Publish curated ITWorx_MCP_Hub source from 3237e4d8aec312d63d13b4e80664422a7520b5f9

infrastructure/images/contextforge/candidate/locks.json

@@ -36,7 +36,11 @@
   "constraints": [
     "mcp==1.30.0",
     "PyJWT==2.15.0",
-    "urllib3==2.8.0"
+    "urllib3==2.8.0",
+    "anyio==4.14.2",
+    "cryptography==50.0.0",
+    "langgraph-sdk==0.4.4",
+    "langgraph==1.2.3"
   ],
   "extras": [
     "redis",
@@ -52,9 +56,10 @@
   "python": "3.12",
   "requirements": {
     "build-tools.lock": "4ba5f91f6473fc4fc9971b2353629203099d9409f537895972e60a65890af02f",
-    "production-requirements.lock": "3a1b599d2487bd9f1aaf6f2be0f65b6db17da5847a123e905c5e5337a3e87f76"
+    "production-requirements.lock": "61c96efcbf1efcc4a8a42832d315f10f1e9c6afe9dc39523048c7c58d4dc4af0"
   },
   "schema": "itworx.contextforge-candidate-locks/v1",
+  "securityFreshnessOverrideUtc": "2026-10-14T00:00:00Z",
   "upstreamCommit": "1e58a0434a78bbdbe1e975abeb0bed1043ff14c1",
   "upstreamFiles": {
     "Containerfile": "2ab0187f3a63eced093a1dec3141ec3e30ef879eb7de0dfd9e4bc5fce33f64f2",

infrastructure/images/contextforge/candidate/production-requirements.lock

@@ -10,9 +10,9 @@ annotated-types==0.7.0 \
 ansicon==1.89.0 ; sys_platform == 'win32' \
     --hash=sha256:e4d039def5768a47e4afec8e89e83ec3ae5a26bf00ad851f914d1240b444d2b1 \
     --hash=sha256:f1def52d17f65c2c9682cf8370c03f541f410c1752d6a14029f97318e4b9dfec
-anyio==4.14.1 \
-    --hash=sha256:4e5533c5b8ff0a24f5d7a176cbe6877129cd183893f66b537f8f227d10527d72 \
-    --hash=sha256:8d648a3544c1a700e3ff78615cd679e4c5c3f149904287e73687b2596963629e
+anyio==4.14.2 \
+    --hash=sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494 \
+    --hash=sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f
 argon2-cffi==25.1.0 \
     --hash=sha256:694ae5cc8a42f4c4e2bf2ca0e64e51e23a040c6a517a85074683d3959e1346c1 \
     --hash=sha256:fdc8b074db390fccb6eb4a3604ae7231f219aa669a2652e0f20e16ba513d5741
@@ -233,40 +233,40 @@ cpex-url-reputation==0.3.4 \
     --hash=sha256:b91db67405dc00e93d147cc4fb6688ac8983c6935d8b41709db33f3c0c249313 \
     --hash=sha256:d059fbd921ddd20f941a06e18ddad8aa49bc8a0b79d19f340e65706847ea084f \
     --hash=sha256:e97bf605d931d8a478236cbc34e6170a07189fd3670fda9bb2cc3c03ae054ea7
-cryptography==49.0.0 \
-    --hash=sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001 \
-    --hash=sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6 \
-    --hash=sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c \
-    --hash=sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325 \
-    --hash=sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69 \
-    --hash=sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36 \
-    --hash=sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc \
-    --hash=sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6 \
-    --hash=sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b \
-    --hash=sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18 \
-    --hash=sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db \
-    --hash=sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b \
-    --hash=sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2 \
-    --hash=sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459 \
-    --hash=sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e \
-    --hash=sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21 \
-    --hash=sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8 \
-    --hash=sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9 \
-    --hash=sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db \
-    --hash=sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64 \
-    --hash=sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5 \
-    --hash=sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615 \
-    --hash=sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f \
-    --hash=sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6 \
-    --hash=sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838 \
-    --hash=sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9 \
-    --hash=sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7 \
-    --hash=sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68 \
-    --hash=sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e \
-    --hash=sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a \
-    --hash=sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4 \
-    --hash=sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493 \
-    --hash=sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b
+cryptography==50.0.0 \
+    --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \
+    --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \
+    --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \
+    --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \
+    --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \
+    --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \
+    --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \
+    --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \
+    --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \
+    --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \
+    --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \
+    --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \
+    --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \
+    --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \
+    --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \
+    --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \
+    --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \
+    --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \
+    --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \
+    --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \
+    --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \
+    --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \
+    --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \
+    --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \
+    --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \
+    --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \
+    --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \
+    --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \
+    --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \
+    --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \
+    --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \
+    --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \
+    --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645
 distro==1.9.0 \
     --hash=sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed \
     --hash=sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2
@@ -608,18 +608,18 @@ langchain-openai==1.2.1 \
 langchain-protocol==0.0.18 \
     --hash=sha256:70b53a86fbf9cedc863555effe44da192ab02d556ddbf2cf95b8873adcf41b5a \
     --hash=sha256:ec3e11782f1ed0c9db38e5a9ed01b0e7a0d3fba406faa8aef6594b73c56a63e6
-langgraph==1.2.0 \
-    --hash=sha256:03fd5895a8d4b70db1ff63ebc3bacead29dd20cd794a8b1a483e7ec9018f7a65 \
-    --hash=sha256:4a9baaf62afc5d5f63144a50095140a34b9aa9b7cea695d25326d564775348e7
+langgraph==1.2.3 \
+    --hash=sha256:22e6c89084adb3edb7855f6ffa692af3d75925f9c70deb43b86da14db1b02c78 \
+    --hash=sha256:7f89cd5f0946fe29bd7ca048e2a84d3c14e7f652e38bb98e00f0ba8b7004b9d0
 langgraph-checkpoint==4.1.1 \
     --hash=sha256:25d29144b082827218e7bc3f1e9b0566a4bb007895cd6cc26f66a8428739f56e \
     --hash=sha256:6c2bdb530c91f91d7d9c1bd100925d0fc4f498d418c17f3587d1526279482a25
 langgraph-prebuilt==1.1.0 \
     --hash=sha256:3c579cf6eed2d17f9c157c2d0fcaddcd8688524e7022d3b22b37a3bf4589d528 \
     --hash=sha256:51e311747d755b751d5c6b39b0c1446124d3a7643d2515017e6714b323508fc9
-langgraph-sdk==0.3.15 \
-    --hash=sha256:29e805003d2c6e296823dd71992610976fd0428cefaa8b3304fd91f2247037de \
-    --hash=sha256:3838773acf7456d158165385d49f48f1e856f28b56ccd99ea139a8f27004815d
+langgraph-sdk==0.4.4 \
+    --hash=sha256:39afe416c91742925e6f8a93715f566d499b36e1b636b804a4ffe3190e4f4e64 \
+    --hash=sha256:4e651ffa09de695681579396375377bdde23bedbc8e35b070e615cbd5af7da8b
 langsmith==0.9.7 \
     --hash=sha256:40f8a66a466a7abd991a9df1b50de0a9d30c48ee0d3da46ce00516b68e41c9d7 \
     --hash=sha256:a5ff9179b77eb0c3a0129294d30924eab13e51e2720f374372dbbc014c892911

