Skip to content

chore(main): release 0.2.7 - #200

Closed
github-actions[bot] wants to merge 1 commit into
mainfrom
release-please--branches--main
Closed

chore(main): release 0.2.7#200
github-actions[bot] wants to merge 1 commit into
mainfrom
release-please--branches--main

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 20, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 I have created a release beep boop

0.2.7 (2022-10-21)

Miscellaneous Chores

This PR was generated with Release Please. See documentation.

@github-actions
github-actions Bot requested a review from AlexsJones as a code owner October 20, 2022 09:18
@github-actions github-actions Bot changed the title chore(main): release 0.2.6 chore(main): release 0.2.7 Oct 20, 2022
@github-actions
github-actions Bot force-pushed the release-please--branches--main branch from ea86296 to 5111555 Compare October 20, 2022 09:23
@github-actions
github-actions Bot force-pushed the release-please--branches--main branch from 5111555 to 27a1300 Compare October 21, 2022 15:01
@AlexsJones

AlexsJones commented Oct 21, 2022

Copy link
Copy Markdown
Member

This seems a bit mad @beeme1mr

@beeme1mr

beeme1mr commented Oct 21, 2022

Copy link
Copy Markdown
Member

I'll check it out in a bit.

@beeme1mr beeme1mr closed this Oct 21, 2022
@beeme1mr
beeme1mr deleted the release-please--branches--main branch October 21, 2022 19:33
@beeme1mr

beeme1mr commented Oct 21, 2022

Copy link
Copy Markdown
Member

Looks like an outdated branch. I'll keep and eye on this to see if it continues to be an issue.

@toddbaert

toddbaert commented Oct 21, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

This is because of these commits: 93cfb78

and

4a9f6df

These are explicitly telling release please to cut these releases. Was this not the expected result?

raphael-wigoutschnigg-dt pushed a commit to open-feature-forking/flagd that referenced this pull request Mar 11, 2025
@github-actions
chore(main): release providers/go-feature-flag 0.1.14 (open-feature#200)
1225ade 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jonathannorris added a commit that referenced this pull request Jul 20, 2026
@jonathannorris
chore: resolve newly reported dependabot alerts and address review fe…
20b4381 
…edback

- github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration
  (medium, alert #260)
- js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app
  (medium/high, alerts #207, #199, #200); lockfile already resolved these
  transitively, this pins the direct specifiers to match
- Root-cause fix for a regression introduced by the prior
  testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose
  changed DockerContainer.MappedPort's signature (nat.Port -> string),
  which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's
  testframework (pinned, no newer version exists) and broke
  `go vet`/`go test` compilation in test/integration (go build alone
  didn't catch it since _test.go files aren't compiled by `go build`).
  Reverted testcontainers-go and testcontainers-go/modules/compose to
  v0.41.0 (API-compatible) while keeping the already-patched transitive
  containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit
  go.mod requires, so alerts #189, #192-#196 remain resolved without
  reintroducing the vulnerable containerd version.
- Add ReadTimeout to the flagd-proxy metrics server's http.Server per
  CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only
  bounds header parsing, leaving the plain HTTP/h2c port open to
  slow-client (Slowloris-style) resource exhaustion.

Still unresolvable: github.com/docker/docker (alerts #151, #152, #184,
#185, #186) remains at v28.5.2+incompatible in test/integration. No
version >= 28.5.2 (including the advisory's referenced 29.3.1 for
alert #152) is published under the legacy github.com/docker/docker
import path in the Go module proxy; moby now ships new majors under
github.com/moby/moby/v2, which this module graph cannot switch to
without deeper dependency surgery.

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris jonathannorris mentioned this pull request Jul 20, 2026
Merged
toddbaert pushed a commit that referenced this pull request Jul 20, 2026
@jonathannorris @toddbaert
chore: resolve newly reported dependabot alerts and address review fe…
1bc6b5e 
…edback

- github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration
  (medium, alert #260)
- js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app
  (medium/high, alerts #207, #199, #200); lockfile already resolved these
  transitively, this pins the direct specifiers to match
- Root-cause fix for a regression introduced by the prior
  testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose
  changed DockerContainer.MappedPort's signature (nat.Port -> string),
  which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's
  testframework (pinned, no newer version exists) and broke
  `go vet`/`go test` compilation in test/integration (go build alone
  didn't catch it since _test.go files aren't compiled by `go build`).
  Reverted testcontainers-go and testcontainers-go/modules/compose to
  v0.41.0 (API-compatible) while keeping the already-patched transitive
  containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit
  go.mod requires, so alerts #189, #192-#196 remain resolved without
  reintroducing the vulnerable containerd version.
- Add ReadTimeout to the flagd-proxy metrics server's http.Server per
  CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only
  bounds header parsing, leaving the plain HTTP/h2c port open to
  slow-client (Slowloris-style) resource exhaustion.

