Skip to content

build(db): Update commons-db to v0.1.14 - #145

Open
moshloop wants to merge 23 commits into
mainfrom
chore/update-commons-db-0-1-14
Open

build(db): Update commons-db to v0.1.14#145
moshloop wants to merge 23 commits into
mainfrom
chore/update-commons-db-0-1-14

Conversation

@moshloop

Copy link
Copy Markdown
Member

What

  • Update the commons-db dependency to v0.1.14.
  • Refresh related transitive dependencies.

moshloop added 23 commits July 15, 2026 14:38
A completed task kept its runFunc closure for the manager's 10-minute
run-retention window. When the closure captured large state (parsed
inputs, accumulators, intermediate outputs), that state stayed live for
every retained task — a leak that scales with the number of past runs.

Release runFunc once executeTask finishes: it is invoked nowhere else and
retries are already exhausted by then. Completed tasks keep only their
lightweight result and snapshot for viewing.
Implement request-scoped timing accumulation for HTTP handlers with Server-Timing header emission. Provides AddTiming and Track APIs for measuring operation phases within the RPC executor and custom handlers, summing durations by phase name and emitting millisecond-precision metrics in the response header. The middleware preserves http.Flusher for streaming responses and integrates without importing rpc package dependencies.: feat
…edge case

Gavel-Issue-Id: 6b2997e35e373dc3d3209e33280094ab
Claude-Session-Id: f7ecddc5-467d-4fd4-a7b8-f0778f653659
…ure drain race, blank-line loss, noColor default, StartGroup race
Introduce MCPToolHints struct to hold tool-level metadata including title, icon, group, parent, boolean hints (readOnly, destructive, idempotent, openWorld), default permission, and strict. Update entity building, action specs, and command annotation to use the new hints instead of a plain tool-group string. This enables richer MCP tool annotations and Clicky UI metadata inheritance.
…anonical mode names

Introduce canonical tool permission modes (on/off/ask/auto) with backward compatibility for legacy labels. Add DefaultPermission, Parent, Icon, and Strict fields to ToolInfo and ToolCatalogEntry to control tool behavior without user preferences. Refactor effortConfig to delegate to captain's shared EffortConfig, removing duplicate provider-specific logic. Update tests to verify mode normalization, default permission filtering, and temperature gating.
Introduce ToolAnnotations struct for well-known MCP tool properties. Infer readOnly, destructive, idempotent hints from HTTP method/verb. Propagate tool hints (icon, group, parent, permission, strict) into _meta field. Update RPCOperation to carry ToolHints from clicky annotations.
Add mutex protection to Group and Task methods to fix data races. Introduce render lifecycle state machine (renderIdle, renderRunning, renderStopping) to allow the render loop to be restarted after stopRender, enabling subsequent enqueues to trigger fresh rendering. Implement prettyPlainDelta to emit only new log entries per PlainRender tick, preserving full log history for snapshots and final tree. Add plainSummaryText for a concise one-line summary after plain loop. Ensure renderFinal is idempotent and final output includes summary without duplicating task lines. Update Wait/WaitSilent to flush captured output via StopCapturingOutput. Fix WaitTime and StartTime to be thread-safe.
feat(entity): list/get default to auto-run and create/update/delete to ask
at registration; EntityBuilder.ToolPermission and ActionSpec.WithToolPermission
override; promoted entity roots inherit the list permission
Replace duplicated repository-specific Grite instructions with a pointer to shared agent guidance, project memory, and Clicky skills. This keeps workflow documentation centralized and easier to maintain.
Add semantic column metadata and structured value rendering while preserving raw values for exports. Improve terminal width calculations so capped columns behave correctly in wide and narrow terminals.
Add bounded-memory streaming exports for JSON, NDJSON, YAML, CSV, Markdown, HTML, Excel, and PDF.
Expose export capabilities through operation metadata and support NDJSON content negotiation.
Render paged clicky-json responses as table documents with pagination retained in headers.

BREAKING CHANGE: Paged clicky-json responses no longer wrap rows in the data/page envelope.
Refresh related transitive dependencies to align with the updated database module.
@coderabbitai

coderabbitai Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@moshloop, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c3e0d1ec-580e-4caf-a6d8-dc2fad4b28d2

📥 Commits

Reviewing files that changed from the base of the PR and between d5f340c and 021d1b6.

