Engine 0.183.370: Host metadata, readable workloads and Catalog binding

.github/workflows/security-release-gate.yml

@@ -266,6 +266,44 @@ jobs:
                   'nativeSqlBoundsRelationshipCandidatesBeforeMaterializationIncludingStoppedContainers',
                   'nativeSqlExcludesEveryForeignRemovedAndNonContainerRelationshipWithoutWrites',
               },
+              'io.cattle.platform.iaas.api.auth.change.AiHostMetadataChangeTest': {
+                  'onlyMetadataIntentAndFieldsAreAccepted',
+                  'nativePutUsesRealRevisionGuardAndRestoresContext',
+                  'nativeMethodFieldAndCrossProjectCeilingsRejectBeforeMutation',
+                  'durableSnapshotAndSummaryExcludeMaterialAndObserveExactMetadata',
+                  'boundPlanRequiresHumanApprovalAndExactOnceObservedCompletion',
+                  'casAndLiveWriteRevocationNeverClaimOrDispatch',
+                  'actualHostTableLockRequiresTransactionAndReloadsTheMetadataSnapshot',
+              },
+              'io.cattle.platform.iaas.api.auditing.TypedResourceAuditContractTest': {
+                  'everyRegisteredTypedDomainHasRealClosedMetadataAuditAllowAndDeny',
+              },
+              'io.cattle.platform.core.dao.impl.HostWorkloadDaoTest': {
+                  'boundsNativeHostMappingsBeforeMaterializationAndKeepsStoppedContainers',
+                  'bindsExactHostAndAllTenantOwnersAndRechecksMovedOrRemovedMappings',
+              },
+              'io.cattle.platform.core.dao.impl.UsageServiceDaoTest': {
+                  'nativeSemUsesTwoDistinctServiceSentinelAndBindsAllOwnersIncludingLegacyNullStack',
+                  'finalNativeQueryRequiresCapturedUniqueSemServiceStackAndOptionalExactHostMapping',
+                  'latePersistedStackAssignmentInvalidatesCapturedNullSemFallbackForHostAndVolume',
+              },
+              'io.cattle.platform.iaas.api.auth.ai.view.AiHostWorkloadViewTest': {
+                  'sameNameRunningAndStoppedChildrenUseFreshContainerAndStackOwnersWithoutDtoAugmentation',
+                  'boundUnknownSnapshotsExcludeMovedForeignRemovedAndUnreadableChildrenOrStackNames',
+                  'realScopedKeyNativePredicateHidesChildrenAndTheirAuditIdentitiesButDirectTargetStillDenies',
+                  'parentRbacAndKeyRevocationFailClosedBeforeRelationshipOutputAndRestoreContext',
+                  'cookieFullAndLegacyHostMetadataMatchesActualNativeWrappingAndHostsFilter',
+              },
+              'io.cattle.platform.iaas.api.auth.ai.view.AiUsageServiceStackViewTest': {
+                  'realNativeNullInstanceStackAndNoStackFieldUsesReadableSemServiceStackForHostAndVolume',
+                  'hiddenTransformedNonNullDirectOrMultipleSemRelationsNeverBypassReadableSchemaOrLeakNames',
+                  'exactCapturedSemAndStackRaceDropsFormerNameWhileChangedKeyAbortsTheWholeRead',
+              },
+              'io.cattle.platform.app.AiCatalogLaunchObjectLifecycleWiringTest': {
+                  'actualSpringFactoryLazilyBindsNativeStackBeforeCreateProcessScheduling',
+                  'emptyHandlersAndLegacyListOverrideRemainValidWithoutEagerDependencyCycles',
+                  'nativeCreateBindsExactlyOnceAndNestedFailureRestoresThreadLocalEnvelope',
+              },
           }
           suites = []
           observed = {}
@@ -393,8 +431,38 @@ jobs:
             "$TRIVY_IMAGE" image \
             --offline-scan --scanners vuln --list-all-pkgs --format json --output /work/evidence/dapper-image-vulnerabilities.raw.json \
             "$DAPPER_IMAGE"
-          python3 tools/pip-security-overlay/filter-pip-vendor-findings.py \
+          cp security/ubuntu-apt-fixed.openvex.json evidence/dapper-apt-fixed.openvex.json
+          cp security/ubuntu-apt-fixed.sha256 evidence/dapper-apt-official-elf.sha256
+          docker run --rm --network none --entrypoint sha256sum "$DAPPER_IMAGE" \
+            /usr/bin/apt /usr/bin/apt-cache /usr/bin/apt-cdrom /usr/bin/apt-config \
+            /usr/bin/apt-get /usr/bin/apt-mark /usr/lib/apt/apt-extracttemplates /usr/lib/apt/apt-helper \
+            /usr/lib/apt/methods/cdrom /usr/lib/apt/methods/copy /usr/lib/apt/methods/file /usr/lib/apt/methods/gpgv \
+            /usr/lib/apt/methods/http /usr/lib/apt/methods/mirror /usr/lib/apt/methods/rred /usr/lib/apt/methods/store \
+            /usr/lib/apt/solvers/dump /usr/lib/x86_64-linux-gnu/libapt-pkg.so.7.0.0 /usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0 > evidence/dapper-apt-installed-elf.sha256
+          python3 scripts/check-apt-fixed-vex.py \
+            --dpkg evidence/dapper-dpkg.tsv --inspect evidence/dapper-image-inspect.json \
             --raw evidence/dapper-image-vulnerabilities.raw.json \
+            --installed evidence/dapper-apt-installed-elf.sha256 \
+            --vex evidence/dapper-apt-fixed.openvex.json --inputs-only
+          docker run --rm --network none \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PWD:/work" -w /work \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" image \
+            --offline-scan --scanners vuln --list-all-pkgs \
+            --skip-db-update --skip-java-db-update --skip-vex-repo-update \
+            --vex /work/evidence/dapper-apt-fixed.openvex.json \
+            --format json --output /work/evidence/dapper-image-vulnerabilities.apt-fixed.json \
+            "$DAPPER_IMAGE"
+          python3 scripts/check-apt-fixed-vex.py \
+            --dpkg evidence/dapper-dpkg.tsv --inspect evidence/dapper-image-inspect.json \
+            --raw evidence/dapper-image-vulnerabilities.raw.json \
+            --installed evidence/dapper-apt-installed-elf.sha256 \
+            --vex evidence/dapper-apt-fixed.openvex.json \
+            --native evidence/dapper-image-vulnerabilities.apt-fixed.json \
+            --proof evidence/dapper-apt-fixed-vex-proof.json
+          python3 tools/pip-security-overlay/filter-pip-vendor-findings.py \
+            --raw evidence/dapper-image-vulnerabilities.apt-fixed.json \
             --proof evidence/dapper-pip-vendor-proof.json \
             --output evidence/dapper-image-vulnerabilities.json \
             --vex evidence/dapper-pip-vendor.vex.json \

