enricobuehler 42848c56b7 docs(compliance): the vendor-CVE watch the technical file will cite — and the SBOM learns we ship Bun ...

compliance/vendored-components.md records, per vendored/bundled component,
where the pin lives, how it updates, and which feed to watch — the CRA
Art. 13(5) due-diligence evidence (S4 in the roadmap). Retention verified
while writing it: Gitea serves the full release history v0.17.x -> current,
stable sysext feeds publish KEEP=0, flatpak rsyncs without --delete.

The manual SBOM fragment gains the bundled Bun 1.3.14 runtime (portable
bun.exe in the Windows installer for the console + plugin runner — it was
in no lockfile and no SBOM) and stops hardcoding the gamescope patch count
at 3 when the series is at 9. SECURITY.md gets the one sentence Annex I
Part II asks for: security fixes are free, prompt, and ride patch releases
— which the stable channel already did, unwritten.

2026-08-14 18:14:32 +02:00

..

sbom

docs(compliance): the vendor-CVE watch the technical file will cite — and the SBOM learns we ship Bun

2026-08-14 18:14:32 +02:00

vendored-components.md

docs(compliance): the vendor-CVE watch the technical file will cite — and the SBOM learns we ship Bun

2026-08-14 18:14:32 +02:00