Skip to content

Merge "ballerina-5.12.5" into "stable/ballerina" - #2467

Open
choreo-cicd wants to merge 3 commits into
stable/ballerinafrom
ballerina-5.12.5
Open

Merge "ballerina-5.12.5" into "stable/ballerina"#2467
choreo-cicd wants to merge 3 commits into
stable/ballerinafrom
ballerina-5.12.5

Conversation

@choreo-cicd

@choreo-cicd choreo-cicd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

$subject

gigara and others added 3 commits August 19, 2026 10:49
@gigara
Fix trivy vulnerabilities
57d1b89
@gigara @claude
Pin ballerina-grammar submodule to brace-expansion 1.1.18 fix
452d42a 
The Trivy scan fails on brace-expansion@1.1.16 (CVE-2026-69152, HIGH) in
the ballerina-grammar submodule's package-lock.json. The fix lives in
ballerina-platform/ballerina-grammar, but init-submodules pulled the
submodule to its master tip on every build, so the pinned commit was
never what got scanned or built.

Pin the submodule to the fixed commit (fix/brace-expansion-1.1.18 in the
grammar repo) and drop the 'git pull origin master' from init-submodules
so builds actually use the pinned revision. Grammar updates now require
a deliberate pin bump instead of silently tracking master.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@choreo-cicd
Update version to ballerina-5.12.5
c0749d0
@CLAassistant

CLAassistant commented Aug 19, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ gigara
❌ choreo-cicd
You have signed the CLA already but the status is still pending? Let us recheck it.

@coderabbitai

coderabbitai Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (4)
  • main
  • feature/.*
  • release/.*
  • hotfix/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c074360b-c065-42b6-b6e5-0a85fa4b33a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hevayo hevayo Awaiting requested review from hevayo hevayo is a code owner
@gigara gigara Awaiting requested review from gigara gigara is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@choreo-cicd @CLAassistant @gigara