feat: http unix socket support - #152
Merged
Merged
Conversation
Signed-off-by: James-Milligan <james@omnant.co.uk>
Signed-off-by: James-Milligan <james@omnant.co.uk>
Signed-off-by: James-Milligan <james@omnant.co.uk>
james-milligan
marked this pull request as ready for review
August 22, 2022 12:40
AlexsJones
approved these changes
Aug 22, 2022
Member
|
Please sure to update the documentation. |
Signed-off-by: James-Milligan <james@omnant.co.uk>
Signed-off-by: James-Milligan <james@omnant.co.uk>
beeme1mr
approved these changes
Aug 22, 2022
raphael-wigoutschnigg-dt
pushed a commit
to open-feature-forking/flagd
that referenced
this pull request
Mar 11, 2025
… v1.5.1 (open-feature#152) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
beeme1mr
added a commit
that referenced
this pull request
May 20, 2026
## Summary Resolved 5 open Dependabot security alerts by bumping vulnerable dependencies. ## Dependabot Alerts Resolved | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | #179 | `postcss` | **medium** | Bumped from 8.5.8 to 8.5.14 in `playground-app/package-lock.json` (vite resolves postcss to patched version naturally, no override needed) | | #181 | `github.com/go-git/go-git/v5` | **high** | Bumped from 5.18.0 to 5.19.1 in `test/integration/go.mod` | | #182 | `github.com/go-git/go-billy/v5` | **medium** | Bumped from 5.8.0 to 5.9.0 via go-git upgrade | | #183 | `github.com/go-git/go-billy/v5` | **high** | Bumped from 5.8.0 to 5.9.0 via go-git upgrade | | #180 | `github.com/in-toto/in-toto-golang` | **medium** | Bumped from 0.10.0 to 0.11.0 in `test/integration/go.mod` | ## Unresolvable alerts - **Alert #184** (`github.com/docker/docker`, high) — vulnerable `<= 28.5.2`; no patched Go module version is published yet (latest is 28.5.2; fix is on `moby/moby/v2` 2.0.0-beta.14, a different module path) - **Alert #185** (`github.com/docker/docker`, medium) — same; no patched version available on the `docker/docker` module path - **Alert #186** (`github.com/docker/docker`, high) — same; no patched version available on the `docker/docker` module path - **Alert #152** (`github.com/docker/docker`, high) — requires >= 29.3.1 but no patched Go module version is published yet - **Alert #151** (`github.com/docker/docker`, medium) — same; requires >= 29.3.1, no patched version available All docker/docker alerts are transitive deps of `testcontainers-go` in the orphaned integration-test module; will be resolved when upstream cuts a Go module under the existing `docker/docker` path or testcontainers-go migrates to `moby/moby/v2`. --------- Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com> Co-authored-by: Michael Beemer <beeme1mr@users.noreply.github.com>
jonathannorris
added a commit
that referenced
this pull request
Jul 6, 2026
- golang.org/x/net v0.52.0/v0.48.0 -> v0.55.0 in flagd, core, flagd-proxy, flagd-proxy/tests/loadtest, test/zero-downtime-flagd-proxy (medium, alerts #201-206) - github.com/testcontainers/testcontainers-go v0.41.0 -> v0.43.0 in test/integration, which migrates off github.com/containerd/containerd/v2 and picks up patched transitive deps (moby/buildkit, docker/buildx, docker/compose) used for alert #152's fix chain - suppress newly-introduced staticcheck deprecation warnings for golang.org/x/net/http2/h2c (deprecated as of x/net v0.55.0) with nolint directives; migrating to http.Server.Protocols is a larger refactor out of scope for this dependency bump Unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. It is an unreachable transitive entry retained by Go's module graph pruning (no code path imports it); the advisory's patched version 29.3.1 has no corresponding tag in the Go module proxy for the legacy github.com/docker/docker import path (moby has moved new majors to github.com/moby/moby/v2), so it cannot be bumped without a replace/override, which is disallowed for this published project. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
jonathannorris
added a commit
that referenced
this pull request
Jul 20, 2026
- golang.org/x/net v0.52.0/v0.48.0 -> v0.55.0 in flagd, core, flagd-proxy, flagd-proxy/tests/loadtest, test/zero-downtime-flagd-proxy (medium, alerts #201-206) - github.com/testcontainers/testcontainers-go v0.41.0 -> v0.43.0 in test/integration, which migrates off github.com/containerd/containerd/v2 and picks up patched transitive deps (moby/buildkit, docker/buildx, docker/compose) used for alert #152's fix chain - suppress newly-introduced staticcheck deprecation warnings for golang.org/x/net/http2/h2c (deprecated as of x/net v0.55.0) with nolint directives; migrating to http.Server.Protocols is a larger refactor out of scope for this dependency bump Unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, unreachable transitive entry retained by Go's module graph pruning (no code path imports it); the advisory's patched version 29.3.1 has no corresponding tag in the Go module proxy for the legacy github.com/docker/docker import path (moby has moved new majors to github.com/moby/moby/v2), so it cannot be bumped without a replace/override, which is disallowed for this published project. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
jonathannorris
added a commit
that referenced
this pull request
Jul 20, 2026
