CodesWhat/drydock v1.3.7

on GitHub

What's Changed

Fixed

• Tag regex OOM crash with re2-wasm — Replaced re2-wasm with re2js (pure JavaScript RE2 port). The WASM binary had a hard 16 MB memory ceiling causing abort() crashes on valid regex patterns. (#89)
• Self-signed/private CA support for self-hosted registries — Added optional CAFILE and INSECURE TLS options for self-hosted registry providers (Custom, Gitea, Forgejo, Harbor, Artifactory, Nexus). (#88)
• Docker Compose trigger silently no-ops on digest updates — Digest-only updates were filtered out entirely because the compose image string didn't change. Now digest updates skip the compose file write but still trigger container recreation. (#91)

Changed

• Gitea refactored to shared SelfHostedBasic base class
• Lint tooling migrated from biome CLI to qlty
• Dependabot replaced with Renovate
• CI: added npm/Docker caching, parallelized jobs, harden-runner on all workflows, credential hardening with persist-credentials: false
• Lefthook pre-push runs piped (sequential fail-fast)

Security

• Bumped harden-runner v2.11.1 → v2.14.2 (fixes GHSA-cpmj-h4f6-r6pq)
• Added persist-credentials: false to all actions/checkout steps
• Zizmor GitHub Actions security linter added to CI and local pre-push

Full Changelog: v1.3.6...v1.3.7