20260417T091355Z-5ebb263

chore(golang): update to 1.25.9 / CVE-2026-27143 (#334)

* chore(golang): update to 1.25.9

* chore(golang): load sdk version from go.mod

20260326T151518Z-d0c6f26

Forward termination signals to child process (#332)

Commit d2a3a16763ee8a62125d9c57b7a12bf5d9ae0789,
"On Linux, relaunch the current process when running as PID 1 (#311)",
relaunches the command in a child process and then waits for it to exit,
if the parent process has PID 1. If the command is ran in a container,
any termination signal sent to the container is forwarded to the parent
process. This unfortunately prevents the persistent state files from
being saved to disk if the container is killed, as the child process
never receives the shutdown signal.
This commit forwards `SIGINT` and `SIGTERM` signals to the child
process, which then saves the state files to disk, exits, and triggers
a graceful exit in PID 1.

Co-authored-by: Fredrik Medley <fredrik@meroton.com>

20260326T140518Z-bbf587e

Remove dependency on rules_proto

20260317T135248Z-dc342e1

Fix gRPC reflection for local services (#331)

Commit 5b5db75d620841b08c02f04f817652d4ebc949ce,
"Add generic gRPC stream forwarding (#306)",
correctly added forwarding of grpc_reflection_v1 to configured backends.
Unfortunately, it stopped the local services from being reported.

Co-authored-by: Fredrik Medley <fredrik@meroton.com>

20260316T192935Z-6d68947

Append \. instead of \ for Windows directory path suffixes (#329)

Also consolidate namespace prefix stripping in the Windows path
parser and add support for the \\.\ device namespace prefix.

20260312T200350Z-6c51449

Set the block device sector size to at least the page size

For block devices that are backed by raw devices we effectively already
do this (due to us using BLKBSZGET). By doing this, we ensure that
writes don't unintentionally trigger reads as well.

20260312T135247Z-d172b5f

fix: prevent double-close inflating zstd pool release counters (#330)

* fix: prevent double-close inflating zstd pool release counters

In writeZstd(), the zstdReader was closed twice: once by the buffer
(which takes ownership via NewCASBufferFromReader) and again by
defer zstdReader.Close(). Since metricsDecoder.Close() had no
double-close guard — unlike the underlying pooledDecoder — each
duplicate close incremented releases_total without a corresponding
acquisition, causing releases to permanently exceed acquisitions.

Remove the redundant defer and add double-close protection to both
metricsEncoder and metricsDecoder as a safety net.

* fix: use nil guard instead of bool for double-close protection

Per review feedback: set Encoder/Decoder to nil on close instead of
using a separate bool field. This prevents calling any methods on the
object after close and matches the pattern in pooledEncoder/pooledDecoder.

* fix: use util.StatusWrap for decoder acquisition error

Per review feedback: preserve the gRPC status code from
Pool.NewDecoder() (e.g. codes.Canceled) instead of hardcoding
codes.ResourceExhausted via status.Errorf.

20260312T095938Z-f48c18e

feat: add bounded ZSTD encoder/decoder pool with memory management (#…

20260303T071613Z-6002cad

chore: Update aspect_rules_js to v3.0.1 (#328)

20260302T115855Z-f62d21c

feat: create grpcZstd blob access (#277)