From 81d1a1cb21a64a82eeb103e2554be65741a2aca8 Mon Sep 17 00:00:00 2001 From: Chris Olszewski Date: Fri, 30 Oct 2026 08:10:57 -0400 Subject: [PATCH 1/4] Update bridge zip dependency to 9.1.3 --- changelog/fixed/zip-zapping-zebra.md | 1 + temporalio/Cargo.lock | 12 +++++++----- 2 files changed, 8 insertions(+), 5 deletions(-) create mode 100644 changelog/fixed/zip-zapping-zebra.md diff --git a/changelog/fixed/zip-zapping-zebra.md b/changelog/fixed/zip-zapping-zebra.md new file mode 100644 index 00000000..53730000 --- /dev/null +++ b/changelog/fixed/zip-zapping-zebra.md @@ -0,0 +1 @@ +Update the bridge's zip dependency to 9.1.3 to resolve dependency issues. diff --git a/temporalio/Cargo.lock b/temporalio/Cargo.lock index f5a6d9c4..cd7c81d2 100644 --- a/temporalio/Cargo.lock +++ b/temporalio/Cargo.lock @@ -3671,7 +3671,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2", @@ -4434,9 +4434,9 @@ dependencies = [ [[package]] name = "typed-path" -version = "0.12.3" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" +checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e" [[package]] name = "typeid" @@ -5578,17 +5578,19 @@ dependencies = [ [[package]] name = "zip" -version = "9.0.4" +version = "9.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22" +checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb" dependencies = [ "bzip2", "crc32fast", "flate2", + "getrandom 0.4.3", "indexmap", "memchr", "nix", "typed-path", + "windows-sys 0.61.2", "zopfli", "zstd 0.14.3", ] From ad867704a8a8e3bd3eb8647ba4dbd250be102cc5 Mon Sep 17 00:00:00 2001 From: Chris Olszewski Date: Fri, 30 Oct 2026 08:13:22 -0400 Subject: [PATCH 2/4] Prepare release 1.10.1 --- CHANGELOG.md | 6 ++++++ changelog/fixed/zip-zapping-zebra.md | 1 - temporalio/Gemfile.lock | 4 ++-- temporalio/lib/temporalio/version.rb | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) delete mode 100644 changelog/fixed/zip-zapping-zebra.md diff --git a/CHANGELOG.md b/CHANGELOG.md index af1c0dce..54a93c79 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## [1.10.1] - 2026-10-30 + +### Fixed + +- Update the bridge's zip dependency to 9.1.3 to resolve dependency issues. + ## [1.10.0] - 2026-10-19 ### Added diff --git a/changelog/fixed/zip-zapping-zebra.md b/changelog/fixed/zip-zapping-zebra.md deleted file mode 100644 index 53730000..00000000 --- a/changelog/fixed/zip-zapping-zebra.md +++ /dev/null @@ -1 +0,0 @@ -Update the bridge's zip dependency to 9.1.3 to resolve dependency issues. diff --git a/temporalio/Gemfile.lock b/temporalio/Gemfile.lock index e000d504..ff2c0316 100644 --- a/temporalio/Gemfile.lock +++ b/temporalio/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - temporalio (1.10.0) + temporalio (1.10.1) google-protobuf (>= 3.25.0) json (< 3) logger @@ -286,7 +286,7 @@ CHECKSUMS steep (1.10.0) sha256=1b295b55f9aaff1b8d3ee42453ee55bc2a1078fda0268f288edb2dc014f4d7d1 stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1 strscan (3.1.8) sha256=aae2db611a225559f21ffbb71765c9a4e60fd262534a9ea84f4f11c7f32f679e - temporalio (1.10.0) + temporalio (1.10.1) terminal-table (4.0.0) sha256=f504793203f8251b2ea7c7068333053f0beeea26093ec9962e62ea79f94301d2 timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f diff --git a/temporalio/lib/temporalio/version.rb b/temporalio/lib/temporalio/version.rb index 3b594004..7cc192fc 100644 --- a/temporalio/lib/temporalio/version.rb +++ b/temporalio/lib/temporalio/version.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true module Temporalio - VERSION = '1.10.0' + VERSION = '1.10.1' end From f9f6719a0d572db3e5d920c4bef3a78c61cece17 Mon Sep 17 00:00:00 2001 From: Chris Olszewski Date: Fri, 30 Oct 2026 09:13:37 -0400 Subject: [PATCH 3/4] Describe zip update as a security fix --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 54a93c79..fe32151b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,9 @@ ## [1.10.1] - 2026-10-30 -### Fixed +### Security -- Update the bridge's zip dependency to 9.1.3 to resolve dependency issues. +- Update the bridge's zip dependency to 9.1.3 to address a security vulnerability in zip. ## [1.10.0] - 2026-10-19 From 5531b2a3a19461fb290871d342ff174dcd837462 Mon Sep 17 00:00:00 2001 From: Christopher Constable Date: Fri, 23 Oct 2026 12:56:43 -0400 Subject: [PATCH 4/4] ci: add Required PR Checks job to gate merges (#634) (cherry picked from commit 8dac10315a331d9c3fafa9e2ec24ab36fca4c420) --- .github/workflows/ci.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9e84c873..79927d5c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -262,3 +262,18 @@ jobs: path: temporalio/tmp/cloud-test.log if-no-files-found: warn retention-days: 14 + + # The single required status check for merging: a PR can merge only if every job in + # `needs` passed. + required-pr-checks: + name: Required PR Checks + # Without always(), this job would be skipped when a dependency fails, and GitHub + # treats a skipped required check as passing. + if: always() + needs: + - build-lint-test + runs-on: ubuntu-latest + steps: + - name: Fail if any check failed or was cancelled + if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }} + run: exit 1