⛔ Files ignored due to path filters (2)
  • aichat/go.sum is excluded by !**/*.sum
  • examples/enitity/webapp/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (93)
  • .gitignore
  • AGENTS.md
  • CONTRIBUTING.md
  • Makefile
  • aichat/agent.go
  • aichat/agent_test.go
  • aichat/approval.go
  • aichat/approval_test.go
  • aichat/genkit.go
  • aichat/go.mod
  • aichat/models.go
  • aichat/models_test.go
  • aichat/server.go
  • aichat/strict_tools.go
  • aichat/strict_tools_test.go
  • aichat/tool_catalog.go
  • aichat/tool_registry.go
  • aichat/tool_registry_test.go
  • aichat/tools_clicky.go
  • aichat/tools_clicky_test.go
  • aichat/tools_mcp.go
  • api/column.go
  • api/column_value.go
  • api/column_value_test.go
  • api/table.go
  • api/table_test.go
  • api/types.go
  • entity/annotations.go
  • entity/builder.go
  • entity/command.go
  • entity/entity.go
  • entity/operation.go
  • entity/sub_command.go
  • entity/tool_hints.go
  • entity/toolgroup_test.go
  • entity/toolpermission_test.go
  • entity_aliases.go
  • examples/enitity/webapp/.oxlintrc.json
  • examples/enitity/webapp/package.json
  • examples/enitity/webapp/pnpm-workspace.yaml
  • examples/enitity/webapp/src/App.tsx
  • examples/enitity/webapp/src/ChatWidget.tsx
  • examples/enitity/webapp/tsconfig.json
  • examples/enitity/webapp/vite.config.ts
  • flags/binding.go
  • flags/parser.go
  • flags/parser_test.go
  • flags/types.go
  • formatters/html_react_formatter.go
  • formatters/html_react_formatter_test.go
  • formatters/http/http.go
  • formatters/map_input_test.go
  • formatters/markdown_formatter.go
  • formatters/options.go
  • formatters/stream.go
  • formatters/stream_test.go
  • mcp/registry.go
  • mcp/registry_test.go
  • rpc/converter.go
  • rpc/converter_flags_test.go
  • rpc/converter_toolgroup_test.go
  • rpc/entities_test.go
  • rpc/http/middleware.go
  • rpc/http/middleware_test.go
  • rpc/http/timing.go
  • rpc/http/timing_test.go
  • rpc/openapi.go
  • rpc/serve.go
  • rpc/serve_test.go
  • rpc/types.go
  • skills/clicky-tasks/SKILL.md
  • skills/clicky-tasks/agents/openai.yaml
  • skills/clicky-tasks/references/refactoring-patterns.md
  • skills/pretty-printing/SKILL.md
  • skills/pretty-printing/agents/openai.yaml
  • skills/pretty-printing/references/api-patterns.md
  • task/group.go
  • task/group_race_test.go
  • task/manager.go
  • task/manager_color_test.go
  • task/manager_lifecycle.go
  • task/manager_output.go
  • task/manager_output_test.go
  • task/manager_wait.go
  • task/render.go
  • task/render_dedupe_test.go
  • task/render_hook_test.go
  • task/render_restart_test.go
  • task/task.go
  • task/task_log_display_test.go
  • task/task_logs_render.go
  • task/worker.go
  • task/worker_release_test.go
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/update-commons-db-0-1-14
✨ Simplify code
  • Create PR with simplified code
  • Commit simplified code in branch chore/update-commons-db-0-1-14

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedgolang/​github.com/​flanksource/​commons-db@​v0.1.1472100100100100
Addedgolang/​github.com/​firebase/​genkit/​go@​v1.10.074100100100100
Addednpm/​@​flanksource/​clicky-ui@​0.3.97710010096100
Addednpm/​oxlint@​1.72.0911009295100

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: golang github.com/envoyproxy/go-control-plane/envoy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/envoyproxy/go-control-plane/envoy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/envoyproxy/go-control-plane/envoy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/envoyproxy/go-control-plane/envoy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/envoyproxy/go-control-plane/envoy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/envoyproxy/go-control-plane/envoy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/microsoft/go-mssqldb is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/microsoft/go-mssqldb@v1.10.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/microsoft/go-mssqldb@v1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/planetscale/vtprotobuf is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?golang/github.com/firebase/genkit/go@v1.10.0golang/github.com/flanksource/commons-db@v0.1.14golang/github.com/flanksource/clicky@v1.21.37golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jotai is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: examples/enitity/webapp/pnpm-lock.yamlnpm/@flanksource/clicky-ui@0.3.9npm/jotai@2.20.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jotai@2.20.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@github-actions

Copy link
Copy Markdown
Contributor

Gavel crashed before producing results

Exit code: 1
Error: gavel exited 1 before writing results

Last lines of gavel.log

go: downloading github.com/go-openapi/swag v0.23.1 go: downloading github.com/go-openapi/jsonreference v0.21.4 go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3 go: downloading githu...

Full gavel.log, JSON stub, and HTML stub are in the workflow artifact.

View full results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant