From 081d85bb6750bff1a328e8b1100487e21932108f Mon Sep 17 00:00:00 2001 From: socket-bot Date: Tue, 3 Nov 2026 17:13:41 +0000 Subject: [PATCH] chore: update firewall image to 2.16.3 --- cloudformation/README.md | 4 ++-- cloudformation/firewall-eks.yaml | 4 ++-- cloudformation/values/dns-override.values.yaml | 2 +- helm/Chart.yaml | 4 ++-- helm/README.md | 2 +- helm/values.yaml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/cloudformation/README.md b/cloudformation/README.md index 3800ab7..cd4bf44 100644 --- a/cloudformation/README.md +++ b/cloudformation/README.md @@ -14,7 +14,7 @@ On EKS the firewall is the **Helm chart** (`../helm`), which already supports DN |------|---------| | `eks-cluster.yaml` | **Greenfield wrapper** — VPC + EKS cluster + node group + OIDC provider. Skip if you already run a cluster. | | `firewall-eks.yaml` | **Shared base** — ElastiCache Redis + Socket token (Secrets Manager) + IRSA role; emits the `helm upgrade --install` command. | -| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.16.2`. | +| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.16.3`. | ## Cases @@ -29,7 +29,7 @@ The base template currently takes the **handoff** approach: CloudFormation provi ## Config model -On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.16.2`). Chart version defaults to `0.11.20`. +On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.16.3`). Chart version defaults to `0.11.21`. ## Known DRAFT caveats diff --git a/cloudformation/firewall-eks.yaml b/cloudformation/firewall-eks.yaml index 1253964..e824d1a 100644 --- a/cloudformation/firewall-eks.yaml +++ b/cloudformation/firewall-eks.yaml @@ -54,12 +54,12 @@ Parameters: ChartVersion: Type: String - Default: "0.11.20" + Default: "0.11.21" Description: Socket Firewall Helm chart version to install. FirewallImageTag: Type: String - Default: "2.16.2" + Default: "2.16.3" Description: socketdev/socket-registry-firewall image tag (must match chart appVersion). Resources: diff --git a/cloudformation/values/dns-override.values.yaml b/cloudformation/values/dns-override.values.yaml index 0e7feb9..09a2c79 100644 --- a/cloudformation/values/dns-override.values.yaml +++ b/cloudformation/values/dns-override.values.yaml @@ -17,7 +17,7 @@ image: repository: socketdev/socket-registry-firewall # Pin explicitly so CloudFormation installs don't drift if the chart # appVersion changes independently. Never use :latest for a security product. - tag: "2.16.2" + tag: "2.16.3" pullPolicy: Always socket: diff --git a/helm/Chart.yaml b/helm/Chart.yaml index b12eef1..fac0707 100644 --- a/helm/Chart.yaml +++ b/helm/Chart.yaml @@ -2,11 +2,11 @@ apiVersion: v2 name: socket-firewall description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster type: application -version: 0.11.20 +version: 0.11.21 # appVersion is the firewall image version. image.tag in values.yaml must equal # it or be empty (empty falls back to it, see templates/_helpers.tpl); the Chart # checks workflow fails a PR where they differ. -appVersion: "2.16.2" +appVersion: "2.16.3" keywords: - security - supply-chain diff --git a/helm/README.md b/helm/README.md index 894fe24..433ee23 100644 --- a/helm/README.md +++ b/helm/README.md @@ -90,7 +90,7 @@ registries: | Parameter | Description | Default | |-----------|-------------|---------| | `image.repository` | Docker image | `socketdev/socket-registry-firewall` | -| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.16.2"` | +| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.16.3"` | | `image.pullPolicy` | Image pull policy | `Always` | | `replicaCount` | Number of replicas (ignored if autoscaling enabled) | `1` | | `socket.apiToken` | Socket API token | `""` | diff --git a/helm/values.yaml b/helm/values.yaml index a1a786d..8eb8393 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -5,7 +5,7 @@ image: repository: socketdev/socket-registry-firewall # Keep in sync with Chart.yaml appVersion. Leave empty only if you intentionally # want to track whatever appVersion the installed chart carries. - tag: "2.16.2" + tag: "2.16.3" pullPolicy: Always # Image pull secrets for private registries