COMPATIBILITY.md

@@ -1,5 +1,38 @@
 # Compatibility Contract
 
+## Engine 0.183.370 candidate — not published
+
+Host metadata is limited to name/description through the existing native PUT
+owner and human approval. Bounded Host workload references and the Volume
+serviceIds-to-Stack fallback independently recheck current object, role and Key
+visibility; ambiguous or moved relations remain unknown. The native Catalog
+Stack lifecycle binding now runs before CREATE scheduling through lazy,
+memoized generic-handler composition. Ordinary creates and output filters stay
+unchanged. No Host lifecycle, labels, new tool or permission grant is added.
+
+The release registry preserves all 142 prior identities and adds 24 exact methods
+(166 total). C03 binds 458 real source inputs and retains all 1396 tuples with
+zero HTTP semantic, admission or native-role grant delta. The only typed plan
+schema change adds Host to the existing resourceType enum. Existing sixteen
+frozen v1 serialized schemas are byte-identical. Necessary full CI, artifact
+qualification, matching Web 1.6.209 / Bridge 0.2.11, a new Server assembly and
+native acceptance remain pending. See the [candidate note](docs/releases/orchestration-engine-0.183.370.md).
+
+Both builders download the same SHA512-pinned Maven 3.9.16 bytes from Apache's
+official CDN, with the original Apache archive as a bounded transport fallback.
+The existing TLS, checksum and installed-library checks remain; checksum failure
+is terminal and does not select another origin.
+The same pinned Guava JAR now uses HTTP-status-aware bounded curl downloads
+instead of remote ADD, followed by the unchanged SHA256 check.
+Both builders install the two exact Ubuntu USN-8996-1 APT 3.2.1ubuntu0.1
+packages before the first APT operation. Official package SHA256, metadata and
+installed-version checks remain mandatory; release vulnerability gates are unchanged.
+A narrow native OpenVEX fixed statement covers only these two exact Ubuntu
+amd64 package PURLs while the scanner vendor data lags the official fix. CI
+verifies all nineteen installed package-owned ELF hashes and the native package
+pair on the same image, preserves the original raw report, and rejects any
+unrelated finding removal. The existing pip overlay and release thresholds remain.
+
 ## Engine 0.183.369 published
 
 Volume detail gains a read-only projection of at most fifty currently readable

Dockerfile

@@ -34,6 +34,10 @@ ADD --checksum=sha256:bedeef1cf3268f90338c411cdb0a45b224d0660fd2240f310f380316c8
 ADD --checksum=sha256:44ebbeb6493eacffbc460ca71446959ba86a00b2e23515e4cfb1a5cc317d6672 https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-8-0_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-8-0.deb
 ADD --checksum=sha256:44605ea665673a359927d014f4a027c50fe6472af8bc956bd1b1c43ddc07a1cd https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-posix3_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-posix3.deb
 
