Add e2e tests for systemd's event-driven activation mechanisms and the
sd_notify watchdog protocol:
- TestSystemdTimer: transient timer units fire repeatedly on both the
monotonic (OnActiveSec/OnUnitActiveSec) and the realtime (OnCalendar)
clocks.
- TestSystemdDBusActivation: a bus call to org.freedesktop.hostname1
starts systemd-hostnamed on demand.
- TestSystemdSocketActivation: with only ssh.socket started, the first
connection starts ssh.service, which serves it on the inherited
listening socket.
- TestSystemdWatchdog: a Type=notify service with WatchdogSec= stays up
while it pings the watchdog, and is killed with Result=watchdog once
the pings stop.
All TestSystemd* tests now run in parallel, each in its own container.
The systemd entry on the website's compatibility page is also updated.
PiperOrigin-RevId: 958778081
Add an agents category to the compatibility dashboard, along with Ollama,
OpenClaw, PicoClaw, Hermes Agent, and Claude Code.
Ollama has a test included. The *claws and Hermes reference the MAGI blog post.
No test for claude code since they require an account, and testing claude code
with a local model would likely require a beefy GPU (since claude's system
prompt is pretty big).
PiperOrigin-RevId: 958632910
Add CVE-2026-43456 (network bonding type confusion) and CVE-2026-46300 (XFRM ESP-in-TCP logic flaw) to the list of vulnerabilities not exploitable under gVisor.
PiperOrigin-RevId: 951081670
Includes:
- A JSON schema for the application compatibility database (an
application can either be compatible, partially compatible, not
compatible, coming-soon, or experimentally supported)
- A web page to render the compatibility database. Each row has the name
of the application, a link to the testing methodology script, the
version we last tested with, and a badge indicating its status
- A small database including the applications whose test scripts have
been reviewed so far.
The web page includes a search bar.
The CVE entries in `cve-track-record.yml` have been reordered alphabetically by CVE number within each month. Additionally, CVE-2026-43284 has been added to the list. Some CVSS scores were also updated to use explicit float notation.
PiperOrigin-RevId: 945215587
- Replace binary "Defended"/"Unmitigated" status with a richer `patched` field (tri-state: `PATCHED`, `EXTERNAL_MITIGATION_REQUIRED`, `UNPATCHED`). Required when `exploitable_under_gvisor` is true.
- Chart: distinct yellow/orange/red bar segments per status. Legend shows percentages.
- Chart: add a dashed "ghost" extrapolation on current-year bar projecting the expected year-end CVE count (suppressed when <2 months remain or projection within 15% of the actual count to avoid visual crowding).
- Display entries without a CVE ID so chart and table counts are complete.
- Add a CVSS chip, colored by score.
- Render markdown-style backticks in descriptions as monospace, and wrap code identifiers throughout the data file in backticks.
- Mobile: horizontally scrollable chart that starts scrolled to the most recent year; wrapped legend; fix stray divider border on stacked columns.
- Preserve highlighted year in URL anchor.
- Remove redundant "Vulnerability Overview & Impact" header and shorten "Target Ecosystem Scope" to "Scope".
