Skip to content

Release 2.0.46 (2026-05-25)

Bug fixes

  • validate runtime against allowlist before execvp Add validated_runtime() that asserts the runtime string is 'docker' or 'nerdctl' before passing it to os.execvp. Fixes Semgrep dangerous-os-exec-tainted-env-args findings where detect_runtime() return value was traced as tainted user input.

  • use literal executables in execvp to satisfy Semgrep taint analysis Semgrep flagged os.execvp(runtime, ...) as dangerous-os-exec-tainted-env-args because the runtime variable traces back to detect_runtime() via PATH lookup. Branch on the runtime value so execvp always receives a string literal, which breaks the taint chain without suppression comments.

  • surface subprocess stderr on failure across all lib modules Wrap subprocess.run calls in try/except to print captured stderr before re-raising CalledProcessError. Previously, check=True with capture_output=True silently swallowed error details — the exception string shows only the command and exit code, hiding the diagnostic message in exc.stderr.

Modules fixed: git, github, lima, promote, changelog, version.

For github.py specifically, get_installation_token() now catches CalledProcessError and OSError, logs a warning, and returns None so vrg-gh falls back to ambient gh auth instead of crashing.

  • update CLAUDE.md consumer template for vrg-container-run rename The vrg-docker- to vrg-container- rename (4e712baf) updated CLAUDE.md but missed the consumer template at src/vergil_tooling/data/claude_md_consumer.md. The template still referenced vrg-docker-run in two places, causing vrg-github-repo-config audit to report 'template not found' and blocking the release preflight.

Chores

  • bump version to 2.0.46

Documentation

  • add orchestrator refactor implementation plan
  • move orchestrator refactor plan to docs/specs/

Features

  • add minor and major bump support to vrg-version Extend bump() with an optional part parameter accepting "patch" (default), "minor", or "major". The CLI subcommand gains an optional positional argument: vrg-version bump [minor|major]. Ref #1069

  • extract lib/changelog.py and vrg-changelog CLI Move changelog and release notes generation from release/prepare.py into a standalone library and CLI tool. The library functions generate files without committing — callers control the commit. Ref #1069

  • add lib/promote.py and vrg-promote CLI Standalone tool to force-update the vX.Y rolling tag to point at a specific vX.Y.Z release tag. Uses subprocess.run(["git", ...]) directly — this is a human tool requiring push credentials. Ref #1069

  • add promote and develop CD fields to ReleaseContext

  • add --no-promote flag to vrg-release CLI

Refactoring

  • rename vrg-docker- to vrg-container- with runtime auto-detection Replace all vrg-docker- commands with vrg-container- equivalents to support nerdctl as a first-class runtime alongside Docker. Add detect_runtime() to lib/container.py that prefers nerdctl when available, falling back to docker.

  • simplify preflight: use version.show(), remove inline version detection and override commit

  • simplify prepare: use lib/changelog, remove -X ours merge, handle version override on release branch
  • rewrite confirm phase: known job expectations, add confirm_develop
  • rewrite bump phase: orchestrator-driven back-merge from main
  • update finalize summary: back-merge PR label, develop CD
  • update orchestrator to new 8-phase sequence with promote and split confirm