+# USN-8996-1: replace vulnerable APT before its first package operation.
+ADD --checksum=sha256:0de729b8fe0e1c67c04e8e8d5bd6e0420dbd47f75b93f0b71c8e740edc2d5ffc https://security.ubuntu.com/ubuntu/pool/main/a/apt/apt_3.2.1ubuntu0.1_amd64.deb /tmp/apt.deb
+ADD --checksum=sha256:94e5d41303265b66af0f8c70ade18bfb77260ad286edee6c8045faddef82b94c https://security.ubuntu.com/ubuntu/pool/main/a/apt/libapt-pkg7.0_3.2.1ubuntu0.1_amd64.deb /tmp/libapt-pkg7.0.deb
+
 ENV DEBIAN_FRONTEND=noninteractive
 ARG TEMURIN_JDK25_URL="https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_x64_linux_hotspot_25.0.5_8.tar.gz"
 ARG TEMURIN_JDK25_SHA256=68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb
@@ -52,6 +56,16 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/orchestra
       org.opencontainers.image.licenses="Apache-2.0"
 
 RUN set -eux; \
+    for package in apt libapt-pkg7.0; do \
+        test "$(dpkg-query -W -f='${db:Status-Status}' "${package}")" = installed; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = 3.2.1ubuntu0.1; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64; \
+    done; \
+    dpkg -i /tmp/libapt-pkg7.0.deb /tmp/apt.deb; \
+    for package in apt libapt-pkg7.0; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = 3.2.1ubuntu0.1; \
+    done; \
     . /licenses/ubuntu-apt.lock; \
     rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
     rm -rf /tmp/ca-bootstrap; \
@@ -134,15 +148,17 @@ RUN set -eux; \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/bin/pebble
 
 COPY --from=docker-cli-build /go/src/github.com/docker/cli/build/docker-linux-amd64 /usr/bin/docker
-ADD --checksum=sha256:b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c https://repo.maven.apache.org/maven2/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar /tmp/guava-33.7.2-jre.jar
+RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/guava-33.7.2-jre.jar "https://repo.maven.apache.org/maven2/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar" && \
+    echo 'b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c  /tmp/guava-33.7.2-jre.jar' | sha256sum -c -
 
 RUN mkdir -p ${JAVA_HOME} /usr/lib/jvm && \
     curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 600 -o /tmp/temurin-jdk25.tar.gz "${TEMURIN_JDK25_URL}" && \
     echo "${TEMURIN_JDK25_SHA256}  /tmp/temurin-jdk25.tar.gz" | sha256sum -c - && \
     tar -xzf /tmp/temurin-jdk25.tar.gz -C ${JAVA_HOME} --strip-components=1 && \
     rm -f /tmp/temurin-jdk25.tar.gz && \
     ln -sfn ${JAVA_HOME} /usr/lib/jvm/temurin-25-amd64 && \
-    curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/apache-maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" && \
+    (curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/apache-maven.tar.gz "https://dlcdn.apache.org/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" || \
+     curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/apache-maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz") && \
     echo "${MAVEN_SHA512}  /tmp/apache-maven.tar.gz" | sha512sum -c - && \
     mkdir -p ${MAVEN_HOME} && \
     tar -xzf /tmp/apache-maven.tar.gz -C ${MAVEN_HOME} --strip-components=1 && \

Dockerfile.dapper

@@ -35,6 +35,10 @@ ADD --checksum=sha256:bedeef1cf3268f90338c411cdb0a45b224d0660fd2240f310f380316c8
 ADD --checksum=sha256:44ebbeb6493eacffbc460ca71446959ba86a00b2e23515e4cfb1a5cc317d6672 https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-8-0_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-8-0.deb
 ADD --checksum=sha256:44605ea665673a359927d014f4a027c50fe6472af8bc956bd1b1c43ddc07a1cd https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-posix3_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-posix3.deb
 
+# USN-8996-1: replace vulnerable APT before its first package operation.
+ADD --checksum=sha256:0de729b8fe0e1c67c04e8e8d5bd6e0420dbd47f75b93f0b71c8e740edc2d5ffc https://security.ubuntu.com/ubuntu/pool/main/a/apt/apt_3.2.1ubuntu0.1_amd64.deb /tmp/apt.deb
+ADD --checksum=sha256:94e5d41303265b66af0f8c70ade18bfb77260ad286edee6c8045faddef82b94c https://security.ubuntu.com/ubuntu/pool/main/a/apt/libapt-pkg7.0_3.2.1ubuntu0.1_amd64.deb /tmp/libapt-pkg7.0.deb
+
 ENV DEBIAN_FRONTEND=noninteractive
 ENV LANG=C.UTF-8 LC_ALL=C.UTF-8
 ARG TEMURIN_JDK25_URL="https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_x64_linux_hotspot_25.0.5_8.tar.gz"
@@ -70,6 +74,16 @@ ENV PGUSER=cattle
 ENV PGDATABASE=cattle
 
