- Flip --native to --docker on up/down commands (native is now default)
- Add ensure_wasm_plugins() and ensure_brightstaff_binary() to auto-download from GitHub releases
- Add _find_config_dir() to support pip-installed usage without repo checkout
- Bundle config templates in wheel via pyproject.toml force-include
- Add publish-binaries.yml CI workflow for release binary uploads
- Update docs to reflect native-first experience
* Add Trivy Docker image security scan workflow
Scans the Docker image for CRITICAL and HIGH vulnerabilities using Trivy.
Blocks PRs on failures; runs non-blocking on main for visibility. Results
are uploaded to the GitHub Security tab via SARIF.
* Add explicit permissions to Docker security scan workflow
Set minimal permissions: contents read for checkout, security-events
write for SARIF upload to the GitHub Security tab.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix 27 HIGH vulnerabilities found by Trivy Docker scan
- Install supervisor via pip instead of apt to eliminate 22 Debian
python3.13 package vulnerabilities
- Pin urllib3>=2.6.3 to fix CVE-2025-66418, CVE-2025-66471, CVE-2026-21441
- Add ignore-unfixed to Trivy scan to suppress unfixable glibc CVE-2026-0861
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