…edback - github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration (medium, alert #260) - js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app (medium/high, alerts #207, #199, #200); lockfile already resolved these transitively, this pins the direct specifiers to match - Root-cause fix for a regression introduced by the prior testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose changed DockerContainer.MappedPort's signature (nat.Port -> string), which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's testframework (pinned, no newer version exists) and broke `go vet`/`go test` compilation in test/integration (go build alone didn't catch it since _test.go files aren't compiled by `go build`). Reverted testcontainers-go and testcontainers-go/modules/compose to v0.41.0 (API-compatible) while keeping the already-patched transitive containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit go.mod requires, so alerts #189, #192-#196 remain resolved without reintroducing the vulnerable containerd version. - Add ReadTimeout to the flagd-proxy metrics server's http.Server per CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only bounds header parsing, leaving the plain HTTP/h2c port open to slow-client (Slowloris-style) resource exhaustion. Still unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. No version >= 28.5.2 (including the advisory's referenced 29.3.1 for alert #152) is published under the legacy github.com/docker/docker import path in the Go module proxy; moby now ships new majors under github.com/moby/moby/v2, which this module graph cannot switch to without deeper dependency surgery. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
pushed a commit
that referenced
this pull request
Jul 20, 2026
- golang.org/x/net v0.52.0/v0.48.0 -> v0.55.0 in flagd, core, flagd-proxy, flagd-proxy/tests/loadtest, test/zero-downtime-flagd-proxy (medium, alerts #201-206) - github.com/testcontainers/testcontainers-go v0.41.0 -> v0.43.0 in test/integration, which migrates off github.com/containerd/containerd/v2 and picks up patched transitive deps (moby/buildkit, docker/buildx, docker/compose) used for alert #152's fix chain - suppress newly-introduced staticcheck deprecation warnings for golang.org/x/net/http2/h2c (deprecated as of x/net v0.55.0) with nolint directives; migrating to http.Server.Protocols is a larger refactor out of scope for this dependency bump Unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, unreachable transitive entry retained by Go's module graph pruning (no code path imports it); the advisory's patched version 29.3.1 has no corresponding tag in the Go module proxy for the legacy github.com/docker/docker import path (moby has moved new majors to github.com/moby/moby/v2), so it cannot be bumped without a replace/override, which is disallowed for this published project. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
pushed a commit
that referenced
this pull request
Jul 20, 2026
…edback - github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration (medium, alert #260) - js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app (medium/high, alerts #207, #199, #200); lockfile already resolved these transitively, this pins the direct specifiers to match - Root-cause fix for a regression introduced by the prior testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose changed DockerContainer.MappedPort's signature (nat.Port -> string), which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's testframework (pinned, no newer version exists) and broke `go vet`/`go test` compilation in test/integration (go build alone didn't catch it since _test.go files aren't compiled by `go build`). Reverted testcontainers-go and testcontainers-go/modules/compose to v0.41.0 (API-compatible) while keeping the already-patched transitive containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit go.mod requires, so alerts #189, #192-#196 remain resolved without reintroducing the vulnerable containerd version. - Add ReadTimeout to the flagd-proxy metrics server's http.Server per CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only bounds header parsing, leaving the plain HTTP/h2c port open to slow-client (Slowloris-style) resource exhaustion. Still unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. No version >= 28.5.2 (including the advisory's referenced 29.3.1 for alert #152) is published under the legacy github.com/docker/docker import path in the Go module proxy; moby now ships new majors under github.com/moby/moby/v2, which this module graph cannot switch to without deeper dependency surgery. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
pushed a commit
that referenced
this pull request
Jul 20, 2026
