DoDiODev opened a new pull request, #9262:
URL: https://github.com/apache/devlake/pull/9262
### Summary
Follow-up to #9217, #9251 and #9254 for version pins that Dependabot does
not track.
### Changes
| Pin | Old | New | Where | Why |
|---|---|---|---|---|
| Go | 1.27.2 | 1.27.3 | `backend/scripts/install-go.sh` (amd64 + arm64
SHA256), `devops/docker/lake-builder/Dockerfile` (`GO_VERSION` + `GO_SHA256`),
"Install Go" step names | security fixes in `crypto/x509` (released
2026-10-19); checksums from go.dev |
| Node | 24.19.0 | 24.22.1 | `config-ui/.tool-versions` | match the Volta
pin from #9251 (Node.js security release 2026-10-21) |
| MySQL | 8.4.11 | 8.4.13 | `docker-compose-dev-mysql.yml`, `test-e2e.yml`
service | match the compose files bumped by Dependabot in #9254 |
`backend/go.mod` keeps `go 1.27.0`; `golang:1.27-bookworm` already floats to
the latest patch. Dependabot does not see these pins: the compose fetcher
does not match `docker-compose-dev-*.yml`, `github-actions` updates ignore
`services:`, and shell scripts / `ARG`s / `.tool-versions` are not parsed.
### Notes
The upstream Go CI jobs still run in `mericodev/lake-builder:latest` (see
#9209), so the lake-builder change only takes effect once that image is
republished.
### Verification
- Fork CI (builds the lake-builder image from this Dockerfile, runs unit,
e2e MySQL/PostgreSQL, lint, migration lint):
https://github.com/DoDiODev/devlake/actions/runs/40484194578
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
