update

temp
chore(deps): update nginx docker tag to v1.31.6
2026-09-25 21:58:10 -04:00 · 2026-09-25 19:33:19 -04:00 · 2026-09-15 23:01:13 +00:00 · 2026-09-08 19:01:07 +00:00 · 2026-09-08 18:03:14 +00:00 · 2026-09-08 15:04:36 +00:00
68 changed files with 1194 additions and 183 deletions
@@ -0,0 +1 @@
+vendor/** linguist-generated=true
@@ -0,0 +1,97 @@
+package app
+
+import (
+	"coopcloud.tech/abra/cli/internal"
+	"coopcloud.tech/abra/pkg/client"
+	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/i18n"
+	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/upstream/stack"
+	"coopcloud.tech/abra/pkg/vulncheck"
+	"github.com/spf13/cobra"
+
+	"context"
+)
+
+var appVulncheckAliases = i18n.G("vc")
+
+var AppVulncheckCommand = &cobra.Command{
+	Use:     i18n.G("vulncheck [flags] APP"),
+	Aliases: []string{appVulncheckAliases},
+	Short:   i18n.G("Check for vulnerabilities in images for this app"),
+	Long:    i18n.G("Check for vulnerabilities in images for this app"),
+	Args:    cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		app := internal.ValidateApp(args)
+
+		if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+			log.Fatal(err)
+		}
+
+		cl, err := client.New(app.Server)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		deployMeta, err := stack.IsDeployed(context.Background(), cl, app.StackName())
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if !deployMeta.IsDeployed {
+			log.Fatal(i18n.G("%s is not deployed?", app.Name))
+		}
+
+		// log.Debugf("App: %+v", app)
+		// log.Debugf("Deployed version: %s", deployMeta.Version)
+		status := stack.GetAllDeployedServices(cl, app.StackName())
+
+		ac := &vulncheck.AdvisoryClient{}
+		ac.Init()
+
+		rows := [][]string{}
+		for _, svc := range status.Services {
+			imgname := formatter.TrimNs(svc.Spec.Labels["com.docker.stack.image"])
+			advisories := ac.GetAdvisoriesForImage(imgname)
+			for _, advisory := range advisories {
+				rows = append(rows, []string{
+					advisory.Recipe,
+					svc.Spec.Name,
+					imgname,
+					advisory.ShortDesc,
+					advisory.Details,
+				})
+			}
+		}
+
+		if len(rows) == 0 {
+			log.Info(i18n.G("No advisories found for %s", app.Name))
+			return
+		}
+
+		table, err := formatter.CreateTable()
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		headers := []string{
+			i18n.G("RECIPE"),
+			i18n.G("SERVICE"),
+			i18n.G("IMAGE"),
+			i18n.G("VERSION"),
+			i18n.G("DETAILS"),
+		}
+
+		table.
+			Headers(headers...).
+			Rows(rows...)
+
+		if err := formatter.PrintTable(table); err != nil {
+			log.Fatal(err)
+		}
+
+		upgradeTo := ac.GetRecipeUpgradeTo(deployMeta.Version)
+
+		log.Infof(i18n.G("Security advisories found for %s, upgrade recipe from %s to %s"), app.Recipe.Name, deployMeta.Version, upgradeTo)
+	},
+}
@@ -311,6 +311,7 @@ Config:
 		app.AppVolumeCommand,
 		app.AppLabelsCommand,
 		app.AppEnvCommand,
+		app.AppVulncheckCommand,
 	)

 	if err := rootCmd.Execute(); err != nil {
@@ -20,7 +20,7 @@ require (
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
 	github.com/schollz/progressbar/v3 v3.19.1
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.46.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
@@ -153,7 +153,7 @@ require (
 	github.com/stretchr/testify v1.12.1
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.47.0
+	golang.org/x/sys v0.48.0
 )

 replace github.com/docker/cli v28.4.0+incompatible => git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible
@@ -1138,13 +1138,13 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -34,6 +34,24 @@ func SmallSHA(hash string) string {
 	return hash[:8]
 }

+// TrimNs strips any repository namespace/org and digest from an image string.
+//
+// Examples:
+//
+//	"n8nio/n8n:1.81.2" -> "n8n:1.81.2"
+//	"nginx:1.29.0@sha256:3ab4ed..." -> "nginx:1.29.0"
+//	"docker.io/library/nginx:latest" -> "nginx:latest"
+func TrimNs(image string) string {
+	// 1. Remove digest suffix if present (@sha256:...)
+	if idx := strings.Index(image, "@"); idx != -1 {
+		image = image[:idx]
+	}
+
+	// 2. Remove registry domain and org/namespace path (keep only the last element)
+	parts := strings.Split(image, "/")
+	return parts[len(parts)-1]
+}
+
 // RemoveSha remove image sha from a string that are added in some docker outputs
 func RemoveSha(str string) string {
 	return strings.Split(str, "@")[0]
@@ -52,7 +52,6 @@ func Clone(dir, url string) error {
 				URL:           url,
 				Tags:          git.AllTags,
 				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
-				SingleBranch:  true,
 			})

 			if err != nil && gitCloneIgnoreErr(err) {
@@ -71,7 +70,6 @@ func Clone(dir, url string) error {
 					URL:           url,
 					Tags:          git.AllTags,
 					ReferenceName: plumbing.ReferenceName("refs/heads/master"),
-					SingleBranch:  true,
 				})

 				if err != nil && gitCloneIgnoreErr(err) {
@@ -7,7 +7,7 @@
 msgid   ""
 msgstr  "Project-Id-Version: \n"
        "Report-Msgid-Bugs-To: EMAIL\n"
-        "POT-Creation-Date: 2026-06-14 17:56+0200\n"
+        "POT-Creation-Date: 2026-08-31 19:21+0000\n"
        "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
        "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
        "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -189,7 +189,7 @@ msgstr  ""
 msgid   "%d volumes removed successfully"
 msgstr  ""

-#: ./pkg/recipe/git.go:197
+#: ./pkg/recipe/git.go:198
 #, c-format
 msgid   "%s (%s) has locally unstaged changes?"
 msgstr  ""
@@ -419,7 +419,7 @@ msgstr  ""
 msgid   "%s sanitised as %s for new app"
 msgstr  ""

-#: ./pkg/recipe/git.go:445
+#: ./pkg/recipe/git.go:451
 #, c-format
 msgid   "%s service is missing image tag?"
 msgstr  ""
@@ -902,7 +902,7 @@ msgstr  ""
 msgid   "Generate the recipe catalogue"
 msgstr  ""

-#: ./pkg/recipe/git.go:459
+#: ./pkg/recipe/git.go:465
 #, c-format
 msgid   "GetRecipeVersions encountered error for %s: %s (collected %d versions)"
 msgstr  ""
@@ -1815,7 +1815,7 @@ msgstr  ""
 msgid   "are you sure?"
 msgstr  ""

-#: ./pkg/recipe/git.go:162
+#: ./pkg/recipe/git.go:163
 #, c-format
 msgid   "attempting to checkout '%s' as chaos commit"
 msgstr  ""
@@ -1951,7 +1951,7 @@ msgstr  ""
 msgid   "cancelled"
 msgstr  ""

-#: ./pkg/catalogue/catalogue.go:59 ./pkg/recipe/git.go:251
+#: ./pkg/catalogue/catalogue.go:59 ./pkg/recipe/git.go:252
 #, c-format
 msgid   "cannot ensure %s is up-to-date, no git remotes configured"
 msgstr  ""
@@ -1966,7 +1966,7 @@ msgstr  ""
 msgid   "cannot get label %s for %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:58
+#: ./pkg/recipe/git.go:59
 #, c-format
 msgid   "cannot redeploy previous chaos version (%s), did you mean to use \"--chaos\"?"
 msgstr  ""
@@ -2118,7 +2118,7 @@ msgstr  ""
 msgid   "cmd"
 msgstr  ""

-#: ./pkg/recipe/git.go:470
+#: ./pkg/recipe/git.go:476
 #, c-format
 msgid   "collected %s for %s"
 msgstr  ""
@@ -2456,7 +2456,7 @@ msgstr  ""
 msgid   "destination directory does not exist"
 msgstr  ""

-#: ./pkg/recipe/git.go:373
+#: ./pkg/recipe/git.go:379
 #, c-format
 msgid   "detected %s as tags for recipe %s"
 msgstr  ""
@@ -2653,7 +2653,7 @@ msgstr  ""
 msgid   "ensure recipe: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:56
+#: ./pkg/recipe/git.go:57
 #, c-format
 msgid   "ensuring env version %s"
 msgstr  ""
@@ -2751,12 +2751,12 @@ msgstr  ""
 msgid   "failed to check git status of %s: %s"
 msgstr  ""

-#: ./pkg/git/branch.go:95 ./pkg/recipe/git.go:231
+#: ./pkg/git/branch.go:95 ./pkg/recipe/git.go:232
 #, c-format
 msgid   "failed to check out %s in %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:412
+#: ./pkg/recipe/git.go:418
 #, c-format
 msgid   "failed to check out %s in %s: %s"
 msgstr  ""
@@ -2806,7 +2806,7 @@ msgstr  ""
 msgid   "failed to generate random bytes: %w"
 msgstr  ""

-#: ./pkg/recipe/git.go:421
+#: ./pkg/recipe/git.go:427
 #, c-format
 msgid   "failed to get compose config for %s: %s"
 msgstr  ""
@@ -2844,7 +2844,7 @@ msgstr  ""
 msgid   "failed to parse image %s, saw: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:431
+#: ./pkg/recipe/git.go:437
 #, c-format
 msgid   "failed to parse image for %s in %s: %s"
 msgstr  ""
@@ -2952,7 +2952,7 @@ msgstr  ""
 msgid   "fetch all recipes"
 msgstr  ""

