bumped `github.com/pelletier/go-toml/v2` from v2.2.4 to v2.4.3, clearing a reported denial-of-service finding (XRAY-1033007). The module arrives indirectly through `spf13/viper`, which requires v2.2.4, so the 2.18.0 dependency work did not move it. The TOML decoder is not reachable from this program -- `options.go` pins `viper.SetConfigType("yaml")`, so viper never selects the TOML codec -- but the upstream release bounds array and inline-table nesting depth to prevent a stack-overflow crash, so the bump is worth taking regardless +- the GitHub Action README examples referenced `launchdarkly/find-code-references@v2.18.1`, a tag that was never created. The Action tag and the scanner version are realigned at 2.18.2 so the copy-pasteable examples resolve + ## [2.18.1] - 2026-09-23 ### Fixed: diff --git a/build/metadata/github-actions/Dockerfile b/build/metadata/github-actions/Dockerfile index c50f77b3..38a9d10d 100644 --- a/build/metadata/github-actions/Dockerfile +++ b/build/metadata/github-actions/Dockerfile @@ -1,4 +1,4 @@ -FROM launchdarkly/ld-find-code-refs-github-action:2.18.1 +FROM launchdarkly/ld-find-code-refs-github-action:2.18.2 LABEL com.github.actions.name="LaunchDarkly Code References" LABEL com.github.actions.description="Find references to feature flags in your code." diff --git a/build/metadata/github-actions/README.md b/build/metadata/github-actions/README.md index 05c02299..55c54730 100644 --- a/build/metadata/github-actions/README.md +++ b/build/metadata/github-actions/README.md @@ -28,7 +28,7 @@ jobs: with: fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions - name: LaunchDarkly Code References - uses: launchdarkly/find-code-references@v2.18.1 + uses: launchdarkly/find-code-references@v2.18.2 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY @@ -64,11 +64,11 @@ jobs: password: ${{ secrets.REGISTRY_TOKEN }} - name: LaunchDarkly Code References # Pin to a release that includes the docker/ entry point (see changelog). - uses: launchdarkly/find-code-references/docker@v2.18.1 + uses: launchdarkly/find-code-references/docker@v2.18.2 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY - dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1 + dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.2 ``` Mirror the public image `launchdarkly/ld-find-code-refs-github-action` into your registry (pin `dockerImage` to the scanner image tag you mirrored; it can lag the Action tag). This entry point requires a Docker CLI on the runner (included on GitHub-hosted `ubuntu-*` runners). Existing workflows that use the root Action do not need to change. @@ -104,7 +104,7 @@ jobs: with: fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions - name: LaunchDarkly Code References - uses: launchdarkly/find-code-references@v2.18.1 + uses: launchdarkly/find-code-references@v2.18.2 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY diff --git a/build/metadata/github-actions/docker/action.yml b/build/metadata/github-actions/docker/action.yml index 465d2d96..2eb3def8 100644 --- a/build/metadata/github-actions/docker/action.yml +++ b/build/metadata/github-actions/docker/action.yml @@ -52,12 +52,12 @@ inputs: description: >- Container image to run. Defaults to the public Docker Hub image used by the root Action. Set this to your mirrored/proxy image (for example - your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1). + your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.2). Authenticate to private registries with docker/login-action (or equivalent) in a prior step. Requires a runner with a Docker CLI (GitHub-hosted ubuntu-* runners include one). required: false - default: "launchdarkly/ld-find-code-refs-github-action:2.18.1" + default: "launchdarkly/ld-find-code-refs-github-action:2.18.2" runs: using: composite steps: diff --git a/internal/version/version.go b/internal/version/version.go index ebb4ffa7..6832086f 100644 --- a/internal/version/version.go +++ b/internal/version/version.go @@ -1,3 +1,3 @@ package version -const Version = "2.18.1" +const Version = "2.18.2"