11.2.0 Release

.github/dependabot.yml

@@ -1,21 +1,87 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
 updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      cargo-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
   - package-ecosystem: "uv"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
+    groups:
+      uv-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      uv-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "github-actions"
+    directory: "/"
     target-branch: "dev"
-    open-pull-requests-limit: 10
-  - package-ecosystem: github-actions
-    directory: /
+    schedule:
+      interval: "weekly"
     groups:
-      github-actions:
+      github-actions-minor-patch:
         patterns:
-          - "*"  # Group all Actions updates into a single larger pull request
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      github-actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "docker"
+    directory: "/"
+    target-branch: "dev"
     schedule:
-      interval: weekly
+      interval: "weekly"
+    groups:
+      docker-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      docker-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "helm"
+    directory: "/helm"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+    groups:
+      helm-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      helm-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"

.github/workflows/cla.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   CLAAssistant:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Generate token from GitHub App
         id: app-token

.github/workflows/daily-update.yml

@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
 

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,12 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions: {}
+
+jobs:
+  auto-merge:
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+    uses: blacklanternsecurity/CLA/.github/workflows/dependabot-auto-merge.yml@ad6e7d77546f99f569e51085a0e7aad496e23b9c # 2026-10-20

.github/workflows/docker-tests.yml

@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   docker-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v7
@@ -33,7 +33,7 @@ jobs:
           python test_docker.py
 
   docker-publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: docker-test
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/stable' }}
 
@@ -61,8 +61,8 @@ jobs:
           type=sha,prefix=sha-
           type=raw,value=latest,enable={{is_default_branch}}
           type=raw,value=v11
-          type=raw,value=v11.1
-          type=raw,value=v11.1.0
+          type=raw,value=v11.2
+          type=raw,value=v11.2.0
 
     - name: Build and push Docker image
       uses: docker/build-push-action@v7

.github/workflows/pipeline-tests.yml

@@ -11,15 +11,15 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - uses: actions/checkout@v7
 
     - name: Set up Python
       uses: actions/setup-python@v7
       with:
-        python-version: 3.x
+        python-version: "3.14"
 
     - name: Set up uv
       uses: astral-sh/setup-uv@v7

.github/workflows/python-tests.yml

@@ -12,10 +12,10 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
 
     steps:
     - uses: actions/checkout@v7
@@ -29,22 +29,22 @@ jobs:
       uses: astral-sh/setup-uv@v7
 
     - name: Install Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@v2
 
     - name: Install dependencies
       run: |
-        uv sync
+        uv sync --no-default-groups --group test
 
     - name: Build Python bindings
       run: |
-        uv run maturin develop --release
+        uv run --no-default-groups --group test maturin develop --release --group test
 
     - name: Run Python tests
       run: |
-        uv run pytest test_cloudcheck.py -v
+        uv run --no-default-groups --group test pytest test_cloudcheck.py -v
 
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     permissions:
@@ -63,9 +63,9 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
-          python-version: "3.x"
+          python-version: "3.14"
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # 2026-09-03, no release tag
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
       - name: Get current version
@@ -254,7 +254,7 @@ jobs:
           path: dist
 
   sdist:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: publish
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     steps:
@@ -272,7 +272,7 @@ jobs:
 
   release:
     name: Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [linux, musllinux, windows, macos, sdist]
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     permissions:

.github/workflows/rust-tests.yml

@@ -11,13 +11,13 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
 
       - name: Cache Rust dependencies
         uses: actions/cache@v6
@@ -41,14 +41,14 @@ jobs:
 
   publish:
     needs: test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
 
     steps:
       - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
 
       - name: Publish to crates.io
         run: |

.github/workflows/signature-update-alerts.yml

@@ -0,0 +1,74 @@
+name: Signature Update Alerts
+
+# Opens a GitHub issue when the daily signature update fails, comments on it if it keeps failing,
+# and closes it when the update next succeeds.
+# The name below must match `name:` in daily-update.yml exactly, or alerting silently stops.
+# workflow_run only fires from this file on the default branch (stable).
+on:
+  workflow_run:
+    workflows: [Daily Signature Update]
+    types: [completed]
+
+permissions:
+  actions: read
+  issues: write
+
+concurrency:
+  group: signature-update-alerts
+  cancel-in-progress: false
+
+jobs:
+  alert:
+    runs-on: ubuntu-24.04
+    if: contains(fromJSON('["failure", "timed_out", "startup_failure", "success"]'), github.event.workflow_run.conclusion)
+    steps:
+    - name: Open, update, or close the alert issue
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        CONCLUSION: ${{ github.event.workflow_run.conclusion }}
+        RUN_ID: ${{ github.event.workflow_run.id }}
+        RUN_URL: ${{ github.event.workflow_run.html_url }}
+        RUN_EVENT: ${{ github.event.workflow_run.event }}
+        HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      run: |
+        TITLE="Daily signature update failing"
+        LABEL="signature-update-failure"
+
+        ISSUE=$(gh issue list --repo "$REPO" --label "$LABEL" --state open --json number,title \
+          | jq -r --arg t "$TITLE" '[.[] | select(.title == $t)][0].number // empty')
+
+        if [ "$CONCLUSION" = "success" ]; then
+          if [ -n "$ISSUE" ]; then
+            gh issue comment "$ISSUE" --repo "$REPO" --body "Recovered in $RUN_URL"
+            gh issue close "$ISSUE" --repo "$REPO"
+          fi
+          exit 0
+        fi
+
+        FAILED=$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs" --paginate \
+          --jq '.jobs[] | select(.conclusion == "failure") | "- `\(.name)`: \([.steps[]? | select(.conclusion == "failure") | .name] | join(", "))"')
+        FAILED=${FAILED:-"- (no failed job details available)"}
+
+        BODY=$(cat <<EOF
+        The daily signature update did not succeed.
+
+        - Conclusion: \`$CONCLUSION\`
+        - Run: $RUN_URL
+        - Trigger: \`$RUN_EVENT\` on \`$HEAD_BRANCH\` @ \`${HEAD_SHA:0:7}\`
+
+        Failed jobs and steps:
+        $FAILED
+
+        The run's job summary lists the provider errors.
+        EOF
+        )
+
+        if [ -n "$ISSUE" ]; then
+          gh issue comment "$ISSUE" --repo "$REPO" --body "$BODY"
+        else
+          gh label create "$LABEL" --repo "$REPO" --color B60205 \
+            --description "Daily signature update is failing" --force
+          gh issue create --repo "$REPO" --title "$TITLE" --label "$LABEL" --body "$BODY"
+        fi