-#: ./pkg/catalogue/catalogue.go:84 ./pkg/recipe/git.go:284
+#: ./pkg/catalogue/catalogue.go:84 ./pkg/recipe/git.go:290
 #, c-format
 msgid   "fetched latest git changes for %s"
 msgstr  ""
@@ -3070,12 +3070,12 @@ msgstr  ""
 msgid   "git changes pushed"
 msgstr  ""

-#: ./pkg/recipe/git.go:417
+#: ./pkg/recipe/git.go:423
 #, c-format
 msgid   "git checkout: %s in %s"
 msgstr  ""

-#: ./pkg/git/clone.go:64 ./pkg/git/clone.go:102
+#: ./pkg/git/clone.go:63 ./pkg/git/clone.go:100
 #, c-format
 msgid   "git clone %s: cancelled due to interrupt"
 msgstr  ""
@@ -3085,17 +3085,17 @@ msgstr  ""
 msgid   "git clone: %s"
 msgstr  ""

-#: ./pkg/git/clone.go:89
+#: ./pkg/git/clone.go:87
 #, c-format
 msgid   "git clone: %s already exists"
 msgstr  ""

-#: ./pkg/git/clone.go:59 ./pkg/git/clone.go:78 ./pkg/git/clone.go:87
+#: ./pkg/git/clone.go:58 ./pkg/git/clone.go:76 ./pkg/git/clone.go:85
 #, c-format
 msgid   "git clone: %s cloned successfully"
 msgstr  ""

-#: ./pkg/git/clone.go:68
+#: ./pkg/git/clone.go:67
 msgid   "git clone: main branch failed, attempting master branch"
 msgstr  ""

@@ -3150,7 +3150,7 @@ msgstr  ""
 msgid   "git.coopcloud.tech repo exists"
 msgstr  ""

-#: ./pkg/recipe/git.go:384
+#: ./pkg/recipe/git.go:390
 #, c-format
 msgid   "git: opening repository in %s"
 msgstr  ""
@@ -4061,7 +4061,7 @@ msgstr  ""
 msgid   "proceed?"
 msgstr  ""

-#: ./pkg/recipe/git.go:404
+#: ./pkg/recipe/git.go:410
 #, c-format
 msgid   "processing %s for %s"
 msgstr  ""
@@ -4129,7 +4129,7 @@ msgstr  ""
 msgid   "re"
 msgstr  ""

-#: ./pkg/recipe/git.go:157
+#: ./pkg/recipe/git.go:158
 #, c-format
 msgid   "read %s as tags for recipe %s"
 msgstr  ""
@@ -4865,17 +4865,17 @@ msgstr  ""
 msgid   "skipping secret (because it already exists) on %s: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:413
+#: ./pkg/recipe/git.go:419
 #, c-format
 msgid   "skipping tag %s: checkout failed: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:422
+#: ./pkg/recipe/git.go:428
 #, c-format
 msgid   "skipping tag %s: invalid compose config: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:432
+#: ./pkg/recipe/git.go:438
 #, c-format
 msgid   "skipping tag %s: invalid image reference in service %s: %s"
 msgstr  ""
@@ -4978,7 +4978,7 @@ msgstr  ""
 msgid   "succeeded"
 msgstr  ""

-#: ./pkg/recipe/git.go:184
+#: ./pkg/recipe/git.go:185
 #, c-format
 msgid   "successfully checked %s out to %s in %s"
 msgstr  ""
@@ -5138,17 +5138,17 @@ msgstr  ""
 msgid   "un"
 msgstr  ""

-#: ./pkg/recipe/git.go:193
+#: ./pkg/recipe/git.go:194
 #, c-format
 msgid   "unable to check git clean status in %s: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:262
+#: ./pkg/recipe/git.go:263
 #, c-format
 msgid   "unable to check out default branch in %s: %s"
 msgstr  ""

-#: ./pkg/git/clone.go:100
+#: ./pkg/git/clone.go:98
 #, c-format
 msgid   "unable to clean up git clone of %s: %s"
 msgstr  ""
@@ -5222,7 +5222,7 @@ msgstr  ""
 msgid   "unable to discover SSH remote for %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:268
+#: ./pkg/recipe/git.go:274
 #, c-format
 msgid   "unable to fetch tags in %s: %s"
 msgstr  ""
@@ -5232,7 +5232,7 @@ msgstr  ""
 msgid   "unable to get container matching %s: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:280
+#: ./pkg/recipe/git.go:286
 #, c-format
 msgid   "unable to git pull in %s: %s"
 msgstr  ""
@@ -5261,12 +5261,12 @@ msgstr  ""
 msgid   "unable to look up server context for %s: %s"
 msgstr  ""

-#: ./cli/recipe/fetch.go:77 ./pkg/git/read.go:26 ./pkg/lint/recipe.go:491 ./pkg/recipe/git.go:242
+#: ./cli/recipe/fetch.go:77 ./pkg/git/read.go:26 ./pkg/lint/recipe.go:491 ./pkg/recipe/git.go:243
 #, c-format
 msgid   "unable to open %s: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:257
+#: ./pkg/recipe/git.go:258
 #, c-format
 msgid   "unable to open git work tree in %s: %s"
 msgstr  ""
@@ -5326,7 +5326,7 @@ msgstr  ""
 msgid   "unable to read new env %s: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:247
+#: ./pkg/recipe/git.go:248
 #, c-format
 msgid   "unable to read remotes in %s: %s"
 msgstr  ""
@@ -5361,7 +5361,7 @@ msgstr  ""
 msgid   "unable to reset commit after failed release attempt: %s"
 msgstr  ""

-#: ./pkg/recipe/git.go:166
+#: ./pkg/recipe/git.go:167
 #, c-format
 msgid   "unable to resolve '%s': %s"
 msgstr  ""
@@ -1,5 +1,17 @@
 msgid ""
-msgstr "Project-Id-Version: \nReport-Msgid-Bugs-To: EMAIL\nPOT-Creation-Date: 2026-06-14 17:56+0200\nPO-Revision-Date: 2026-08-11 06:51+0000\nLast-Translator: chasqui <chasqui@cryptolab.net>\nLanguage-Team: Spanish <https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/>\nLanguage: es\nMIME-Version: 1.0\nContent-Type: text/plain; charset=UTF-8\nContent-Transfer-Encoding: 8bit\nPlural-Forms: nplurals=2; plural=n != 1;\nX-Generator: Weblate 5.12.2\n"
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2026-08-31 19:21+0000\n"
+"PO-Revision-Date: 2026-09-01 22:35+0000\n"
+"Last-Translator: chasqui <chasqui@cryptolab.net>\n"
+"Language-Team: Spanish <https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
+"X-Generator: Weblate 5.12.2\n"

 #: cli/app/cp.go:38
 msgid ""
@@ -100,7 +112,26 @@ msgid ""
 "\n"
 "  # list apps of all servers which match a specific recipe\n"
 "  abra app ls -r gitea"
-msgstr "  # Listar todas las aplicaciones instaladas con mayor detalle\n  abra aplicacion listar --estado\n\n  # Listar todas las aplicaciones \"wordpress\" (puedes probar otras recetas)\n  abra aplicacion listar --receta wordpress\n\n  # Listar todas las aplicaciones \"wordpress\" con mayor detalle\n  abra aplicacion listar --receta wordpress --estado\n\n  #  Listar todas las aplicaciones instaladas con mayor detalle usando los comandos abreviados\n  abra app ls -S"
+msgstr ""
+"  OPCIONES Y FLAGS\n"
+"  ────────────────\n"
+"  ejemplos de uso:\n"
+"\n"
+"┌─ Información detallada ─────────────────────────────────────┐\n"
+"│  $ abra aplicacion listar --estado                          │\n"
+"└─────────────────────────────────────────────────────────────┘\n"
+"\n"
+"┌─ Aplicaciones de una receta ────────────────────────────────┐\n"
+"│  $ abra aplicacion listar --receta wordpress                │\n"
+"└─────────────────────────────────────────────────────────────┘\n"
+"\n"
+"┌─ Receta + información detallada ────────────────────────────┐\n"
+"│  $ abra aplicacion listar --receta wordpress --estado       │\n"
+"└─────────────────────────────────────────────────────────────┘\n"
+"\n"
+"┌─ Forma abreviada ───────────────────────────────────────────┐\n"
+"│  $ abra app ls -S                                           │\n"
+"└─────────────────────────────────────────────────────────────┘"

 #: cli/app/move.go:59
 msgid ""
@@ -213,7 +244,21 @@ msgstr "  abra aplicacion entorno listar \"nombre_app.dominio\""

 #: cli/app/remove.go:45
 msgid "  abra app remove 1312.net"
-msgstr "  abra aplicacion borrar \"nombre_app.dominio\""
+msgstr ""
+"  EJEMPLOS DE USO\n"
+"  ────────────────\n"
+"\n"
+"┌─ Borrar una aplicación ─────────────────────────────────────┐\n"
+"│  $ abra aplicacion borrar \"nombre_app.dominio\"              │\n"
+"└─────────────────────────────────────────────────────────────┘\n"
+"\n"
+"┌─ Borrar sin confirmación ───────────────────────────────────┐\n"
+"│  $ abra aplicacion borrar \"nombre_app.dominio\" --forzar     │\n"
+"└─────────────────────────────────────────────────────────────┘\n"
+"\n"
+"┌─ Borrar sin confirmación usando comando abreviado ──────────┐\n"
+"│  $ abra app rm \"nombre_app.dominio\" -f                      │\n"
+"└─────────────────────────────────────────────────────────────┘"