- golang.org/x/net v0.52.0/v0.48.0 -> v0.55.0 in flagd, core, flagd-proxy, flagd-proxy/tests/loadtest, test/zero-downtime-flagd-proxy (medium, alerts #201-206) - github.com/testcontainers/testcontainers-go v0.41.0 -> v0.43.0 in test/integration, which migrates off github.com/containerd/containerd/v2 and picks up patched transitive deps (moby/buildkit, docker/buildx, docker/compose) used for alert #152's fix chain - suppress newly-introduced staticcheck deprecation warnings for golang.org/x/net/http2/h2c (deprecated as of x/net v0.55.0) with nolint directives; migrating to http.Server.Protocols is a larger refactor out of scope for this dependency bump Unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, unreachable transitive entry retained by Go's module graph pruning (no code path imports it); the advisory's patched version 29.3.1 has no corresponding tag in the Go module proxy for the legacy github.com/docker/docker import path (moby has moved new majors to github.com/moby/moby/v2), so it cannot be bumped without a replace/override, which is disallowed for this published project. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
pushed a commit
that referenced
this pull request
Jul 20, 2026
…edback - github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration (medium, alert #260) - js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app (medium/high, alerts #207, #199, #200); lockfile already resolved these transitively, this pins the direct specifiers to match - Root-cause fix for a regression introduced by the prior testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose changed DockerContainer.MappedPort's signature (nat.Port -> string), which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's testframework (pinned, no newer version exists) and broke `go vet`/`go test` compilation in test/integration (go build alone didn't catch it since _test.go files aren't compiled by `go build`). Reverted testcontainers-go and testcontainers-go/modules/compose to v0.41.0 (API-compatible) while keeping the already-patched transitive containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit go.mod requires, so alerts #189, #192-#196 remain resolved without reintroducing the vulnerable containerd version. - Add ReadTimeout to the flagd-proxy metrics server's http.Server per CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only bounds header parsing, leaving the plain HTTP/h2c port open to slow-client (Slowloris-style) resource exhaustion. Still unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. No version >= 28.5.2 (including the advisory's referenced 29.3.1 for alert #152) is published under the legacy github.com/docker/docker import path in the Go module proxy; moby now ships new majors under github.com/moby/moby/v2, which this module graph cannot switch to without deeper dependency surgery. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
added a commit
that referenced
this pull request
Jul 20, 2026
## Summary Resolves all cleanly patchable open Dependabot security alerts (28 of 33). The remaining 5 have no available patched version for their legacy import path — see below. ## Dependabot Alerts Resolved | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | #260 | `github.com/sigstore/sigstore-go` | **medium** | Bumped to v1.2.2 in `test/integration` | | #247-#259 (13 alerts) | `golang.org/x/crypto` | **critical/high/medium** | Already resolved on `main` (v0.52.0+); carried through the rebase | | #207 | `js-yaml` | **medium** | Bumped to `^4.2.0` in `playground-app` | | #206, #202, #201 | `golang.org/x/net` | **medium** | Bumped to v0.55.0/v0.56.0 across `flagd`, `core`, `flagd-proxy`, `test/integration`, and related test modules | | #200, #199 | `vite` | **medium/high** | Bumped to `^6.4.3` in `playground-app` | | #197 | `@babel/core` | **low** | Forced `>=7.29.6` via npm override in `playground-app` | | #189, #192-#196 | `github.com/containerd/containerd/v2` | **high/medium** | Bumped to v2.2.5 in `test/integration` (kept on `testcontainers-go` v0.41.0 — see note below) | | #190 | `js-cookie` | **high** | Forced `>=3.0.7` via npm override in `playground-app` | **Note on containerd fix:** an earlier revision of this branch bumped `testcontainers-go` to v0.43.0 to reach patched `containerd/v2`, but that also changed `DockerContainer.MappedPort`'s signature in a way that's incompatible with `go-sdk-contrib/tests/flagd/v2@v2.0.2` (pinned; no newer version exists) — breaking `go vet`/`go test` compilation in `test/integration` (not caught by `go build` alone, since it doesn't compile `_test.go` files). Reverted `testcontainers-go` to v0.41.0 (API-compatible) while keeping `containerd/containerd/v2` pinned at v2.2.5 via an explicit `go.mod` require — standard Go MVS, no `replace` directive needed. ## Unresolvable Alerts **`github.com/docker/docker`** (#151, #152, #184, #185, #186) in `test/integration`: pinned at `v28.5.2+incompatible`. No version ≥ that (including the advisory's referenced `v29.3.1` for #152) exists under the legacy `github.com/docker/docker` import path in the Go module proxy — moby now ships new majors under `github.com/moby/moby/v2`. Transitive dependency of testcontainers/buildx/compose; unresolvable until those upstreams migrate. | Alert | Package | Severity | Reason | |-------|---------|----------|--------| | #186 | `github.com/docker/docker` | **high** | No patched version in Go module proxy | | #185 | `github.com/docker/docker` | **medium** | No patched version in Go module proxy | | #184 | `github.com/docker/docker` | **high** | No patched version in Go module proxy | | #152 | `github.com/docker/docker` | **high** | Advisory's patched version (29.3.1) not published for this import path | | #151 | `github.com/docker/docker` | **medium** | No patched version in Go module proxy | ## Other changes - Added `ReadTimeout` to the flagd-proxy metrics server's `http.Server` (`flagd-proxy/pkg/service/server.go`) per CodeRabbit review feedback, hardening the plain HTTP/h2c port against slow-client resource exhaustion. ## Verification - `make test`, `make build`, and `go vet` pass across all Go modules (`core`, `flagd`, `flagd-proxy`, `flagd-proxy/tests/loadtest`, `test/zero-downtime-flagd-proxy`). - `test/integration`: `go build ./...