 RUN set -eux; \
+    for package in apt libapt-pkg7.0; do \
+        test "$(dpkg-query -W -f='${db:Status-Status}' "${package}")" = installed; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = 3.2.1ubuntu0.1; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64; \
+    done; \
+    dpkg -i /tmp/libapt-pkg7.0.deb /tmp/apt.deb; \
+    for package in apt libapt-pkg7.0; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = 3.2.1ubuntu0.1; \
+    done; \
     . /licenses/ubuntu-apt.lock; \
     rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
     rm -rf /tmp/ca-bootstrap; \
@@ -152,15 +166,17 @@ RUN set -eux; \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/bin/pebble
 
 COPY --from=docker-cli-build /go/src/github.com/docker/cli/build/docker-linux-amd64 /usr/bin/docker
-ADD --checksum=sha256:b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c https://repo.maven.apache.org/maven2/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar /tmp/guava-33.7.2-jre.jar
+RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/guava-33.7.2-jre.jar "https://repo.maven.apache.org/maven2/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar" && \
+    echo 'b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c  /tmp/guava-33.7.2-jre.jar' | sha256sum -c -
 
 RUN mkdir -p ${JAVA_HOME} /usr/lib/jvm && \
     curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 600 -o /tmp/temurin-jdk25.tar.gz "${TEMURIN_JDK25_URL}" && \
     echo "${TEMURIN_JDK25_SHA256}  /tmp/temurin-jdk25.tar.gz" | sha256sum -c - && \
     tar -xzf /tmp/temurin-jdk25.tar.gz -C ${JAVA_HOME} --strip-components=1 && \
     rm -f /tmp/temurin-jdk25.tar.gz && \
     ln -sfn ${JAVA_HOME} /usr/lib/jvm/temurin-25-amd64 && \
-    curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/apache-maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" && \
+    (curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/apache-maven.tar.gz "https://dlcdn.apache.org/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" || \
+     curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 300 -o /tmp/apache-maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz") && \
     echo "${MAVEN_SHA512}  /tmp/apache-maven.tar.gz" | sha512sum -c - && \
     mkdir -p ${MAVEN_HOME} && \
     tar -xzf /tmp/apache-maven.tar.gz -C ${MAVEN_HOME} --strip-components=1 && \

README.md

@@ -8,6 +8,12 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE.
 This fork of [`rancher/cattle`](https://github.com/rancher/cattle) preserves
 upstream history, authorship, licenses, and dependency notices.
 
+## Next candidate: Engine 0.183.370
+
+Host name/description review, bounded readable workload references and the
+native Catalog launch binding fix are in [source/CI preparation](docs/releases/orchestration-engine-0.183.370.md).
+Publication and native acceptance remain pending; use the published release below.
+
 ## Latest published release: Engine 0.183.369
 
 [Engine 0.183.369](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.369)
@@ -30,10 +36,9 @@ Original CI, source/artifact qualification, immutable release verification and
 public checksums are recorded in the
 [published release note](docs/releases/orchestration-engine-0.183.369.md).
 Existing lower security findings remain disclosed; publication is not a claim
-of zero vulnerabilities. Server 1.6.567 still includes Engine 0.183.368.
-Matching Web 1.6.208 / bridge0.2.10, a new Server assembly and designated native
-Volume/reference/role/Key/layout acceptance remain separate. Full frontend
-coverage is in progress.
+of zero vulnerabilities. Server 1.6.568 includes Engine 0.183.369 with Web
+1.6.208 / Bridge 0.2.10. Component publication does not complete all native
+business acceptance or the 243 frontend groups.
 
 Four independent AI opt-ins remain default-off. The
 [release note](docs/releases/orchestration-engine-0.183.368.md) mirrors the immutable
@@ -179,7 +184,7 @@ Before publishing an Engine artifact, run the complete package gate:
 
 ```sh
 bash scripts/check-cattle-jdk25-full-package
-ENGINE_VERSION=0.183.369 bash scripts/build --release
+ENGINE_VERSION=0.183.370 bash scripts/build --release
 bash scripts/check-release-artifact dist/artifacts/cattle.jar
 ```
 

code/framework/api-pub-sub-jetty/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.369</version>
+        <version>0.183.370</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api-pub-sub/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.369</version>
+        <version>0.183.370</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.369</version>
+        <version>0.183.370</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/archaius/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.369</version>
+        <version>0.183.370</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
 </project>

code/framework/async/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.369</version>
+        <version>0.183.370</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>