 #: cli/app/secret.go:346
 msgid "  abra app secret rm 1312.net oauth_key"
@@ -269,7 +314,7 @@ msgstr "%d volumen(es) eliminados con éxito"
 msgid "%d volumes removed successfully"
 msgstr "%d volúmenes eliminados correctamente"

-#: pkg/recipe/git.go:197
+#: pkg/recipe/git.go:198
 #, c-format
 msgid "%s (%s) has locally unstaged changes?"
 msgstr "%s (%s) ¿tiene cambios locales?"
@@ -502,7 +547,7 @@ msgstr "%s requiere inserción de secretos antes del despliegue (#generate=false
 msgid "%s sanitised as %s for new app"
 msgstr "%s sanitisado como %s para nueva aplicación"

-#: pkg/recipe/git.go:445
+#: pkg/recipe/git.go:451
 #, c-format
 msgid "%s service is missing image tag?"
 msgstr "¿falta la etiqueta de imagen del servicio %s?"
@@ -1084,7 +1129,26 @@ msgid ""
 "Generate a report of all managed apps.\n"
 "\n"
 "Use \"--status/-S\" flag to query all servers for the live deployment status."
-msgstr "BIENVENIDE AL MANUAL DE USO COMANDO \"LISTAR\"\n\nEl comando \"abra aplicacion listar\" permite consultar de forma rápida qué aplicaciones están siendo gestionadas. \nAl ejecutarlo, Abra genera un informe con la lista de aplicaciones disponibles y la información básica de cada una.\nPuedes imaginar el comando listar como una forma de decirle a Abra: «muéstrame qué aplicaciones tengo»\n\nLos comandos pueden aceptar opciones y flags que permiten modificar o ampliar la información que muestran, \nen este caso es bastante útil el uso de \"--estado\". Estas opciones se escriben después del comando siguiendo \nla sintaxis detallada más adelante."
+msgstr ""
+"┌──────────────────────────────────────────────────────────────┐\n"
+"│              MANUAL DE USO · COMANDO «LISTAR»                │\n"
+"└──────────────────────────────────────────────────────────────┘\n"
+"  DESCRIPCIÓN\n"
+"  ───────────\n"
+"  El comando:\n"
+"\n"
+"    abra aplicacion listar\n"
+"\n"
+"Permite consultar rápidamente qué aplicaciones están siendo\n"
+"gestionadas por Abra.\n"
+"\n"
+"Al ejecutarlo, Abra genera un informe con la lista de\n"
+"aplicaciones disponibles y la información básica de cada una.\n"
+"\n"
+"En pocas palabras, puedes imaginar `listar` como una forma\n"
+"de decirle a Abra:\n"
+"\n"
+"    «muéstrame qué aplicaciones tengo»"

 #: cli/app/new.go:321
 msgid "Generate app secrets?"
@@ -1110,7 +1174,7 @@ msgstr "Genera 🥷 secretos (contraseñas) automáticamente"
 msgid "Generate the recipe catalogue"
 msgstr "📋 Muestra el catálogo de 📜 recetas"

-#: pkg/recipe/git.go:459
+#: pkg/recipe/git.go:465
 #, c-format
 msgid "GetRecipeVersions encountered error for %s: %s (collected %d versions)"
 msgstr "GetRecipeVersions encontró un error para %s: %s (recopiladas %d versiones)"
@@ -1452,24 +1516,48 @@ msgid ""
 "To delete everything without prompt, use the \"--force/-f\" or the \"--no-input/n\"\n"
 "flag."
 msgstr ""
-"Elimina todo lo relacionado con una aplicación que ya está plegada.\n"
+"┌──────────────────────────────────────────────────────────────┐\n"
+"│              MANUAL DE USO · COMANDO «BORRAR»                │\n"
+"└──────────────────────────────────────────────────────────────┘\n"
+"  DESCRIPCIÓN\n"
+"  ───────────\n"
+"  El comando:\n"
 "\n"
-"Por defecto, pedirá confirmación antes de continuar. Se borrarán \n"
-"todos los secretos, volúmenes y el archivo .env local de la aplicación.\n"
+"    abra aplicacion borrar \"nombre_app.dominio\"\n"
 "\n"
-"Ejecuta este comando solo si estás seguro de querer quitar por \n"
-"completo la aplicación y todos sus datos asociados. Esta acción \n"
-"es destructiva. ¡Ten cuidado!\n"
+"elimina todo lo relacionado con una aplicación que ya está\n"
+"desplegada.\n"
 "\n"
-"Si quieres borrar volúmenes o secretos específicos, \n"
-"usa los subcomandos de eliminación bajo \"aplicación volumen\" \n"
-"y \"aplicación secreto\" en su lugar.\n"
+"Por defecto, Abra pedirá confirmación antes de continuar.\n"
 "\n"
-"Ten en cuenta que si borras el archivo .env local sin eliminar primero \n"
-"volúmenes y secretos, Abra *no* podrá ayudarte a eliminarlos después.\n"
+"La eliminación incluye:\n"
 "\n"
-"Para borrar todo sin confirmación, usa la opción \"--forzar/-f\" \n"
-"o la opción \"--no-input/-n\"."
+"    ├── secretos\n"
+"    ├── volúmenes\n"
+"    └── archivo .env local\n"
+"\n"
+"\n"
+"  ¡ATENCIÓN!\n"
+"  ──────────\n"
+"Esta es una acción destructiva.\n"
+"\n"
+"La aplicación y todos los datos asociados serán eliminados.\n"
+"Ejecuta este comando únicamente si estás seguro de querer\n"
+"quitar la aplicación por completo.\n"
+"\n"
+"\n"
+"Si quieres eliminar volúmenes o secretos específicos, utiliza\n"
+"los subcomandos correspondientes:\n"
+"\n"
+"    abra aplicacion volumen\n"
+"    abra aplicacion secreto\n"
+"\n"
+"\n"
+"  IMPORTANTE\n"
+"  ──────────\n"
+"Si eliminas el archivo .env local sin eliminar primero los\n"
+"volúmenes y secretos, Abra no podrá ayudarte a eliminarlos\n"
+"después."

 #. translators: Short description for `app volume remove` command
 #: cli/app/volume.go:90
@@ -1998,7 +2086,33 @@ msgid ""
 "  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableSubCommands}}\n"
 "\n"
 "Use \"{{.CommandPath}} [command] --help\" for more information about a command.{{end}}\n"
-msgstr "Sintaxis del comando:{{if .Runnable}}\n  {{.UseLine}}{{end}}{{if .HasAvailableSubCommands}}\n  {{.CommandPath}} [command]{{end}}{{if gt (len .Aliases) 0}}\n\nComando y comando abreviado:\n  {{.NameAndAliases}}{{end}}{{if .HasExample}}\n\nUSO DE\"OPCIONES\" y \"FLAGS\":\nImportante: 1312.net es únicamente un ejemplo utilizado para mostrar cómo debe configurarse este campo. No es necesario utilizar este nombre.\nAl ejecutar el comando, reemplaza 1312.net por el nombre o dominio real de tu aplicación.\n\n{{.Example}}{{end}}{{if .HasAvailableSubCommands}}\n\nComandos disponibles:{{range .Commands}}{{if (or .IsAvailableCommand (eq .Name \"help\"))}}\n  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableLocalFlags}}\n\nOpciones:\n{{.LocalFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasAvailableInheritedFlags}}\n\nOpciones globales:\n{{.InheritedFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasHelpSubCommands}}\n\nTemas de ayuda adicionales:{{range .Commands}}{{if .IsAdditionalHelpTopicCommand}}\n  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableSubCommands}}\n\nUse \"{{.CommandPath}} [command] --help\" para más información sobre un comando.{{end}}\n"
+msgstr ""
+"COMANDO ABREVIADO\n"
+"─────────────────\n"
+"  {{range .Aliases}}{{.}}{{end}}\n"
+"\n"
+"{{if .HasExample}}\n"
+"{{.Example}}{{end}}{{if .HasAvailableSubCommands}}\n"
+"\n"
+"Comandos disponibles:{{range .Commands}}{{if (or .IsAvailableCommand (eq .Name \"help\"))}}\n"
+"  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if .HasHelpSubCommands}}\n"
+"\n"
+"Temas de ayuda adicionales:{{range .Commands}}{{if .IsAdditionalHelpTopicCommand}}\n"
+"  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}\n"
+"\n"
+"  SINTAXIS\n"
+"  ────────{{if .Runnable}}\n"
+"  {{.UseLine}}{{end}}{{if .HasAvailableSubCommands}}\n"
+"  {{.CommandPath}} [command]{{end}}\n"
+"\n"
+"Opciones:{{if .HasAvailableLocalFlags}}\n"
+"{{.LocalFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}\n"
+"\n"
+"Opciones globales:{{if .HasAvailableInheritedFlags}}\n"
+"{{.InheritedFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}\n"
+"\n"
+"{{if .HasAvailableSubCommands}}\n"
+"Use \"{{.CommandPath}} [comando] --help\" para más información sobre un comando.{{end}}\n"

 #: cli/recipe/fetch.go:28
 msgid "Using \"--force/-f\" Git syncs an existing recipe. It does not erase unstaged changes."
@@ -2296,7 +2410,7 @@ msgstr "¿A la aplicación le falta la etiqueta de imagen?"
 msgid "are you sure?"
 msgstr "¿Estás segurx?"