`, `go vet ./...`, and `go test` (compile-only; actual container run needs a Docker daemon) all pass. - `playground-app`: `npm run build` succeeds; `npm install --package-lock-only --dry-run` reports up to date. --------- Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com> Signed-off-by: Todd Baert <todd.baert@dynatrace.com> Co-authored-by: Todd Baert <todd.baert@dynatrace.com>
5 tasks
toddbaert
pushed a commit
that referenced
this pull request
Jul 31, 2026
## Summary - Resolved 6 open Dependabot security alerts by bumping vulnerable dependencies (Go and npm) - 5 remaining docker/docker alerts are unresolvable at this time (see table) — no released fix is available yet in the go.mod-compatible module ## Dependabot Alerts Resolved | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | #269 | `postcss` | **high** | Bumped to 8.5.23 in playground-app (lockfile-only) | | #268 | `brace-expansion` | **high** | Bumped to 2.1.2 in playground-app (lockfile-only) | | #267 | `brace-expansion` | **high** | Bumped to 1.1.16 in playground-app (lockfile-only) | | #266 | `google.golang.org/grpc` | **high** | Bumped to v1.82.1 in test/integration | | #265 | `google.golang.org/grpc` | **high** | Bumped to v1.82.1 in test/zero-downtime-flagd-proxy | | #264 | `google.golang.org/grpc` | **high** | Bumped to v1.82.1 in flagd-proxy/tests/loadtest | ## Unresolved alerts (not addressed in this PR) | Alert | Package | Severity | Reason | |-------|---------|----------|--------| | #186 | `github.com/docker/docker` | high | No patched version published yet | | #185 | `github.com/docker/docker` | medium | No patched version published yet | | #184 | `github.com/docker/docker` | high | No patched version published yet | | #152 | `github.com/docker/docker` | high | Advisory lists first_patched_version 29.3.1, but no such tag exists in the moby/moby repo — the fix is only available via the pre-release `github.com/moby/moby/v2` module (currently in beta), which would require migrating test/integration's testcontainers-go dependency chain off the legacy incompatible module. Too risky for an automated dependency bump; flagged for manual follow-up. | | #151 | `github.com/docker/docker` | medium | No patched version published yet | All of these come from the transitive `github.com/docker/docker` dependency pulled in via testcontainers-go/docker-compose in `test/integration/go.mod`. Also added `.worktrees/` to `.gitignore` (used for isolated git worktrees during this maintenance work). ## Test plan - [x] `go build ./...` for all touched Go modules - [x] `make test` (core, flagd, flagd-proxy unit tests) — all passing - [x] `make lint` (golangci-lint across workspace modules) — no new issues - [x] `npm run build` in playground-app — succeeds - [x] Verified via `npm ls`/`go mod why` that patched versions are now selected for each resolved alert Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
3 tasks
toddbaert
pushed a commit
that referenced
this pull request
Aug 12, 2026
## Summary - Resolved 2 open Dependabot security alerts by bumping `github.com/go-git/go-git/v5` in `test/integration` - 5 remaining `github.com/docker/docker` alerts are unresolvable at this time (see table) — no released fix is available yet ## Dependabot Alerts Resolved | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | #272 | `github.com/go-git/go-git/v5` | **high** | Bumped to v5.19.2 in test/integration | | #273 | `github.com/go-git/go-git/v5` | **medium** | Bumped to v5.19.2 in test/integration | ## Unresolved alerts (not addressed in this PR) | Alert | Package | Severity | Reason | |-------|---------|----------|--------| | #186 | `github.com/docker/docker` | high | No patched version published yet | | #185 | `github.com/docker/docker` | medium | No patched version published yet | | #184 | `github.com/docker/docker` | high | No patched version published yet | | #152 | `github.com/docker/docker` | high | Advisory lists first_patched_version 29.3.1, but no such tag exists yet in the moby/moby repo | | #151 | `github.com/docker/docker` | medium | No patched version published yet | All of these come from the transitive `github.com/docker/docker` dependency pulled in via testcontainers-go/docker-compose in `test/integration/go.mod`. ## Test plan - [x] `go build ./...` in test/integration - [x] `go vet ./...` in test/integration - [x] `golangci-lint run ./...` in test/integration — no new issues (2 pre-existing errcheck findings unrelated to this change) Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds unix socket support to bridge the connection between the http proxy and grpc service.
When a unix socket path is provided, this new implementation is used in favour of the standard tcp conection