Files
John T. Myers dd8dd8a60c fix(security): bump container dependencies to remediate 10 CVEs (#736)
- k3s v1.35.2-k3s1 -> v1.35.3-k3s1 (containerd v2.2.2, runc v1.4.1, Go 1.25.7)
- Docker CLI 29.3.0 -> 29.3.1 (Go 1.25.8, containerd v2.2.2)
- syft 1.42.2 -> 1.42.3 (bumps buger/jsonparser)
- Explicit gpgv and python3 upgrades in all container images

Addresses: GHSA-p77j-4mvh-x3m3 (Critical), GHSA-pwhc-rpq9-4c8w,
GHSA-p436-gjf2-799p, GHSA-9h8m-3fm2-qjrq, GHSA-6v2p-p543-phr9,
GHSA-6g7g-w4f8-9c9x, GHSA-4qg8-fj49-pxjh, CVE-2026-4519,
CVE-2025-68973, CVE-2024-36623

Closes #735
2026-04-02 09:50:36 -07:00

49 lines
1.4 KiB
TOML

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
# OpenShell mise configuration
# See https://mise.jdx.dev/ for documentation
#
# Tasks are defined in tasks/*.toml — run `mise tasks` to list them all.
redactions = ["*_TOKEN", "*_PASSWORD"]
[settings]
experimental = true
python.precompiled_flavor = "install_only_stripped"
[tools]
python = "3.13.12"
rust = "stable"
kubectl = "1.35.1"
uv = "0.10.2"
protoc = "29.6"
helm = "4.1.1"
"ubi:mozilla/sccache" = { version = "0.14.0", matching = "sccache-v" }
"ubi:anchore/syft" = { version = "1.42.3", matching = "syft_" }
"ubi:EmbarkStudios/cargo-about" = "0.8.4"
[env]
_.path = ["{{config_root}}/scripts/bin"]
_.python.venv = { path = ".venv", create = true }
_.file = [".env"]
KUBECONFIG = "{{config_root}}/kubeconfig"
UV_CACHE_DIR = "{{config_root}}/.cache/uv"
# Enable sccache for faster Rust builds.
# Local builds use a disk cache (SCCACHE_DIR); CI sets SCCACHE_MEMCACHED_ENDPOINT
# via repository variables to use a shared memcached backend instead.
RUSTC_WRAPPER = "sccache"
SCCACHE_DIR = "{{config_root}}/.cache/sccache"
# Shared build constants (overridable via environment)
DOCKER_BUILDKIT = "1"
[vars]
# Python paths to include in formatting/linting
python_paths = "python/ tasks/scripts/*.py deploy/sbom/*.py"
[task_config]
includes = ["tasks/*.toml"]