-#: pkg/recipe/git.go:162
+#: pkg/recipe/git.go:163
 #, c-format
 msgid "attempting to checkout '%s' as chaos commit"
 msgstr "Intentando extraer '%s' como el commit de caos"
@@ -2439,7 +2553,7 @@ msgstr "no se pueden leer las recetas locales: %s"
 msgid "cancelled"
 msgstr "cancelado"

-#: pkg/catalogue/catalogue.go:59 pkg/recipe/git.go:251
+#: pkg/catalogue/catalogue.go:59 pkg/recipe/git.go:252
 #, c-format
 msgid "cannot ensure %s is up-to-date, no git remotes configured"
 msgstr "no se puede asegurar que %s esté actualizado, no hay remotos de git configurados"
@@ -2454,7 +2568,7 @@ msgstr "no se puede encontrar la aplicación con el nombre %s"
 msgid "cannot get label %s for %s"
 msgstr "no se puede obtener la etiqueta %s para %s"

-#: pkg/recipe/git.go:58
+#: pkg/recipe/git.go:59
 #, c-format
 msgid "cannot redeploy previous chaos version (%s), did you mean to use \"--chaos\"?"
 msgstr "no se puede redeplegar la versión anterior de caos (%s), ¿Era tu intención usar \"--caos\"?"
@@ -2614,7 +2728,7 @@ msgstr "tarea: Actualizar tags de una imagen"
 msgid "cmd"
 msgstr ""

-#: pkg/recipe/git.go:470
+#: pkg/recipe/git.go:476
 #, c-format
 msgid "collected %s for %s"
 msgstr "colectado %s para %s"
@@ -2953,7 +3067,7 @@ msgstr "tiempo de espera agotado 🟠"
 msgid "destination directory does not exist"
 msgstr "el directorio de destino no existe"

-#: pkg/recipe/git.go:373
+#: pkg/recipe/git.go:379
 #, c-format
 msgid "detected %s as tags for recipe %s"
 msgstr "detectado(s) %s como etiquetas para la receta %s"
@@ -3150,7 +3264,7 @@ msgstr "asegúrate que \"image: ...\" esté establecido en todos los servicios"
 msgid "ensure recipe: %s"
 msgstr "asegura receta: %s"

-#: pkg/recipe/git.go:56
+#: pkg/recipe/git.go:57
 #, c-format
 msgid "ensuring env version %s"
 msgstr "asegurando la versión del entorno (env) %s"
@@ -3252,12 +3366,12 @@ msgstr "🛑 error al agregar notas de la versión: %s"
 msgid "failed to check git status of %s: %s"
 msgstr "🛑 error al comprobar el estado de git de %s: %s"

-#: pkg/git/branch.go:95 pkg/recipe/git.go:231
+#: pkg/git/branch.go:95 pkg/recipe/git.go:232
 #, c-format
 msgid "failed to check out %s in %s"
 msgstr "🛑 error al cambiar a %s en %s"

-#: pkg/recipe/git.go:412
+#: pkg/recipe/git.go:418
 #, c-format
 msgid "failed to check out %s in %s: %s"
 msgstr "🛑 error al cambiar a %s en %s: %s"
@@ -3307,7 +3421,7 @@ msgstr "🛑 error al crear el volumen %s en %s: %s"
 msgid "failed to generate random bytes: %w"
 msgstr "🛑 error al generar bytes aleatorios: %w"

-#: pkg/recipe/git.go:421
+#: pkg/recipe/git.go:427
 #, c-format
 msgid "failed to get compose config for %s: %s"
 msgstr "🛑 error al obtener la configuración para %s: %s"
@@ -3345,7 +3459,7 @@ msgstr "🛑 error al migrar la configuración de la aplicación: %s"
 msgid "failed to parse image %s, saw: %s"
 msgstr "🛑 error al analizar la imagen %s; detectado: %s"

-#: pkg/recipe/git.go:431
+#: pkg/recipe/git.go:437
 #, c-format
 msgid "failed to parse image for %s in %s: %s"
 msgstr "🛑 error al analizar la imagen %s; en: %s: %s"
@@ -3453,7 +3567,7 @@ msgstr "obtener [receta | --todos] [opciones]"
 msgid "fetch all recipes"
 msgstr "Obtener todas las recetas"

-#: pkg/catalogue/catalogue.go:84 pkg/recipe/git.go:284
+#: pkg/catalogue/catalogue.go:84 pkg/recipe/git.go:290
 #, c-format
 msgid "fetched latest git changes for %s"
 msgstr "Se obtuvieron los últimos cambios de Git para %s"
@@ -3573,12 +3687,12 @@ msgstr "cambios de git confirmados"
 msgid "git changes pushed"
 msgstr "cambios de git enviados (push)"

-#: pkg/recipe/git.go:417
+#: pkg/recipe/git.go:423
 #, c-format
 msgid "git checkout: %s in %s"
 msgstr ""

-#: pkg/git/clone.go:64 pkg/git/clone.go:102
+#: pkg/git/clone.go:63 pkg/git/clone.go:100
 #, c-format
 msgid "git clone %s: cancelled due to interrupt"
 msgstr "git clone %s: cancelado por interrupción"
@@ -3588,17 +3702,17 @@ msgstr "git clone %s: cancelado por interrupción"
 msgid "git clone: %s"
 msgstr ""

-#: pkg/git/clone.go:89
+#: pkg/git/clone.go:87
 #, c-format
 msgid "git clone: %s already exists"
 msgstr "git clone: %s ya existe"

-#: pkg/git/clone.go:59 pkg/git/clone.go:78 pkg/git/clone.go:87
+#: pkg/git/clone.go:58 pkg/git/clone.go:76 pkg/git/clone.go:85
 #, c-format
 msgid "git clone: %s cloned successfully"
 msgstr "git clone: %s clonado correctamente"

-#: pkg/git/clone.go:68
+#: pkg/git/clone.go:67
 msgid "git clone: main branch failed, attempting master branch"
 msgstr "git clone: error en la rama principal; intentando la rama master"

@@ -3653,7 +3767,7 @@ msgstr "git-nombre"
 msgid "git.coopcloud.tech repo exists"
 msgstr "el repositorio git.coopcloud.tech existe"

-#: pkg/recipe/git.go:384
+#: pkg/recipe/git.go:390
 #, c-format
 msgid "git: opening repository in %s"
 msgstr "git: abriendo repositorio en %s"
@@ -4591,7 +4705,7 @@ msgstr "mostrar salida legible por máquina"
 msgid "proceed?"
 msgstr "¿procedemos?"

-#: pkg/recipe/git.go:404
+#: pkg/recipe/git.go:410
 #, c-format
 msgid "processing %s for %s"
 msgstr "procesando %s para %s"
@@ -4661,7 +4775,7 @@ msgstr ""
 msgid "re"
 msgstr ""

-#: pkg/recipe/git.go:157
+#: pkg/recipe/git.go:158
 #, c-format
 msgid "read %s as tags for recipe %s"
 msgstr "leer %s como etiquetas para la receta %s"
@@ -5407,17 +5521,17 @@ msgstr "omitiendo generación de %s (generate=false)"
 msgid "skipping secret (because it already exists) on %s: %s"
 msgstr "omitiendo secreto (porque ya existe) en %s: %s"

-#: pkg/recipe/git.go:413
+#: pkg/recipe/git.go:419
 #, c-format
 msgid "skipping tag %s: checkout failed: %s"
 msgstr "omitiendo la etiqueta %s: error en el checkout: %s"

-#: pkg/recipe/git.go:422
+#: pkg/recipe/git.go:428
 #, c-format
 msgid "skipping tag %s: invalid compose config: %s"
 msgstr "omitiendo la etiqueta %s: configuración de compose inválida: %s"

-#: pkg/recipe/git.go:432
+#: pkg/recipe/git.go:438
 #, c-format
 msgid "skipping tag %s: invalid image reference in service %s: %s"
 msgstr "omitiendo la etiqueta %s: referencia de imagen inválida en el servicio %s: %s"
@@ -5520,7 +5634,7 @@ msgstr "recortado %s a %s para el análisis"
 msgid "succeeded"
 msgstr "exitoso"

-#: pkg/recipe/git.go:184
+#: pkg/recipe/git.go:185
 #, c-format
 msgid "successfully checked %s out to %s in %s"
 msgstr "se comprobó correctamente %s de %s en %s"
@@ -5682,17 +5796,17 @@ msgstr ""
 msgid "un"
 msgstr ""

-#: pkg/recipe/git.go:193
+#: pkg/recipe/git.go:194
 #, c-format
 msgid "unable to check git clean status in %s: %s"
 msgstr "no se pudo comprobar el estado de git clean en %s: %s"

-#: pkg/recipe/git.go:262
+#: pkg/recipe/git.go:263
 #, c-format
 msgid "unable to check out default branch in %s: %s"
 msgstr "no se pudo cambiar a la rama predeterminada en %s: %s"

-#: pkg/git/clone.go:100
+#: pkg/git/clone.go:98
 #, c-format
 msgid "unable to clean up git clone of %s: %s"
 msgstr "no se pudo limpiar la clonación de Git de %s: %s"
@@ -5766,7 +5880,7 @@ msgstr "no se pudieron determinar las reglas de versionado de %s; listando todas
 msgid "unable to discover SSH remote for %s"
 msgstr "no se pudo detectar el remoto SSH para %s"

-#: pkg/recipe/git.go:268
+#: pkg/recipe/git.go:274
 #, c-format
 msgid "unable to fetch tags in %s: %s"
 msgstr "no se pudieron obtener las etiquetas en %s: %s"
@@ -5776,7 +5890,7 @@ msgstr "no se pudieron obtener las etiquetas en %s: %s"
 msgid "unable to get container matching %s: %s"
 msgstr "no se pudo obtener el contenedor que coincide con %s: %s"

