21st Sept 2026 - GitProxy Meeting Minutes #1729

Date

20260921 - 4pm BST / 11am EDT

Meeting info

• Meeting link

• Register for future meetings

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide and review Meeting Notices (see above)
• Approve past meeting minutes
  • 7th Sept 2026 - GitProxy Meeting Minutes #1711
• Status of CVEs in Triage and resolutions
• Release statuses: 2.01, 2.1.1, 2.2.0
• Roadmap Prioritisation
• Open PRs
  • feat: revamp plugin system #1683
  • feat: refactor pull chain to extract and decode pull data #1744
• AOB, Q&A & Adjourn (5mins)

Meeting Minutes

• Past meeting minutes for 7th Sept 2026 (7th Sept 2026 - GitProxy Meeting Minutes #1711) were approved; Citi team were not present and previous PR to update maintainers still outstanding. Action rolled over.

• Status of CVEs in Triage and Resolutions

  • Three main CVE PRs (push identity, arbitrary directory deletion, bypass of push approvals) are ready to merge; order to be finalised.
  • Agreement to merge these promptly and run CI post-merge as checks do not run on these PRs by default due to repo policies.
  • Decision to request CVEs once merged and released.
  • SSH vulnerability fix is pending final review by @fabiovincenzi.
  • Fix for pack parsing/limits is in progress by @jescalada, with further edge cases and config additions suggested by @kriswest.
  • Review of consolidated PostgreSQL feature PR remains outstanding for all maintainers.

• Release Statuses: 2.0.1, 2.1.1, 2.2.0

  • Patch releases 2.0.1 and 2.1.1 have shipped and appear stable.
  • Workflow for release and patch bumper needs refactoring by @jescalada due to accidental success in previous releases; further patch releases to be avoided until this is resolved.
  • Next releases (2.2.0/2.3.0) will incorporate CVE fixes and possibly PostgreSQL features, depending on review status.
  • Aim for rapid succession of releases as soon as core vulnerabilities are merged.

• Roadmap Prioritisation

  • Roadmap summary written by @kriswest; needs conversion into GitHub milestones and tying to issues.
  • @jescalada to formalise the roadmap process and set up milestones for upcoming versions.
  • Prioritisation for 2.2, 2.3, and initial 3.0 milestones discussed; accessibility improvements and onboarding checks are longer-term targets.

• Open PRs

  • Discussion on plugin system revamp (feat: revamp plugin system #1683): introduces "phases" for plugins, allowing more flexible integration in the push/pull chain. Feedback given on phase naming and ordering; further adjustments requested for clarity and optimal workflow.
  • Discussion on pull chain refactor (feat: refactor pull chain to extract and decode pull data #1744): enables more granular pull data extraction and scanning. Concerns raised about performance impact for large-scale org pulls; suggestion to keep security scans advisory/non-blocking and as opt-in plugins.
  • Consensus that plugin system changes are useful but must not create performance bottlenecks or make critical workflows blocking unless strictly necessary.

• AOB, Q&A & Adjourn

  • @goldensyntax confirmed ongoing work on accessibility fixes; an issue will be raised before PR.
  • The detached head handling issue is noted as still open, @dcoric to review.
  • General agreement to push for maintainer/reviewer recruitment
  • No other business raised.

Action Items

• @Andreybest: Submit initial PR for TS REST API documentation/control; review and iterate.
• @ALL: Recruit additional maintainers/reviewers, especially from G-Research and Citi, to accelerate PR review.
• @kriswest: Follow up with FINOS and Andy Block (Red Hat) for OpenSSF/OSSF partnership opportunity.
• @fabiovincenzi / @dcoric: Review and refactor duplicated diff/log storage; ensure no breaking change for old pushes.
• @ALL: Provide external review of consolidated PostgreSQL feature PR (targeting 2.2.0 release).
• @fabiovincenzi: Review interim SSH vulnerability fix and provide feedback.
• @jescalada: Configure Dependabot rules to separately label CVE resolutions and evergreening PRs.
• @jescalada: Refactor the release/patch bumper workflow and document the migration issue in GitHub.
• @jescalada: Finalise and push completion for pack parsing/limits fix, ensuring all limits are configurable and present in default config.
• @kriswest & @jescalada : Convert the roadmap summary into GitHub milestones and tie to individual issues
• @ALL: Review and approve outstanding CVE PRs, action merges as per discussion, and follow up with CI/release.
• @andypols: Review push identity/SCM identities refactor PR (see action on Support SCM-specific user accounts for push identity resolution #1736); confirm PR resolves action item and close if satisfied.