Repository navigation
chore: main -> develop sync - #403
Merged
Merged
Conversation
misc: Release candidate v0.46.0
fix: new dependabot fixes
…ay-timeout fix: reject zero/negative-length WeeklyRange window
…L mode and root certificate
…L mode and root certificate
feat: postgres ssl support
…p of custom string const types
feat(common-lib): introduce strenum on audit constants to generate map of custom string const types
Safe security patches applied to every module's go.mod and re-vendored. 9 of 10 modules build clean (go build ./...); common-lib/securestore/ rollback has only a PRE-EXISTING failure (sql.BuildTLSConfig, from the postgres-SSL work vs its pinned common-lib) that is unrelated to these bumps and is not part of `make build`. Per-module updates: - all modules: golang.org/x/crypto -> v0.52.0 (critical), x/net -> v0.55.0 - chart-sync: + oras-go/v2 2.6.1, containerd 1.7.33 (replace target bumped), helm/v3 3.20.1 -> 3.20.2 (already on k8s 0.35, clean patch) - ci-runner: + otlptracehttp 1.43.0, aws-sdk s3 1.97.3, eventstream 1.7.8 - common-lib: + oras-go/v2 2.6.1, aws-sdk s3 1.97.3, eventstream 1.7.8 - git-sensor: + go-git/v5 5.19.1, go-billy/v5 5.9.0 - kubelink: + oras-go/v2 2.6.1, containerd 1.7.33 - kubewatch: + oras-go/v2 2.6.1, go-git/v5 5.19.1, go-billy/v5 5.9.0, pgx/v5 5.9.2, otlpmetrichttp 1.43.0, argo-workflows/v3 3.7.11 -> 3.7.14 - common-lib/securestore/rollback: x/crypto -> v0.52.0 Deliberately NOT included (deferred to a separate branch or no fix): - helm/v3 3.20.2 for common-lib & kubelink: forces k8s 0.33 -> 0.35 (major), handled on a separate branch for regression testing - github.com/argoproj/argo-cd/v2 (kubewatch): no patched version - github.com/quay/claircore (image-scanner): no patched version - github.com/docker/docker (common-lib, ci-runner): no patched version Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…L mode and root certificate
…L mode and root certificate
…-log fix: migrate secret scanner from ent to oss
kubewatch's image build failed with:
go: go.mod requires go >= 1.25.7 (running go 1.25.5; GOTOOLCHAIN=local)
The Dependabot patch (d3b4df8) wrote `go 1.25.7` into kubewatch/go.mod,
but golang:1.25-alpine3.21 does NOT track the latest 1.25 patch. Docker
Hub stopped publishing 1.25.x-alpine3.21 variants - that tag was last
pushed 2025-12-02 and is pinned to Go 1.25.5; no 1.25.7-alpine3.21
exists. golang:1.25-alpine is still maintained and currently resolves to
1.25.12.
authenticator and common-lib/securestore/rollback were separately broken:
builder on Go 1.24 with go.mod already at 1.25.0.
All three move to golang:1.25-alpine. Side effect: the builder base goes
alpine 3.21 -> 3.22. Safe for the two stages that keep an alpine:3.21.2
runtime - both alpine versions ship musl 1.2.5 (r11 vs r12), and
kubewatch/rollback build with CGO_ENABLED=0 anyway.
Still on the frozen tag and due to break the same way once their go
directive passes 1.25.5: ci-runner (x2), image-scanner, lens, git-sensor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
feat: audit logs
…62507d0fd31f across all services
Dependabot bumped github.com/cyphar/filepath-securejoin v0.4.1 -> v0.6.1. v0.6.0 removed the deprecated top-level MkdirAll wrapper (moved to pathrs-lite), but vendored argo-cd/v2 v2.14.20 still calls securejoin.MkdirAll in util/io/files/secure_mkdir_linux.go: vendor/github.com/argoproj/argo-cd/v2/util/io/files/secure_mkdir_linux.go:16:20: undefined: securejoin.MkdirAll The failure is linux-only (the file is //go:build linux), so it only shows up in the GOOS=linux Makefile build, not in a local darwin go build. A replace for this already existed but was version-qualified (v0.4.1 => v0.3.6), so it stopped firing once MVS selected v0.6.1. Made it unversioned so a future require bump cannot silently bypass it again. v0.3.6 is required specifically: argo-cd passes int(mode), and v0.4.0 changed the arg to os.FileMode. v0.4.1 and v0.5.2 both fail to compile. govulncheck reports no advisory against filepath-securejoin at v0.3.6. Only kubewatch is affected; git-sensor and kubelink do not vendor argo-cd's util/io/files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
misc: patch Dependabot security alerts across all modules
chore: update CODEOWNERS to reflect changes in ownership rules
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
bhupesh-devtron
marked this pull request as ready for review
September 2, 2026 08:26
bhupesh-devtron
requested review from
prakarsh-dt and
vivek-devtron
as code owners
September 2, 2026 08:26
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
prakash100198
approved these changes
Sep 2, 2026
vivek-devtron
approved these changes
Sep 2, 2026
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
1 similar comment
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
prakarsh-dt
approved these changes
Sep 3, 2026
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
1 similar comment
|
Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n |
github-actions
Bot
added
PR:Ready-to-Review
and removed
PR:Issue-verification-failed
labels
bhupesh-devtron
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: devtron-labs/devtron#7010