-#: pkg/recipe/git.go:280
+#: pkg/recipe/git.go:286
 #, c-format
 msgid "unable to git pull in %s: %s"
 msgstr "no se pudo hacer git pull en %s: %s"
@@ -5806,12 +5920,12 @@ msgid "unable to look up server context for %s: %s"
 msgstr "no se pudo obtener el contexto del servidor para %s: %s"

 #: cli/recipe/fetch.go:77 pkg/git/read.go:26 pkg/lint/recipe.go:491
-#: pkg/recipe/git.go:242
+#: pkg/recipe/git.go:243
 #, c-format
 msgid "unable to open %s: %s"
 msgstr "no se pudo abrir %s: %s"

-#: pkg/recipe/git.go:257
+#: pkg/recipe/git.go:258
 #, c-format
 msgid "unable to open git work tree in %s: %s"
 msgstr "no se pudo abrir el git work tree en %s: %s"
@@ -5871,7 +5985,7 @@ msgstr "no se pudo consultar el estado de %s: %s"
 msgid "unable to read new env %s: %s"
 msgstr "no se pudo leer el nuevo env %s: %s"

-#: pkg/recipe/git.go:247
+#: pkg/recipe/git.go:248
 #, c-format
 msgid "unable to read remotes in %s: %s"
 msgstr "no se pudieron leer los remotos en %s: %s"
@@ -5907,7 +6021,7 @@ msgstr "no se pudo renderizar a JSON: %s"
 msgid "unable to reset commit after failed release attempt: %s"
 msgstr "no se pudo establecer los streams de IO como terminal raw: %s"

-#: pkg/recipe/git.go:166
+#: pkg/recipe/git.go:167
 #, c-format
 msgid "unable to resolve '%s': %s"
 msgstr "no se pudo resolver '%s': %s"
@@ -16,6 +16,7 @@ import (
 	"coopcloud.tech/tagcmp"
 	"github.com/distribution/reference"
 	"github.com/go-git/go-git/v5"
+	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 )

@@ -262,7 +263,12 @@ func (r Recipe) EnsureUpToDate() error {
 		return errors.New(i18n.G("unable to check out default branch in %s: %s", r.Dir, err))
 	}

-	fetchOpts := &git.FetchOptions{Tags: git.AllTags}
+	// the refspec is passed explicitly, because a repository cloned by an older abra has a
+	// single-branch refspec stored in its config and would otherwise never see other branches
+	fetchOpts := &git.FetchOptions{
+		Tags:     git.AllTags,
+		RefSpecs: []gitCfg.RefSpec{"+refs/heads/*:refs/remotes/origin/*"},
+	}
 	if err := repo.Fetch(fetchOpts); err != nil {
 		if !strings.Contains(err.Error(), "already up-to-date") {
 			return errors.New(i18n.G("unable to fetch tags in %s: %s", r.Dir, err))
@@ -3,7 +3,7 @@ version: "3.8"

 services:
  app:
-    image: nginx:1.31.4
+    image: nginx:1.31.6
    secrets:
      - test_pass_one
      - test_pass_two
@@ -0,0 +1,92 @@
+package vulncheck
+
+import (
+	"encoding/json"
+	"os"
+	"path"
+
+	"coopcloud.tech/abra/pkg/log"
+
+	"coopcloud.tech/abra/pkg/config"
+	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/git"
+)
+
+type Advisory struct {
+	Id               string   `json:"ccsa_id"`
+	Recipe           string   `json:"recipe"`
+	AdvisoryDate     string   `json:"date"`
+	RecipeVersions   []string `json:"versions"`
+	RecipesUpgradeTo []string `json:"upgrade_to"`
+	Images           []string `json:"images"`
+	ShortDesc        string   `json:"short"`
+	Details          string   `json:"description"`
+	Url              string   `json:"url"`
+}
+
+type AdvisoryClient struct {
+	Advisories []Advisory
+}
+
+func (a *AdvisoryClient) Init() {
+	dir := path.Join(config.ABRA_DIR, "security-advisories")
+
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		log.Infof("Syncing abra security advisories...")
+		err := git.Clone(dir, "https://git.coopcloud.tech/sixsmith/security-advisories.git")
+		if err != nil {
+			log.Debugf("Error cloning security advisories repo: ", err)
+			log.Fatalf("Error cloning security advisories repo: ", err)
+		}
+	}
+
+	afp := path.Join(dir, "CCSA.json")
+	err := a.loadAdvisoriesFromFile(afp)
+	if err != nil {
+		log.Fatalf("Error loading advisories: %v\n", err)
+	}
+}
+
+func (a *AdvisoryClient) loadAdvisoriesFromFile(filePath string) error {
+	file, err := os.Open(filePath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	var advisories []Advisory
+	decoder := json.NewDecoder(file)
+	err = decoder.Decode(&advisories)
+	if err != nil {
+		return err
+	}
+
+	a.Advisories = advisories
+	return nil
+}
+
+func (a *AdvisoryClient) GetAdvisoriesForImage(image string) []Advisory {
+	var relevantAdvisories []Advisory
+	for _, advisory := range a.Advisories {
+		for _, img := range advisory.Images {
+			if formatter.TrimNs(image) == formatter.TrimNs(img) {
+				relevantAdvisories = append(relevantAdvisories, advisory)
+				break
+			}
+		}
+	}
+	return relevantAdvisories
+}
+
+func (a *AdvisoryClient) GetRecipeUpgradeTo(recipeVer string) string {
+	for _, advisory := range a.Advisories {
+		for _, ver := range advisory.RecipeVersions {
+			if recipeVer == ver {
+				if len(advisory.RecipesUpgradeTo) > 0 {
+					return advisory.RecipesUpgradeTo[0]
+				}
+			}
+		}
+	}
+	return ""
+}
@@ -0,0 +1 @@
+package vulncheck
@@ -122,6 +122,39 @@ teardown(){
  assert_failure
 }

+@test "create new app with commit from another branch" {
+  branchHash=$(_get_other_branch_hash)
+  if [[ -z "$branchHash" ]]; then
+    skip "$TEST_RECIPE has no branch besides main"
+  fi
+
+  # re-clone the recipe the way an older abra did, with a single-branch refspec. --no-local
+  # forces a real transfer, a local clone would hardlink the whole object database and leave
+  # the commit reachable
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  run git clone -q --no-local --single-branch --branch main \
+    "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  # the commit has to be genuinely missing, otherwise this test passes for the wrong reason
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-parse --verify "$branchHash^{commit}"
+  assert_failure
+
+  run $ABRA app new "$TEST_RECIPE" "$branchHash" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  # the recipe names itself in TYPE, which differs per branch, so only the version is checked
+  run grep -q "TYPE=.*:${branchHash}$" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+}
+
@test "does not overwrite existing env files" {
  run $ABRA app new "$TEST_RECIPE" \
    --no-input \
@@ -56,6 +56,13 @@ _get_tag_hash() {
  echo $(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list -n 1 "$1")
 }

+_get_other_branch_hash() {
+  # asked from the origin mirror, not from the recipe checkout, so that the result does not
+  # depend on what has been fetched. empty when the recipe only has a default branch
+  echo $(git ls-remote "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" \
+    | grep 'refs/heads/' | grep -v 'refs/heads/main$' | head -1 | cut -f1)
+}
+
 _get_head_hash() {
  echo $(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show -s --format="%H" HEAD)
 }
@@ -3,7 +3,7 @@ version: "3.8"

 services:
  app:
-    image: nginx:1.31.4
+    image: nginx:1.31.6
    networks:
      - proxy
    deploy:
@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
+FROM golang:1.27@sha256:512690a5660563b57d37ecc31129e7f136e831db2aed24a1dbeb8ad7380dc0fa

 ENV GOOS=linux
 ENV GOARCH=arm
@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
+FROM golang:1.27@sha256:512690a5660563b57d37ecc31129e7f136e831db2aed24a1dbeb8ad7380dc0fa

 ENV GOOS=linux
 ENV GOARCH=arm64
@@ -182,12 +182,13 @@ var MIPS64X struct {
 // require kernel support to work (DARN, SCV), so there are feature bits for
 // those as well. The struct is padded to avoid false sharing.
 var PPC64 struct {
-	_        CacheLinePad
-	HasDARN  bool // Hardware random number generator (requires kernel enablement)
-	HasSCV   bool // Syscall vectored (requires kernel enablement)
-	IsPOWER8 bool // ISA v2.07 (POWER8)
-	IsPOWER9 bool // ISA v3.00 (POWER9), implies IsPOWER8
-	_        CacheLinePad
+	_         CacheLinePad
+	HasDARN   bool // Hardware random number generator (requires kernel enablement)
+	HasSCV    bool // Syscall vectored (requires kernel enablement)
+	IsPOWER8  bool // ISA v2.07 (POWER8)
+	IsPOWER9  bool // ISA v3.00 (POWER9), implies IsPOWER8
+	IsPOWER10 bool // ISA v3.1 (POWER10 and POWER11; POWER11 did not add a new architected level), implies IsPOWER9
+	_         CacheLinePad
 }

 // S390X contains the supported CPU features of the current IBM Z
@@ -248,13 +249,21 @@ var RISCV64 struct {
 	HasZvks           bool // ShangMi Algorithm Suite
 	HasZvksc          bool // ShangMi Algorithm Suite with carryless multiplication
 	HasZvksg          bool // ShangMi Algorithm Suite with GCM
+	VLENB             uint // Vector register length in bytes, 0 if undetected
 	_                 CacheLinePad
 }

