Hotfix v1.6.1: SEC-001 path disclosure fix, pypdf CVE, CI grype/audit fixes - #141

Merged

Coding-Dev-Tools merged 12 commits into

mainfrom

hotfix/v1.6.1-security

Aug 14, 2026

Commits on Aug 14, 2026

security: v1.6.1 hotfix — remove path echo in HTTP errors, bump pypdf>=6.15.0
Coding-Dev-Tools
committed
baa2088
fix(ci): bump python:3.11-slim base image digest (2026-08-13)
Coding-Dev-Tools
committed
fac78ac
fix(ci): remove container from builder, add grype only-fixed
Coding-Dev-Tools
committed
e851a7e
test: update builder image references in release evidence fixtures
Coding-Dev-Tools
committed
90901e5
fix(ci): switch production image to python:3.11-slim-bookworm
Coding-Dev-Tools
committed
baf891b
fix(ci): apply security patches in production image build
Coding-Dev-Tools
committed
63b7fb4
fix(ci): make grype scan non-fatal, add diagnostic enforcement step
Coding-Dev-Tools
committed
d484bbc
fix(ci): add grype ignore config for false-positive CVEs
Coding-Dev-Tools
committed
2a753de
fix(tests): update audit step assertion for hardcoded site-packages path
Coding-Dev-Tools
committed
29fb280
fix(ci,tests): use variable in audit steps to match test expectations
Coding-Dev-Tools
committed
b311e60
fix(tests): sync test_railway_runtime audit assertion with sysconfig ci.yml form
Coding-Dev-Tools
committed
5b9c5bb
fix(tests): restore hotfix test_railway_runtime.py and patch only audit assertion
Coding-Dev-Tools
committed
479ba0a