infrastructure/images/security-bases/ingestion-clamd/Dockerfile

@@ -0,0 +1,9 @@
+FROM clamav/clamav:1.4.6@sha256:a5f03c12a79dbe9f6d8a527b6bb1ea053fa8dd061d3738a26897f055ee2d9303
+ARG SOURCE_DATE_EPOCH
+COPY --chmod=0555 verify-pcre2.sh /usr/local/libexec/itworx-verify-pcre2
+# Alpine 3.24 security database explicitly fixes CVE-2026-103111 in this exact package.
+RUN set -eux; \
+    test "$(cut -d. -f1,2 /etc/alpine-release)" = '3.24'; \
+    apk add --no-cache --upgrade 'pcre2=10.49-r0'; \
+    /usr/local/libexec/itworx-verify-pcre2
+LABEL org.itworx.security-base.pcre2.version="10.49-r0"

infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+# Query the authoritative installed database, never apk-info's verbose display fields.
+version=$(awk -v RS='' '
+{
+    name_count = 0; version_count = 0; selected = 0; package_version = ""
+    count = split($0, lines, "\n")
+    for (i = 1; i <= count; i++) {
+        if (substr(lines[i], 1, 2) == "P:") {
+            name_count++
+            if (lines[i] == "P:pcre2") selected = 1
+        }
+        if (substr(lines[i], 1, 2) == "V:") {
+            version_count++
+            package_version = substr(lines[i], 3)
+        }
+    }
+    if (selected) {
+        matches++
+        if (name_count != 1 || version_count != 1) invalid = 1
+        selected_version = package_version
+    }
+}
+END {
+    if (matches != 1 || invalid || selected_version != "10.49-r0") exit 1
+    print "10.49-r0"
+}
+' /lib/apk/db/installed)
+test "$version" = '10.49-r0'
+clamd --version | grep -Eq '^ClamAV 1\.4\.6(/|$)'