+// doDerived, if non-nil, is called after processing GODEBUG to set "derived"
+// feature flags.
+var doDerived func()
+
 func init() {
 	archInit()
 	initOptions()
 	processOptions()
+	if doDerived != nil {
+		doDerived()
+	}
 }

 // options contains the cpu debug options that can be used in GODEBUG.
@@ -0,0 +1,11 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+
+package cpu
+
+// Can only be called when the vector extension is present.
+// Implemented in cpu_riscv64.s.
+func readVLENB() uint
@@ -11,6 +11,7 @@ const (
 	// ISA Level
 	_PPC_FEATURE2_ARCH_2_07 = 0x80000000
 	_PPC_FEATURE2_ARCH_3_00 = 0x00800000
+	_PPC_FEATURE2_ARCH_3_1  = 0x00040000

 	// CPU features
 	_PPC_FEATURE2_DARN = 0x00200000
@@ -21,6 +22,9 @@ func doinit() {
 	// HWCAP2 feature bits
 	PPC64.IsPOWER8 = isSet(hwCap2, _PPC_FEATURE2_ARCH_2_07)
 	PPC64.IsPOWER9 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_00)
+	// ISA 3.1 covers both POWER10 and POWER11: POWER11 did not introduce a
+	// new architected HWCAP level, so there is no separate IsPOWER11.
+	PPC64.IsPOWER10 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_1)
 	PPC64.HasDARN = isSet(hwCap2, _PPC_FEATURE2_DARN)
 	PPC64.HasSCV = isSet(hwCap2, _PPC_FEATURE2_SCV)
 }
@@ -130,6 +130,9 @@ func doinit() {
 			RISCV64.HasFastMisaligned = v == riscv_HWPROBE_MISALIGNED_FAST
 		}
 	}
+	if RISCV64.HasV {
+		RISCV64.VLENB = readVLENB()
+	}

 	// Let's double check with HWCAP if the C extension does not appear to be supported.
 	// This may happen if we're running on a kernel older than 6.4.
@@ -137,6 +140,14 @@ func doinit() {
 	if !RISCV64.HasC {
 		RISCV64.HasC = isSet(hwCap, hwcap_RISCV_ISA_C)
 	}
+
+	doDerived = func() {
+		// If the vector extension is disabled by GODEBUG, then the VLENB is zero.
+		if !RISCV64.HasV {
+			RISCV64.VLENB = 0
+		}
+	}
+
 }

 func isSet(hwc uint, value uint) bool {
@@ -0,0 +1,47 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build netbsd && amd64 && gc
+
+package cpu
+
+func doinit() {
+	// NetBSD corrupts avx registers when receiving signals.
+	// See issue 80285.
+	// TODO: when NetBSD fixes the bug, add a version
+	// check and skip here.
+	X86.HasAVX = false
+	X86.HasAVX2 = false
+	// Set these also, just to be safe
+	X86.HasAVXVNNI = false
+	X86.HasAVX512 = false
+	X86.HasAVX512F = false
+	X86.HasAVX512CD = false
+	X86.HasAVX512CD = false
+	X86.HasAVX512ER = false
+	X86.HasAVX512PF = false
+	X86.HasAVX512VL = false
+	X86.HasAVX512BW = false
+	X86.HasAVX512DQ = false
+	X86.HasAVX512IFMA = false
+	X86.HasAVX512VBMI = false
+	X86.HasAVX5124VNNIW = false
+	X86.HasAVX5124FMAPS = false
+	X86.HasAVX512VPOPCNTDQ = false
+	X86.HasAVX512VPCLMULQDQ = false
+	X86.HasAVX512VNNI = false
+	X86.HasAVX512GFNI = false
+	X86.HasAVX512VAES = false
+	X86.HasAVX512VBMI2 = false
+	X86.HasAVX512BITALG = false
+	X86.HasAVX512BF16 = false
+	X86.HasAVXIFMA = false
+	X86.HasAVXVNNI = false
+	X86.HasAVXVNNIInt8 = false
+
+}
+
+func darwinSupportsAVX512() bool {
+	panic("only implemented for gc && amd64 && darwin")
+}
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

-//go:build 386 || amd64p32 || (amd64 && (!darwin || !gc))
+//go:build 386 || amd64p32 || (amd64 && ((!darwin && !netbsd) || !gc))

 package cpu

@@ -0,0 +1,17 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+
+#include "textflag.h"
+
+// Read the vector register length in bytes from the vlenb CSR.
+// May only be called when the vector extension is present.
+// func readVLENB() uint
+TEXT ·readVLENB(SB), NOSPLIT|NOFRAME, $0-8
+	// Go 1.25's assembler does not recognize VLENB, so use its raw CSRR encoding.
+	// Replace WORD with CSRR VLENB, X10 once go.mod requires Go 1.27.
+	WORD	$0xc2202573
+	MOV	X10, ret+0(FP)
+	RET
@@ -0,0 +1,12 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build sparc64
+
+package cpu
+
+// The L1 line is 32 bytes; false sharing is governed by the 64-byte L2 line.
+const cacheLineSize = 64
+
+func initOptions() {}
@@ -22,7 +22,13 @@ import (
 // fields can be get and set using the following methods:
 //   - Uint16/SetUint16: flags
 //   - Uint32/SetUint32: ifindex, metric, mtu
-type Ifreq struct{ raw ifreq }
+type Ifreq struct {
+	// Aligns the union for the accessors below, which cast it in place;
+	// the generated ifreq is all byte arrays, so its alignment is one.
+	_ [0]int64
+
+	raw ifreq
+}

 // NewIfreq creates an Ifreq with the input network interface name after
 // validating the name does not exceed IFNAMSIZ-1 (trailing NULL required)
@@ -332,3 +332,10 @@ func IoctlLoopSetStatus64(fd int, value *LoopInfo64) error {
 func IoctlLoopConfigure(fd int, value *LoopConfig) error {
 	return ioctlPtr(fd, LOOP_CONFIGURE, unsafe.Pointer(value))
 }
+
+// IoctlPidfdInfo fetches information about a pidfd.
+// The Mask field of the info argument indicates which
+// values to fetch.
+func IoctlPidfdInfo(fd int, info *PidfdInfo) error {
+	return ioctlPtr(fd, PIDFD_GET_INFO, unsafe.Pointer(info))
+}
@@ -290,14 +290,7 @@ struct ltchars {
 #include <mtd/mtd-user.h>
 #include <net/route.h>

-#if defined(__sparc__)
-// On sparc{,64}, the kernel defines struct termios2 itself which clashes with the
-// definition in glibc. As only the error constants are needed here, include the
-// generic termibits.h (which is included by termbits.h on sparc).
-#include <asm-generic/termbits.h>
-#else
 #include <asm/termbits.h>
-#endif

 #ifndef PTRACE_GETREGS
 #define PTRACE_GETREGS	0xc
@@ -544,7 +537,7 @@ ccflags="$@"
 		$2 ~ /^LO_(KEY|NAME)_SIZE$/ ||
 		$2 ~ /^LOOP_(CLR|CTL|GET|SET)_/ ||
 		$2 == "LOOP_CONFIGURE" ||
-		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
+		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|MLOCK|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
 		$2 ~ /^NFC_(GENL|PROTO|COMM|RF|SE|DIRECTION|LLCP|SOCKPROTO)_/ ||
 		$2 ~ /^NFC_.*_(MAX)?SIZE$/ ||
 		$2 ~ /^PTP_/ ||
@@ -76,7 +76,7 @@ func BytePtrToString(p *byte) string {
 	// Find NUL terminator.
 	n := 0
 	for ptr := unsafe.Pointer(p); *(*byte)(ptr) != 0; n++ {
-		ptr = unsafe.Pointer(uintptr(ptr) + 1)
+		ptr = unsafe.Add(ptr, 1)
 	}

 	return string(unsafe.Slice(p, n))
@@ -188,7 +188,7 @@ func (sa *SockaddrUnix) sockaddr() (unsafe.Pointer, _Socklen, error) {
 	}
 	sa.raw.Len = byte(3 + n) // 2 for Family, Len; 1 for NUL
 	sa.raw.Family = AF_UNIX
-	for i := 0; i < n; i++ {
+	for i := range n {
 		sa.raw.Path[i] = int8(name[i])
 	}
 	return unsafe.Pointer(&sa.raw), _Socklen(sa.raw.Len), nil
@@ -2363,7 +2363,7 @@ func (fh *FileHandle) Bytes() []byte {
 	if n == 0 {
 		return nil
 	}
-	return unsafe.Slice((*byte)(unsafe.Pointer(uintptr(unsafe.Pointer(&fh.fileHandle.Type))+4)), n)
+	return unsafe.Slice((*byte)(unsafe.Add(unsafe.Pointer(&fh.fileHandle.Type), 4)), n)
 }

