Pin the node-engine at its reviewed grant, and hold the mount match to the path itself (hq ADR 0312, issue 537 review)

A path beginning with the same letters is another path, and a read-only mount
of a read-write access is still granted: the grant follows what mounts it.
This commit is contained in:
2026-10-12 13:47:17 +02:00
parent 10d4712f82
commit 30599c1858
6 changed files with 38 additions and 9 deletions
+1 -1
View File
@@ -35,4 +35,4 @@ require (
// committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
// fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
// `go mod vendor` fails loudly, at once, everywhere.
replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012102338-f4efc3cad0a6
replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012105342-c433e76de229