From a98d3b635541dc3ae02078fb87c0a82b6f129f85 Mon Sep 17 00:00:00 2001 From: TrueCharts Bot Date: Thu, 22 Jan 2026 02:36:08 +0100 Subject: [PATCH] =?UTF-8?q?fix(soft-serve):=20update=20image=20docker.io/c?= =?UTF-8?q?harmcli/soft-serve=20v0.11.2=20=E2=86=92=20v0.11.3=20(#43937)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/charmcli/soft-serve](https://redirect.github.com/charmbracelet/soft-serve) | patch | `f4aa197` -> `c652482` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Release Notes
charmbracelet/soft-serve (docker.io/charmcli/soft-serve) ### [`v0.11.3`](https://redirect.github.com/charmbracelet/soft-serve/releases/tag/v0.11.3) [Compare Source](https://redirect.github.com/charmbracelet/soft-serve/compare/v0.11.2...v0.11.3) This release patches a critical auth issue that allows any malicious actor to gain access as any user. Please upgrade ASAP! Credits goes to [@​juancabe](https://redirect.github.com/juancabe), so thank you so much for noticing and reporting this one 🙂 #### Changelog ##### New! - [`28c4854`](https://redirect.github.com/charmbracelet/soft-serve/commit/28c48548903dcbdf5d73438bce920af34bd66fae): feat: add support for certificate reloading upon SIGHUP ([#​710](https://redirect.github.com/charmbracelet/soft-serve/issues/710)) ([@​cheesyhypocrisy](https://redirect.github.com/cheesyhypocrisy)) ##### Fixed - [`8539f9a`](https://redirect.github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741): fix: authentication bypass ([@​aymanbagabas](https://redirect.github.com/aymanbagabas)) ***
Verifying the artifacts First, download the [`checksums.txt` file](https://redirect.github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://redirect.github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt.sigstore.json) files, for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt' wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt.sigstore.json' ``` Then, verify it using [`cosign`](https://redirect.github.com/sigstore/cosign): ```bash cosign verify-blob \ --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --bundle 'checksums.txt.sigstore.json' \ ./checksums.txt ``` If the output is `Verified OK`, you can safely use it to verify the checksums of other artifacts you downloaded from the release using `sha256sum`: ```bash sha256sum --ignore-missing -c checksums.txt ``` Done! You artifacts are now verified!
The Charm logo Thoughts? Questions? We love hearing from you. Feel free to reach out on [X](https://x.com/charmcli), [Discord](https://charm.land/discord), [Slack](https://charm.land/slack), [The Fediverse](https://mastodon.social/@​charmcli), [Bluesky](https://bsky.app/profile/charm.land).
--- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). --- charts/stable/soft-serve/Chart.yaml | 4 ++-- charts/stable/soft-serve/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/stable/soft-serve/Chart.yaml b/charts/stable/soft-serve/Chart.yaml index 754a109a982..35ed47c9aaf 100644 --- a/charts/stable/soft-serve/Chart.yaml +++ b/charts/stable/soft-serve/Chart.yaml @@ -11,7 +11,7 @@ annotations: truecharts.org/min_kubernetes_version: 1.24.0 truecharts.org/train: stable apiVersion: v2 -appVersion: 0.11.2 +appVersion: 0.11.3 dependencies: - name: common version: 28.29.27 @@ -38,5 +38,5 @@ sources: - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/soft-serve - https://hub.docker.com/r/charmcli/soft-serve type: application -version: 9.15.11 +version: 9.15.12 diff --git a/charts/stable/soft-serve/values.yaml b/charts/stable/soft-serve/values.yaml index 3f2fb0d8f68..e5bd7b98848 100644 --- a/charts/stable/soft-serve/values.yaml +++ b/charts/stable/soft-serve/values.yaml @@ -1,7 +1,7 @@ image: repository: docker.io/charmcli/soft-serve pullPolicy: IfNotPresent - tag: v0.11.2@sha256:f4aa19762070e93b75f2969b177c9f09dfd4bc77286bf5d7378086a4002b6056 + tag: v0.11.3@sha256:c65248271a9546e2fba9478900dd6114154339aca132c72f495b853c6b1d71b2 softserve: host: localhost key_path: /.ssh/soft_serve_server_ed25519