 // NameToHandleAt wraps the name_to_handle_at system call; it obtains
@@ -2048,6 +2048,7 @@ const (
 	MINIX3_SUPER_MAGIC                          = 0x4d5a
 	MINIX_SUPER_MAGIC                           = 0x137f
 	MINIX_SUPER_MAGIC2                          = 0x138f
+	MLOCK_ONFAULT                               = 0x1
 	MNT_DETACH                                  = 0x2
 	MNT_EXPIRE                                  = 0x4
 	MNT_FORCE                                   = 0x1
@@ -3862,6 +3863,7 @@ const (
 	TIOCPKT_NOSTOP                              = 0x10
 	TIOCPKT_START                               = 0x8
 	TIOCPKT_STOP                                = 0x4
+	TIOCSER_TEMT                                = 0x1
 	TIPC_ADDR_ID                                = 0x3
 	TIPC_ADDR_MCAST                             = 0x1
 	TIPC_ADDR_NAME                              = 0x2
@@ -483,7 +483,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443
@@ -484,7 +484,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443
@@ -489,7 +489,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443
@@ -483,7 +483,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443
@@ -476,7 +476,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443
@@ -481,7 +481,6 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409
@@ -481,7 +481,6 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409
@@ -481,7 +481,6 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409
@@ -481,7 +481,6 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409
@@ -535,7 +535,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETC                         = 0x80067411
 	TIOCSETD                         = 0x5423
 	TIOCSETN                         = 0x8006740a
@@ -539,7 +539,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETC                         = 0x80067411
 	TIOCSETD                         = 0x5423
 	TIOCSETN                         = 0x8006740a
@@ -539,7 +539,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETC                         = 0x80067411
 	TIOCSETD                         = 0x5423
 	TIOCSETN                         = 0x8006740a
@@ -486,7 +486,6 @@ const (
 	TIOCSERGWILD                                 = 0x5454
 	TIOCSERSETMULTI                              = 0x545b
 	TIOCSERSWILD                                 = 0x5455
-	TIOCSER_TEMT                                 = 0x1
 	TIOCSETD                                     = 0x5423
 	TIOCSIG                                      = 0x40045436
 	TIOCSISO7816                                 = 0xc0285443
@@ -545,7 +545,6 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
-	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443
@@ -14,21 +14,21 @@ const (
 	ASI_LEON_DFLUSH                  = 0x11
 	ASI_LEON_IFLUSH                  = 0x10
 	ASI_LEON_MMUFLUSH                = 0x18
-	B1000000                         = 0x1008
+	B1000000                         = 0x100c
 	B115200                          = 0x1002
-	B1152000                         = 0x1009
-	B1500000                         = 0x100a
-	B2000000                         = 0x100b
+	B1152000                         = 0x100d
+	B1500000                         = 0x100e
+	B153600                          = 0x1006
+	B2000000                         = 0x100f
 	B230400                          = 0x1003
-	B2500000                         = 0x100c
-	B3000000                         = 0x100d
-	B3500000                         = 0x100e
-	B4000000                         = 0x100f
+	B307200                          = 0x1007
 	B460800                          = 0x1004
-	B500000                          = 0x1005
+	B500000                          = 0x100a
 	B57600                           = 0x1001
-	B576000                          = 0x1006
-	B921600                          = 0x1007
+	B576000                          = 0x100b
+	B614400                          = 0x1008
+	B76800                           = 0x1005
+	B921600                          = 0x1009
 	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
@@ -91,7 +91,7 @@ const (
 	FFDLY                            = 0x8000
 	FICLONE                          = 0x80049409
 	FICLONERANGE                     = 0x8020940d
-	FLUSHO                           = 0x1000
+	FLUSHO                           = 0x2000
 	FS_IOC_ENABLE_VERITY             = 0x80806685
 	FS_IOC_GETFLAGS                  = 0x40086601
 	FS_IOC_GET_ENCRYPTION_NONCE      = 0x4010661b
@@ -563,6 +563,9 @@ const (
 	TIOCM_CD                         = 0x40
 	TIOCM_CTS                        = 0x20
 	TIOCM_DSR                        = 0x100
+	TIOCM_LOOP                       = 0x8000
+	TIOCM_OUT1                       = 0x2000
+	TIOCM_OUT2                       = 0x4000
 	TIOCM_RI                         = 0x80
 	TIOCM_RNG                        = 0x80
 	TIOCM_SR                         = 0x10
@@ -641,10 +644,11 @@ const (
 	UBI_IOCVOLRMBLK                  = 0x20004f08
 	UBI_IOCVOLUP                     = 0x80084f00
 	VDISCARD                         = 0xd
+	VDSUSP                           = 0xb
 	VEOF                             = 0x4
-	VEOL                             = 0xb
-	VEOL2                            = 0x10
-	VMIN                             = 0x6
+	VEOL                             = 0x5
+	VEOL2                            = 0x6
+	VMIN                             = 0x4
 	VREPRINT                         = 0xc
 	VSTART                           = 0x8
 	VSTOP                            = 0x9
@@ -664,6 +668,7 @@ const (
 	WDIOC_KEEPALIVE                  = 0x40045705
 	WDIOC_SETOPTIONS                 = 0x40045704
 	WORDSIZE                         = 0x40
+	WRAP                             = 0x20000
 	XCASE                            = 0x4
 	XTABS                            = 0x1800
 	_HIDIOCGRAWNAME                  = 0x40804804
@@ -4264,19 +4264,29 @@ type HwTstampConfig struct {
 }

 const (
-	HWTSTAMP_FILTER_NONE            = 0x0
-	HWTSTAMP_FILTER_ALL             = 0x1
-	HWTSTAMP_FILTER_SOME            = 0x2
-	HWTSTAMP_FILTER_PTP_V1_L4_EVENT = 0x3
-	HWTSTAMP_FILTER_PTP_V2_L4_EVENT = 0x6
-	HWTSTAMP_FILTER_PTP_V2_L2_EVENT = 0x9
-	HWTSTAMP_FILTER_PTP_V2_EVENT    = 0xc
+	HWTSTAMP_FILTER_NONE                = 0x0
+	HWTSTAMP_FILTER_ALL                 = 0x1
+	HWTSTAMP_FILTER_SOME                = 0x2
+	HWTSTAMP_FILTER_PTP_V1_L4_EVENT     = 0x3
+	HWTSTAMP_FILTER_PTP_V1_L4_SYNC      = 0x4
+	HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ = 0x5
+	HWTSTAMP_FILTER_PTP_V2_L4_EVENT     = 0x6
+	HWTSTAMP_FILTER_PTP_V2_L4_SYNC      = 0x7
+	HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ = 0x8
+	HWTSTAMP_FILTER_PTP_V2_L2_EVENT     = 0x9
+	HWTSTAMP_FILTER_PTP_V2_L2_SYNC      = 0xa
+	HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ = 0xb
+	HWTSTAMP_FILTER_PTP_V2_EVENT        = 0xc
+	HWTSTAMP_FILTER_PTP_V2_SYNC         = 0xd
+	HWTSTAMP_FILTER_PTP_V2_DELAY_REQ    = 0xe
+	HWTSTAMP_FILTER_NTP_ALL             = 0xf
 )

 const (
 	HWTSTAMP_TX_OFF          = 0x0
 	HWTSTAMP_TX_ON           = 0x1
 	HWTSTAMP_TX_ONESTEP_SYNC = 0x2
+	HWTSTAMP_TX_ONESTEP_P2P  = 0x3
 )

 type (
@@ -4541,6 +4551,48 @@ const (
 	LANDLOCK_RULE_PATH_BENEATH = 0x1
 )

+const (
+	PIDFD_SIGNAL_THREAD        = 0x1
+	PIDFD_SIGNAL_THREAD_GROUP  = 0x2
+	PIDFD_SIGNAL_PROCESS_GROUP = 0x4
+	PIDFD_SELF_THREAD          = -0x2710
+	PIDFD_SELF_THREAD_GROUP    = -0x2711
+	PIDFD_SELF                 = -0x2710
+	PIDFD_SELF_PROCESS         = -0x2711
+	PIDFD_INFO_PID             = 0x1
+	PIDFD_INFO_CREDS           = 0x2
+	PIDFD_INFO_CGROUPID        = 0x4
+	PIDFD_INFO_EXIT            = 0x8
+	PIDFD_INFO_COREDUMP        = 0x10
+	PIDFD_COREDUMPED           = 0x1
+	PIDFD_COREDUMP_SKIP        = 0x2
+	PIDFD_COREDUMP_USER        = 0x4
+	PIDFD_COREDUMP_ROOT        = 0x8
+	PIDFD_INFO_SIZE_VER0       = 0x40
+	PIDFD_GET_INFO             = 0xc048ff0b
+)
+
+const SizeofPidfdInfo = 0x48
+
+type PidfdInfo struct {
+	Mask          uint64
+	Cgroupid      uint64
+	Pid           uint32
+	Tgid          uint32
+	Ppid          uint32
+	Ruid          uint32
+	Rgid          uint32
+	Euid          uint32
+	Egid          uint32
+	Suid          uint32
+	Sgid          uint32
+	Fsuid         uint32
+	Fsgid         uint32
+	Exit_code     int32
+	Coredump_mask uint32
+	_             uint32
+}
+
 const (
 	IPC_CREAT   = 0x200
 	IPC_EXCL    = 0x400
@@ -6473,3 +6525,23 @@ type GPIOV2LineEvent struct {
 	Line_seqno   uint32
 	_            [6]uint32
 }
+
+const (
+	IPMI_MAX_ADDR_SIZE              = 0x20
+	IPMI_SYSTEM_INTERFACE_ADDR_TYPE = 0xc
+	IPMI_BMC_CHANNEL                = 0xf
+	IPMI_RESPONSE_RECV_TYPE         = 0x1
+)
+
+type IPMISystemInterfaceAddr struct {
+	Type    int32
+	Channel int16
+	Lun     uint8
+	_       [1]byte
+}
+type IPMIMsg struct {
+	Netfn uint8
+	Cmd   uint8
+	Len   uint16
+	Data  *uint8
+}
@@ -680,7 +680,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -715,3 +726,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8014690d
+	IPMICTL_RECEIVE_MSG  = 0xc018690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int32
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int32
+	Msg       IPMIMsg
+}
@@ -697,7 +697,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -729,3 +740,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -674,7 +674,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -709,3 +720,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8014690d
+	IPMICTL_RECEIVE_MSG  = 0xc018690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int32
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int32
+	Msg       IPMIMsg
+}
@@ -676,7 +676,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -708,3 +719,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -677,7 +677,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -709,3 +720,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -680,7 +680,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x80
+	PIDFD_NONBLOCK                        = 0x80
+	PIDFD_THREAD                          = 0x400
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -714,3 +725,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4014690d
+	IPMICTL_RECEIVE_MSG  = 0xc018690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int32
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int32
+	Msg       IPMIMsg
+}
@@ -679,7 +679,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x80
+	PIDFD_NONBLOCK                        = 0x80
+	PIDFD_THREAD                          = 0x400
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -711,3 +722,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -679,7 +679,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x80
+	PIDFD_NONBLOCK                        = 0x80
+	PIDFD_THREAD                          = 0x400
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -711,3 +722,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -680,7 +680,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x80
+	PIDFD_NONBLOCK                        = 0x80
+	PIDFD_THREAD                          = 0x400
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -714,3 +725,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4014690d
+	IPMICTL_RECEIVE_MSG  = 0xc018690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int32
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int32
+	Msg       IPMIMsg
+}
@@ -686,7 +686,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -722,3 +733,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4014690d
+	IPMICTL_RECEIVE_MSG  = 0xc018690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int32
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int32
+	Msg       IPMIMsg
+}
@@ -686,7 +686,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -717,3 +728,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -686,7 +686,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -717,3 +728,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -704,7 +704,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -796,3 +807,22 @@ const (
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -700,7 +700,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x800
+	PIDFD_NONBLOCK                        = 0x800
+	PIDFD_THREAD                          = 0x80
+	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
+	PIDFD_GET_IPC_NAMESPACE               = 0xff02
+	PIDFD_GET_MNT_NAMESPACE               = 0xff03
+	PIDFD_GET_NET_NAMESPACE               = 0xff04
+	PIDFD_GET_PID_NAMESPACE               = 0xff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
+	PIDFD_GET_TIME_NAMESPACE              = 0xff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
+	PIDFD_GET_USER_NAMESPACE              = 0xff09
+	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
 )

