enricobuehler
42848c56b7
ci / rust-arm64 (pull_request) Successful in 1m33s
ci / bun-nix (pull_request) Successful in 1m33s
ci / web (pull_request) Successful in 2m5s
ci / docs-site (pull_request) Successful in 2m20s
ci / rust (pull_request) Successful in 5m58s
nix / flake (pull_request) Successful in 14m59s
compliance/vendored-components.md records, per vendored/bundled component, where the pin lives, how it updates, and which feed to watch — the CRA Art. 13(5) due-diligence evidence (S4 in the roadmap). Retention verified while writing it: Gitea serves the full release history v0.17.x -> current, stable sysext feeds publish KEEP=0, flatpak rsyncs without --delete. The manual SBOM fragment gains the bundled Bun 1.3.14 runtime (portable bun.exe in the Windows installer for the console + plugin runner — it was in no lockfile and no SBOM) and stops hardcoding the gamescope patch count at 3 when the series is at 9. SECURITY.md gets the one sentence Annex I Part II asks for: security fixes are free, prompt, and ride patch releases — which the stable channel already did, unwritten.