From a9d72e2dbf696976c6f09f7ef90e7acff1bc4182 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 13 May 2026 13:31:07 +0100 Subject: [PATCH 1/3] chore(deps): bump urllib3 in /eval in the uv group across 1 directory (#1512) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the uv group with 1 update in the /eval directory: [urllib3](https://github.com/urllib3/urllib3). Updates `urllib3` from 2.6.3 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergő Magyar --- eval/uv.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/eval/uv.lock b/eval/uv.lock index fcd666e75..04b89f336 100644 --- a/eval/uv.lock +++ b/eval/uv.lock @@ -2278,11 +2278,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.6.3" +version = "2.7.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" } +sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" }, + { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, ] [[package]] From 38ff7365e862625c50d88974b5cce9dc462b3bd6 Mon Sep 17 00:00:00 2001 From: Hugo Gu Date: Wed, 13 May 2026 21:45:37 +0800 Subject: [PATCH 2/3] fix(docker): install ca-certificates in runtime image for TLS verification (#1545) (#1547) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Close: #1545 Co-authored-by: Gergő Magyar --- Dockerfile.cli | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.cli b/Dockerfile.cli index 60b56451f..05bedd6c3 100644 --- a/Dockerfile.cli +++ b/Dockerfile.cli @@ -40,8 +40,8 @@ RUN npm prune --omit=dev --prefix gitnexus # node:22-bookworm-slim FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS runtime -# curl for the healthcheck; git so `gitnexus` can clone repos at runtime. -RUN apt-get update && apt-get install -y --no-install-recommends curl git && rm -rf /var/lib/apt/lists/* \ +# curl for the healthcheck; git for cloning; ca-certificates for TLS verification. +RUN apt-get update && apt-get install -y --no-install-recommends curl git ca-certificates && rm -rf /var/lib/apt/lists/* \ && rm -rf /usr/local/lib/node_modules/npm \ && rm -rf /usr/local/lib/node_modules/corepack \ && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack From 507f84b69af29f6a5596538a59175bd930d07e57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A9on=20Simmons?= Date: Wed, 13 May 2026 12:14:52 -0400 Subject: [PATCH 3/3] fix(docker): symlink gitnexus binary onto $PATH in runtime image (#1551) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README documents the Docker workflow as: WORKSPACE_DIR=$HOME/code docker compose up -d docker compose exec gitnexus-server gitnexus index /workspace/my-repo …but `gitnexus` is not on $PATH inside the published image: $ docker compose exec gitnexus-server which gitnexus (empty) $ docker compose exec gitnexus-server gitnexus --version exec: "gitnexus": executable file not found in $PATH The package.json `bin` entry (`"gitnexus": "dist/cli/index.js"`) would normally surface via `node_modules/.bin/gitnexus`, but `npm prune --omit=dev` in the builder stage strips that directory before the runtime stage copies it in. The `dist/cli/index.js` itself already has the `#!/usr/bin/env node` shebang and 755 permissions, so a single symlink into /usr/local/bin makes the README's literal command work. Verified locally: $ docker build -f Dockerfile.cli -t gitnexus:local-pr-test . $ docker run --rm gitnexus:local-pr-test gitnexus --version 1.6.4 $ docker run --rm gitnexus:local-pr-test gitnexus --help Usage: gitnexus [options] [command] … $ docker run --rm -d --name t gitnexus:local-pr-test \ && sleep 4 && docker exec t curl -s localhost:4747/api/health {"status":"ok"} CMD continues to invoke `node gitnexus/dist/cli/index.js serve …` unchanged, so the change is additive and the server boot path is untouched. Refs #1549. --- Dockerfile.cli | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Dockerfile.cli b/Dockerfile.cli index 05bedd6c3..3275c8f7e 100644 --- a/Dockerfile.cli +++ b/Dockerfile.cli @@ -58,6 +58,15 @@ COPY --from=builder --chown=node:node /app/gitnexus/package.json ./gitnexus/pack COPY --from=builder --chown=node:node /app/gitnexus/scripts/install-duckdb-extension.mjs ./gitnexus/scripts/install-duckdb-extension.mjs COPY --from=builder --chown=node:node /app/gitnexus/vendor ./gitnexus/vendor +# Expose the `gitnexus` binary on PATH so the documented Docker workflow +# (`docker compose exec gitnexus-server gitnexus index /workspace/`) +# works without users having to invoke `node /app/gitnexus/dist/cli/index.js`. +# `npm prune --omit=dev` in the builder stage strips `node_modules/.bin/` +# entries, so the `gitnexus` bin declared in package.json (`dist/cli/index.js`, +# which already carries `#!/usr/bin/env node` and 755 perms) is otherwise +# unreachable from $PATH. +RUN ln -s /app/gitnexus/dist/cli/index.js /usr/local/bin/gitnexus + USER node # The web UI defaults to http://localhost:4747 - keep that contract.