chore(agent-isolation): pin bubblewrap 0.13.0 with a 1-day cooldown - #1360
Merged
Merged
Conversation
Move the bubblewrap pin from 0.11.2 to 0.13.0 (released 2026-09-22). The 0.12.0 release it builds on fixes GHSA-pxhw-h44j-8pfx: during sandbox setup, files or directories could be created through parent symlinks outside the sandbox. 0.13.0 adds mount_setattr() remounts on kernel 5.12+ and rejects empty path arguments. bubblewrap gets a per-tool cooldown_days = 1 so the pin can move a day after release; the 7-day framework default is unchanged. The setup doc's install lines and version table follow the pin. The Debian bookworm caveat becomes a note that distro packages lag the pin, with the build-from-source path. The Ubuntu Noble shortcut now names the current 0.9.0-1ubuntu0.3 package, as 0.9.0-1ubuntu0.1 no longer resolves. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bubblewrapto 0.13.0 (released 2026-09-22), up from 0.11.2. The 0.12.0 release it builds on fixes GHSA-pxhw-h44j-8pfx: files or directories created during sandbox setup could follow parent symlinks out of the sandbox. 0.13.0 addsmount_setattr()remounts on kernel 5.12+ and rejects empty path arguments. Release notes: v0.12.0, v0.13.0.cooldown_days = 1so the pin can move a day after release. The framework-wide 7-day default is unchanged.docs/setup/secure-agent-setup.mdto match. The Debian bookworm caveat becomes a note that distro packages lag the pin, with the build-from-source path. The Ubuntu Noble shortcut now names0.9.0-1ubuntu0.3, the version apt currently serves;0.9.0-1ubuntu0.1no longer resolves.Type of change
.claude/skills/<name>/) — eval fixtures updated belowtools/<system>/*.md)tools/*/withpyproject.toml)docs/,README.md,CONTRIBUTING.md)projects/_template/)prek, workflows, validators)Test plan
tools/agent-isolation/check-tool-updates.shreportsbubblewrap 0.13.0 … ✓ up to dateagainst the new pincat ~/.aws/credentials,$AWS_ACCESS_KEY_ID,curl https://example.com) still deny, and the project-root read/write probe passesprek run --all-filespasses: all hooks pass excepttools/container-gatewaypytest.tests/test_daemon.py::test_run_unlinks_pid_file_before_closing_the_lock_fdfails on files this PR does not touch, so it is outside this change.RFC-AI-0004 compliance
Linked issues
Notes for reviewers (optional)
docs/rfcs/RFC-AI-0002.mdand thesetup-isolated-setup-verifyeval fixtures still say 0.11.2 on purpose. The RFC records the design as decided, and the fixtures are frozen sample reports that do not read the manifest.bubblewrap=0.13.0-*,bubblewrap-0.13.0) follow the manifest, but no distribution packages 0.13.0 yet; the new note in the doc points at the source build.Generative AI disclosure: this change was prepared with Claude Code (Claude Opus 5) and reviewed by the author before submission.
🤖 Generated with Claude Code