Repository navigation
chore: prepare release 2.18.0 - #618
Merged
Merged
Conversation
cspath1
added this pull request to stack #619
September 23, 2026 19:06
Base automatically changed from
cspath/REL-16023-bump-go-toolchain-and-deps
to
main
September 23, 2026 19:44
Prepares the 2.18.0 release by hand, same approach as 2.17.0 in #613 and 2.16.0 in #608: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Tag, GitHub release, Docker Hub publish and the downstream find-code-references Action update are done manually afterward. Ships the Go toolchain pin and dependency bumps that clear the 69 govulncheck findings reported against the v2.17.1 binary. Minor rather than patch: the `go` directive moves to 1.26.0, which raises the minimum Go version for anything importing this module as a library. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
cspath1
force-pushed
the
cspath/REL-16023-prepare-release-2.18.0
branch
from
September 23, 2026 19:44
ad88ed2 to
257d8cc
Compare
ari-launchdarkly
approved these changes
Sep 23, 2026
cspath1
added a commit
that referenced
this pull request
Sep 23, 2026
Prepares the 2.18.1 release by hand, same approach as 2.17.0 in #613 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. 2.18.0 published Docker images and the Homebrew formula successfully, but its GitHub release was created by hand and then deleted. This repo has immutable releases enabled, which permanently reserves a tag name once an immutable release has used it, so v2.18.0 can never carry a release. The archives Procore needs are therefore unreachable, and the Homebrew formula bumped to 2.18.0 points at download URLs that 404. No code changes from 2.18.0 -- only the version constant, the changelog and the Action metadata pins. The toolchain pin and dependency bumps are carried forward unchanged. Also backfills the 2.17.1 changelog entry, which was tagged off main and so never landed here. Release notes on the publish order, given immutability allows one attempt per tag name: - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify, then publish; never publish an empty release - do not push the tag before running the release workflow, since prepare-release.sh runs a bare `git tag` under `set -e` <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **2.18.1** is a patch release with **no application code changes** from 2.18.0. It exists because v2.18.0’s GitHub release was removed after publish while **immutable releases** still block reusing that tag, so Linux/macOS/Windows tarballs, deb/rpm, and Homebrew download URLs were broken. > > This PR bumps **`Version`** to `2.18.1`, documents the fix in **CHANGELOG**, and updates GitHub Action metadata (Dockerfile base image, README examples, and `docker/` action default `dockerImage`) from **v2.18.0** to **v2.18.1**. It also **backfills** the missing **2.17.1** changelog entry on main. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 260e6b7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
cspath1
added a commit
that referenced
this pull request
Sep 25, 2026
Prepares the 2.18.2 release by hand, same approach as 2.18.1 in #620 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Ships the pelletier/go-toml/v2 v2.4.3 bump from #621, which clears the XRAY-1033007 finding Procore reported against the 2.18.1 binary. Also realigns the Action tag and the scanner version at 2.18.2. The 2.18.1 prep replaced every 2.17.0 reference in the Action metadata README, including the `uses: launchdarkly/find-code-references@v2.17.0` examples, but the Action repo was tagged v2.18.0 rather than v2.18.1. That left the README -- here and, after the #67 sync, live in the Action repo -- pointing at a tag that does not exist, so the examples 404 when copy-pasted. Both streams now read 2.18.2. Publish order, unchanged from 2.18.1 and worth repeating because immutable releases allow one attempt per tag name: - do not push the tag before running the release workflow - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify the count, then publish - sync find-code-references and tag it v2.18.2 so the README examples resolve, then move its v2 tag <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **Release 2.18.2** bumps the embedded scanner version and aligns GitHub Action metadata so copy-paste examples and default container images point at **`v2.18.2`** / **`launchdarkly/ld-find-code-refs-github-action:2.18.2`** instead of the missing **`v2.18.1`** Action tag. > > The changelog records **2.18.2** as addressing **XRAY-1033007** via **`github.com/pelletier/go-toml/v2` v2.4.3** (indirect through Viper; config stays YAML-only) and fixing the Action README/tag mismatch from the 2.18.1 prep. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 2616ac2. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the 2.18.0 release by hand, same approach as 2.17.0 in #613 and 2.16.0 in #608: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Tag, GitHub release, Docker Hub publish and the downstream find-code-references Action update are done manually afterward.
Ships the Go toolchain pin and dependency bumps that clear the 69 govulncheck findings reported against the v2.17.1 binary.
Minor rather than patch: the
godirective moves to 1.26.0, which raises the minimum Go version for anything importing this module as a library.Note
Overview
Release 2.18.0 — bumps
internal/versionand all GitHub Action / Docker metadata from 2.17.0 to 2.18.0, and adds the [2.18.0] - 2026-09-23 changelog entry.That entry records what ships in this minor release (typically landed in earlier commits on the release branch): a
toolchainpin ingo.mod(Go 1.26.8) so builds use a patched stdlib, Alpine 3.22.2 → 3.24.2 for CLI/Action/Pipe images, dependency updates that clear 69govulncheckfindings on the v2.17.1 binary, and a fix so invalidcontextLineserrors no longer mis-format the user’s number. Docs anddocker/action.ymlexamples/defaultdockerImagetags are updated to 2.18.0 accordingly.Reviewed by Cursor Bugbot for commit 257d8cc. Bugbot is set up for automated code reviews on this repo. Configure here.