[rmcdaniel]

Release notes for Waterline 2.13.2, the patch release that ships the curl/libcurl fix for #251. This PR changes only CHANGELOG.md.

Why the published image is still vulnerable

• docker.io/durableworkflow/waterline:2.12.3 (index sha256:5d1ed067…) is the declared stable_image in release/service-image-security.json.
• 2.13.0 (index sha256:925a20c8…) was pushed by tag run 39943943544. That run then failed in the post-publish "Published Composer consumer and browser" job, so 2.13.0 was never promoted to stable.
• The 2.13.1 tag run 39958650927 was cancelled before publish, so no 2.13.1 image exists.
• Pinned Trivy 0.76.1 finds curl/libcurl 8.22.0-r0 CVE-2026-92392 (HIGH, fixed in 8.23.0-r0) in both 2.12.3 and 2.13.0, on amd64 and arm64.
• The fix (fix: qualify patched service image dependencies #252: apk add --upgrade 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0' plus docker/verify-curl.php) merged on Oct 30, after both tags. Main already carries the complete 2.13.2 identity: composer product-train, oci_release.py, the image and publisher workflows, prepare-oci-publication.sh and docs/image-publication.md. No 2.13.2 tag exists yet.

This change

• Dates the 2.13.2 section to 2026-11-02.
• Adds the curl/libcurl CVE-2026-92392 entry.
• Extends the Bound service-mode list page replay per request #255 entry with strict page parsing and past-end page adoption.

There are no source, Dockerfile or workflow changes. The image source is identical to main e1cf21b, where #255 merged.

Local proof

Pending: amd64 and arm64 OCI builds of exact e1cf21b, the pinned Trivy 0.76.1 scan, and a curl version check. Receipts will be added below.

Tag, publication and installed/browser acceptance stay with General. Auto-merge is off.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Local proof for the 2.13.2 image source: exact e1cf21b5add317f3abf1a2952a3fc483ecbddd9c, the post-#255 main this PR is based on. Its Dockerfile and image inputs are identical to this PR's head 45e3612, which changes only CHANGELOG.md.

Build. Mirrors service-image.yml: git archive context, docker buildx build --pull --no-cache --provenance=false --sbom=false, build args WATERLINE_VERSION=2.13.2 and SOURCE_COMMIT=e1cf21b…, OCI output, one platform at a time.

• linux/amd64: built in 129s.
• linux/arm64: built under QEMU emulation on an Intel host in 1875s. Two earlier arm64 attempts died from cc: internal compiler error: Segmentation fault inside the emulator while compiling mbstring (docker-php-ext-install). The source is unchanged between attempts, and the curl upgrade and verify-curl.php had already passed in that same step. These were emulator crashes, not image or source failures.

Scan. The repo's own path: oci_release.py scan-layout, then scanner aquasec/trivy:0.76.1@sha256:790fd66d… (the index from release/service-image-security.json; its amd64 manifest is #251's 2e6c00d7…), then oci_release.py scan. Vulnerability DB updated 2026-11-02T19:15:11Z.

	amd64	arm64
manifest (subject)	sha256:3bffc3b3a120b6500f611e454a73057ac0cb4a668314b10f456242362b51fe50	sha256:d87e59f46ce649f24dbe316a902b8665b9e7960921328a98db80dae3bdfcad59
config	sha256:bc0ba9d0…628d7e	sha256:81ab344c…0a91d4
OS	Alpine 3.24.3	Alpine 3.24.3
validator	pass, 309 packages	pass, 308 packages
HIGH/CRITICAL	0	0
other	1 MEDIUM, 3 LOW	1 MEDIUM, 3 LOW
curl / libcurl pkg	8.23.0-r0 / 8.23.0-r0	8.23.0-r0 / 8.23.0-r0
report digest	sha256:fcf8d655…bf71	sha256:b76c87d6…bd29

Runtime check inside each image (entrypoint bypassed, no network use): curl --version reports curl 8.23.0 … libcurl/8.23.0 … nghttp2/1.70.0, PHP curl_version() reports 8.23.0 with HTTP/2 still enabled, verify-curl.php passes, and the revision label is e1cf21b….

For comparison, the same scanner finds curl/libcurl 8.22.0-r0 CVE-2026-92392 HIGH on both arches of published 2.13.0 (sha256:925a20c8…), as well as on 2.12.3.

PR CI on 45e3612: 15 success, 12 skipped (docs-only classification). The local images, buildx builder and scanner cache have been removed. Tag, publication and installed acceptance stay with General.