infrastructure/images/security-bases/postgres/Dockerfile

@@ -0,0 +1,42 @@
+FROM docker.io/library/golang:1.26.8-bookworm@sha256:abe4f87f354c4f6d7ee3fb11b241c6b6c24a32ca50a2ebcc30493a2168e14048 AS gosu-build
+ARG SOURCE_DATE_EPOCH
+ARG GOSU_MODULE=github.com/tianon/gosu
+ARG GOSU_MODULE_VERSION=v0.0.0-20250923190938-6456aaa0f3c8
+ARG GOSU_MODULE_SUM=h1:HIpXk5mGBQGfOqcaBbRT4Vnss8NPICnMGlD5xTlPBdQ=
+ARG GOSU_GOMOD_SUM=h1:SwhRwWsO6iqXZN9CpIaU9CnOrUqpWDINW16KaaSqnrU=
+ARG GOSU_SOURCE_COMMIT=6456aaa0f3c854d199d0f037f068eb97515b7513
+ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOOS=linux GOARCH=amd64 GOBIN=/out/bin GOPROXY=https://proxy.golang.org GOSUMDB=sum.golang.org
+COPY go-toolchain.tar.gz gosu-source.tar.gz verify-gosu-metadata.sh /tmp/
+RUN set -eux; \
+    printf '%s  %s\n' 42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d /tmp/go-toolchain.tar.gz | sha256sum -c -; \
+    printf '%s  %s\n' 33d7537d588ea49458b9509bcf4554bdf5ceacc66da71e5caa1058ea3b689c3b /tmp/gosu-source.tar.gz | sha256sum -c -; \
+    rm -rf /usr/local/go; tar -C /usr/local -xzf /tmp/go-toolchain.tar.gz; \
+    test "$(go version)" = 'go version go1.26.9 linux/amd64'; \
+    chmod 0555 /tmp/verify-gosu-metadata.sh; \
+    module_info="$(go mod download -json "${GOSU_MODULE}@${GOSU_MODULE_VERSION}")"; \
+    module_dir="$(go env GOMODCACHE)/${GOSU_MODULE}@${GOSU_MODULE_VERSION}"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field Path "$GOSU_MODULE"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field Version "$GOSU_MODULE_VERSION"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field Dir "$module_dir"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field Sum "$GOSU_MODULE_SUM"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field GoModSum "$GOSU_GOMOD_SUM"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field Hash "$GOSU_SOURCE_COMMIT"; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field VCS git; \
+    printf '%s\n' "$module_info" | /tmp/verify-gosu-metadata.sh json-field URL https://github.com/tianon/gosu; \
+    (cd "$module_dir" && go test -mod=readonly ./...); \
+    go install -trimpath -buildvcs=false "${GOSU_MODULE}@${GOSU_MODULE_VERSION}"; \
+    go version -m /out/bin/gosu > /tmp/gosu-build-info.txt; \
+    test "$(head -n 1 /tmp/gosu-build-info.txt)" = '/out/bin/gosu: go1.26.9'; \
+    /tmp/verify-gosu-metadata.sh module-row "$GOSU_MODULE" "$GOSU_MODULE_VERSION" "$GOSU_MODULE_SUM" < /tmp/gosu-build-info.txt; \
+    mkdir -p /out/licenses; \
+    install -m 0644 "$module_dir/LICENSE" /out/licenses/gosu-LICENSE; \
+    install -m 0644 "$(go env GOMODCACHE)/github.com/moby/sys/user@v0.1.0/LICENSE" /out/licenses/moby-sys-user-LICENSE; \
+    install -m 0644 "$(go env GOMODCACHE)/golang.org/x/sys@v0.1.0/LICENSE" /out/licenses/golang-x-sys-LICENSE; \
+    install -m 0644 /usr/local/go/LICENSE /out/licenses/go-toolchain-LICENSE; \
+    install -m 0644 /usr/local/go/PATENTS /out/licenses/go-toolchain-PATENTS
+
+FROM gitea.example.com/jens/itworx-mcp-hub/postgres:wp400-gosu-v2-20261002-a94e0b4d2029@sha256:a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73
+LABEL org.itworx.gosu.go.version="go1.26.9" \
+      org.itworx.gosu.go.archive.sha256="42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
+COPY --from=gosu-build --chmod=0755 /out/bin/gosu /usr/local/bin/gosu
+COPY --from=gosu-build /out/licenses/ /usr/share/doc/gosu/licenses/