[ryuzdev]

Security patch release (2026-10-21, rolling-update safe):

• Outbound TLS distrusts compromised eMudhra CA certs (webpki-roots 1.0.10)
• rustls 0.23.46 fixes GHSA-2mjx-qc3c-rqvc
• Node refuses to acquire a cell whose ownership record is lost instead of starting it empty at epoch 1

No CLI/D1 behavior change, so the verified against celld 0.6.2 code comments stay accurate. Single pin in docker/Dockerfile; ghcr.io/denoland/celld:0.6.3 tag confirmed present.

Summary by CodeRabbit

• Updates
  • Docker builds now use CELLD version 0.6.3.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The Docker build now defaults CELLD_VERSION to 0.6.3 instead of 0.6.2.

Changes: celld Version Pin

Layer / File(s)	Summary
Update celld version pin docker/Dockerfile	The default CELLD_VERSION build argument changes from 0.6.2 to 0.6.3.

Priority: Not assessed

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Possibly related PRs

• ryuzcorp/outer#1: Adds the Docker image stage that supplies the celld binary, which this change updates to a newer version.
• ryuzcorp/outer#2: Adds runtime deployment through celld and reports validation with version 0.6.2.

Merge Risk: Minimal · up to 191b6

The celld pin update is compatible with the Docker build and runtime contract, with no identified merge-blocking risk.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}