 type SysvIpcPerm struct {
@@ -731,3 +742,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x8028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -681,7 +681,18 @@ const (
 )

 const (
-	PIDFD_NONBLOCK = 0x4000
+	PIDFD_NONBLOCK                        = 0x4000
+	PIDFD_THREAD                          = 0x800
+	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
+	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
+	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
+	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
+	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
+	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
+	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
+	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
+	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
+	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
 )

 type SysvIpcPerm struct {
@@ -712,3 +723,22 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
+
+const (
+	IPMICTL_SEND_COMMAND = 0x4028690d
+	IPMICTL_RECEIVE_MSG  = 0xc030690c
+)
+
+type IPMIReq struct {
+	Addr  *uint8
+	Len   uint32
+	Msgid int64
+	Msg   IPMIMsg
+}
+type IPMIRecv struct {
+	Recv_type int32
+	Addr      *uint8
+	Addr_len  uint32
+	Msgid     int64
+	Msg       IPMIMsg
+}
@@ -1065,6 +1065,7 @@ const (
 	SO_BROADCAST              = 32
 	SO_LINGER                 = 128
 	SO_RCVBUF                 = 0x1002
+	SO_SNDTIMEO               = 0x1005
 	SO_RCVTIMEO               = 0x1006
 	SO_SNDBUF                 = 0x1001
 	SO_UPDATE_ACCEPT_CONTEXT  = 0x700b
@@ -106,6 +106,9 @@ type Terminal struct {
 	// a read. It aliases into inBuf.
 	remainder []byte
 	inBuf     [256]byte
+	// readErr is an error returned by a read that also returned data. It is
+	// reported after all of that data has been processed.
+	readErr error

 	// History records and retrieves lines of input read by [ReadLine] which
 	// a user can retrieve and navigate using the up and down arrow keys.
@@ -788,7 +791,11 @@ func (t *Terminal) ReadPassword(prompt string) (line string, err error) {
 	return
 }

-// ReadLine returns a line of input from the terminal.
+// ReadLine returns a line of input from the terminal, excluding the
+// trailing newline. It may return partial data along with an error.
+// An [io.EOF] error indicates the end of the stream. For other errors,
+// such as [ErrPasteIndicator] in bracketed paste mode, a subsequent
+// call may return more data.
 func (t *Terminal) ReadLine() (line string, err error) {
 	t.lock.Lock()
 	defer t.lock.Unlock()
@@ -863,21 +870,24 @@ func (t *Terminal) readLine() (line string, err error) {
 			}
 			return
 		}
+		if t.readErr != nil {
+			err = t.readErr
+			t.readErr = nil
+			return
+		}

 		// t.remainder is a slice at the beginning of t.inBuf
 		// containing a partial key sequence
 		readBuf := t.inBuf[len(t.remainder):]
-		var n int

 		t.lock.Unlock()
-		n, err = t.c.Read(readBuf)
+		n, readErr := t.c.Read(readBuf)
 		t.lock.Lock()

-		if err != nil {
-			return
-		}
-
 		t.remainder = t.inBuf[:n+len(t.remainder)]
+		if readErr != nil {
+			t.readErr = readErr
+		}
 	}
 }

@@ -696,16 +696,16 @@ golang.org/x/net/internal/socks
 golang.org/x/net/internal/timeseries
 golang.org/x/net/proxy
 golang.org/x/net/trace
-# golang.org/x/sys v0.47.0
-## explicit; go 1.25.0
+# golang.org/x/sys v0.48.0
+## explicit; go 1.26.0
 golang.org/x/sys/cpu
 golang.org/x/sys/execabs
 golang.org/x/sys/plan9
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/term v0.45.0
-## explicit; go 1.25.0
+# golang.org/x/term v0.46.0
+## explicit; go 1.26.0
 golang.org/x/term
 # golang.org/x/text v0.39.0
 ## explicit; go 1.25.0
Author	SHA1	Message	Date
sixsmith	f648a94a25	update	2026-09-25 21:58:10 -04:00
sixsmith	12c29fd0be	temp	2026-09-25 19:33:19 -04:00
renovate-bot	ca39ff6e29	chore(deps): update nginx docker tag to v1.31.6	2026-09-15 23:01:13 +00:00
renovate-bot	5d00b3c932	chore(deps): update golang docker tag	2026-09-08 19:01:07 +00:00
renovate-bot	a380b5e8ae	chore(deps): update module golang.org/x/term to v0.46.0	2026-09-08 18:03:14 +00:00
renovate-bot	9ff5024a58	chore(deps): update golang docker tag	2026-09-08 15:04:36 +00:00
renovate-bot	d6dd082e59	chore(deps): update module golang.org/x/sys to v0.48.0	2026-09-08 14:02:32 +00:00
Weblate	0531f30590	chore: update translation files Updated by "Update PO files to match POT (msgmerge)" add-on in Weblate. Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/	2026-09-07 14:34:36 +00:00
moritz	27ca0cd21e	test(app new): cover a commit that only exists on another branch	2026-09-07 14:34:27 +00:00
moritz	920a898955	fix(git): clone every branch so commits outside the default branch resolve	2026-09-07 14:34:27 +00:00
sixsmith	7cbc974763	chore: mark vendor directory as generated	2026-09-03 05:30:34 +00:00
renovate-bot	c71b764546	chore(deps): update otel/weaver docker tag to v0.26.1	2026-09-03 02:01:10 +00:00
renovate-bot	5db8430a73	chore(deps): update nginx docker tag to v1.31.5	2026-09-02 23:01:08 +00:00
renovate-bot	091c4a2ac1	chore(deps): update otel/weaver docker tag to v0.26.0	2026-09-02 19:01:09 +00:00
ChasquiLabo	8e935d08a6	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 22:35:20 +00:00
ChasquiLabo	b959c55852	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 21:54:01 +00:00
ChasquiLabo	bab9b21882	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 21:42:51 +00:00
ChasquiLabo	703fbf5c8a	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 21:41:22 +00:00
ChasquiLabo	aaaf855a6e	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 21:39:07 +00:00
ChasquiLabo	a6666be477	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 19:30:19 +00:00
ChasquiLabo	ba90b04624	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 19:03:00 +00:00
ChasquiLabo	debbdde5d1	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 19:00:21 +00:00
ChasquiLabo	48f62f541f	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 18:56:40 +00:00
ChasquiLabo	e6296e4ce4	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 18:53:08 +00:00
ChasquiLabo	423650e8b5	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 18:50:14 +00:00
ChasquiLabo	d0c42e37a7	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:56:31 +00:00
ChasquiLabo	6afd17f1ed	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:53:56 +00:00
ChasquiLabo	cb0eec2203	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:52:45 +00:00
ChasquiLabo	f5900b726b	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:50:52 +00:00
ChasquiLabo	0d9e777c18	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:39:47 +00:00
ChasquiLabo	f5cc61c211	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:27:24 +00:00
ChasquiLabo	786ba43b83	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:24:37 +00:00
ChasquiLabo	ee80cfa27f	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 16:00:49 +00:00
ChasquiLabo	bbaca64d36	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 15:56:33 +00:00
ChasquiLabo	b608ee3985	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 15:44:56 +00:00
ChasquiLabo	5e72e28ba6	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 15:37:17 +00:00
ChasquiLabo	84b18c1a7b	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 15:26:49 +00:00
ChasquiLabo	249851a556	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 14:16:43 +00:00
ChasquiLabo	344b4c8d3d	chore: translation using Weblate (Spanish) Currently translated at 90.6% (1046 of 1154 strings) Translation: Co-op Cloud/abra Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/	2026-09-01 13:12:53 +00:00