revert(release): re-cut v0.75.0 after the image vulnerabilities are fixed - #1701
Merged
Conversation
…ixed This reverts commit 8ff1a91. The v0.75.0 evidence gate rejected the webapp image: the pinned nginx:stable-alpine base carries four HIGH CVEs (openssl CVE-2026-14456, expat CVE-2026-66046 and CVE-2026-76641), all fixed in Alpine but not in any digest upstream has published. Release images are promoted by digest and never rebuilt, so the draft at that commit could never pass, and the next version could not cut while an unpublished v0.75.0 draft remained. The draft is deleted; no tag was ever materialised. Restoring 0.74.0 and the changesets lets v0.75.0 re-cut from a commit that carries the image fixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
Important Review skippedToo many files! This PR contains 116 files, which is 16 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (116)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
documentation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Approved automatically: @FelixTJDietrich is listed in the REVIEW_POLICY_MAINTAINERS repository variable, which the repository treats as satisfying the review requirement. See the review policy in docs/contributor/ci-cd.mdx.
Contributor
📚 Documentation Preview
|
Collaborator
Author
|
Merging with an admin bypass. The only failing check is A revert of the version commit necessarily restores |
Contributor
🧩 Storybook Preview
|
This was referenced Sep 1, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts the version commit
8ff1a912aso v0.75.0 can be cut again from a commit that carries the image fixes.Why
The v0.75.0 release stopped at the evidence gate:
The pinned
nginx:stable-alpine@sha256:97d490c…base carries four HIGH CVEs — opensslCVE-2026-14456, expatCVE-2026-66046andCVE-2026-76641— all fixed in Alpine 3.24, none available in any digest upstream has published.nginx:stable-alpinestill resolves to that same digest today, so Renovate's digest management cannot deliver the fix.Release images are promoted by digest and never rebuilt, so the draft at
8ff1a912acould never pass no matter what landed afterwards. Andrelease.ymlrefuses to cut version N+1 unless version N is a published release, so the unpublished v0.75.0 draft would have wedged the version line.The draft has been deleted. No tag was ever materialised — a draft release's tag is not created in git until publish — so no version was burned.
What this restores
package.json→0.74.0.migration/fragmentsAdmin bypass
Verify changesetsfreeze-guardsCHANGELOG.mdand.migration/, which a revert necessarily touches. This needs the same documented bypass used on #1686 and #1691. Adding a revert exemption to that guard is tracked separately.Follow-up
The image fixes and the structural changes that stop this recurring are tracked as separate issues, linked from this PR.