happa release v1.72.10

Important

Releases 1.72.5 – 1.72.9 never reached any installation. push-to-registries timed out pushing the image across the Pacific to the Aliyun registry on every one of those tags, which blocked launch-container and therefore push-happa-to-catalog. The images were fine and present in gsoci, but the chart never published, so the OCIRepository (semver: x.x.x) had nothing newer than 1.72.4 to pick up. GitHub showed green releases throughout, so this was invisible.

This release fixes that and carries the whole backlog — 66 commits since 1.72.4, including roughly ten security-only dependency updates that had been merged and released but never deployed.

Fixed

• CI: the Aliyun registry push no longer blocks the chart publish. The buildx push stays on gsoci/gsociprivate (split-china-push) and a separate sync-china-registry job mirrors to Aliyun from the in-China runner, with nothing depending on it (#4881).

Security

• The container image no longer ships webpack source maps. They were uploaded to Sentry during the build and then baked into the nginx image as well, where they were publicly downloadable at roughly four times the weight of the bundles they described. Sentry symbolication is unaffected. Reported via bug bounty; internal tracking issue giantswarm/giantswarm#37469 (#4879).
• Dependency updates previously released but never deployed, including js-yaml 4.3.1 (#4877), mermaid 10.9.8 (#4878), and the tar, brace-expansion and webpack-dev-server advisories.

Full diff: https://github.com/giantswarm/happa/compare/v1.72.4...v1.72.10