Still unresolvable: github.com/docker/docker (alerts #151, #152, #184,
#185, #186) remains at v28.5.2+incompatible in test/integration. No
version >= 28.5.2 (including the advisory's referenced 29.3.1 for
alert #152) is published under the legacy github.com/docker/docker
import path in the Go module proxy; moby now ships new majors under
github.com/moby/moby/v2, which this module graph cannot switch to
without deeper dependency surgery.

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert pushed a commit that referenced this pull request Jul 20, 2026
@jonathannorris @toddbaert
chore: resolve newly reported dependabot alerts and address review fe…
b3833bb 
…edback

- github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration
  (medium, alert #260)
- js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app
  (medium/high, alerts #207, #199, #200); lockfile already resolved these
  transitively, this pins the direct specifiers to match
- Root-cause fix for a regression introduced by the prior
  testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose
  changed DockerContainer.MappedPort's signature (nat.Port -> string),
  which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's
  testframework (pinned, no newer version exists) and broke
  `go vet`/`go test` compilation in test/integration (go build alone
  didn't catch it since _test.go files aren't compiled by `go build`).
  Reverted testcontainers-go and testcontainers-go/modules/compose to
  v0.41.0 (API-compatible) while keeping the already-patched transitive
  containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit
  go.mod requires, so alerts #189, #192-#196 remain resolved without
  reintroducing the vulnerable containerd version.
- Add ReadTimeout to the flagd-proxy metrics server's http.Server per
  CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only
  bounds header parsing, leaving the plain HTTP/h2c port open to
  slow-client (Slowloris-style) resource exhaustion.

Still unresolvable: github.com/docker/docker (alerts #151, #152, #184,
#185, #186) remains at v28.5.2+incompatible in test/integration. No
version >= 28.5.2 (including the advisory's referenced 29.3.1 for
alert #152) is published under the legacy github.com/docker/docker
import path in the Go module proxy; moby now ships new majors under
github.com/moby/moby/v2, which this module graph cannot switch to
without deeper dependency surgery.

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert added a commit that referenced this pull request Jul 20, 2026
@jonathannorris @toddbaert
fix: add server ReadTimeouts, update security deps (#1980)
0e1e8b3 
## Summary

Resolves all cleanly patchable open Dependabot security alerts (28 of
33). The remaining 5 have no available patched version for their legacy
import path — see below.

## Dependabot Alerts Resolved

| Alert | Package | Severity | Fix |
|-------|---------|----------|-----|
| #260 | `github.com/sigstore/sigstore-go` | **medium** | Bumped to
v1.2.2 in `test/integration` |
| #247-#259 (13 alerts) | `golang.org/x/crypto` |
**critical/high/medium** | Already resolved on `main` (v0.52.0+);
carried through the rebase |
| #207 | `js-yaml` | **medium** | Bumped to `^4.2.0` in `playground-app`
|
| #206, #202, #201 | `golang.org/x/net` | **medium** | Bumped to
v0.55.0/v0.56.0 across `flagd`, `core`, `flagd-proxy`,
`test/integration`, and related test modules |
| #200, #199 | `vite` | **medium/high** | Bumped to `^6.4.3` in
`playground-app` |
| #197 | `@babel/core` | **low** | Forced `>=7.29.6` via npm override in
`playground-app` |
| #189, #192-#196 | `github.com/containerd/containerd/v2` |
**high/medium** | Bumped to v2.2.5 in `test/integration` (kept on
`testcontainers-go` v0.41.0 — see note below) |
| #190 | `js-cookie` | **high** | Forced `>=3.0.7` via npm override in
`playground-app` |

**Note on containerd fix:** an earlier revision of this branch bumped
`testcontainers-go` to v0.43.0 to reach patched `containerd/v2`, but
that also changed `DockerContainer.MappedPort`'s signature in a way
that's incompatible with `go-sdk-contrib/tests/flagd/v2@v2.0.2` (pinned;
no newer version exists) — breaking `go vet`/`go test` compilation in
`test/integration` (not caught by `go build` alone, since it doesn't
compile `_test.go` files). Reverted `testcontainers-go` to v0.41.0
(API-compatible) while keeping `containerd/containerd/v2` pinned at
v2.2.5 via an explicit `go.mod` require — standard Go MVS, no `replace`
directive needed.

## Unresolvable Alerts

**`github.com/docker/docker`** (#151, #152, #184, #185, #186) in
`test/integration`: pinned at `v28.5.2+incompatible`. No version ≥ that
(including the advisory's referenced `v29.3.1` for #152) exists under
the legacy `github.com/docker/docker` import path in the Go module proxy
— moby now ships new majors under `github.com/moby/moby/v2`. Transitive
dependency of testcontainers/buildx/compose; unresolvable until those
upstreams migrate.

| Alert | Package | Severity | Reason |
|-------|---------|----------|--------|
| #186 | `github.com/docker/docker` | **high** | No patched version in
Go module proxy |
| #185 | `github.com/docker/docker` | **medium** | No patched version in
Go module proxy |
| #184 | `github.com/docker/docker` | **high** | No patched version in
Go module proxy |
| #152 | `github.com/docker/docker` | **high** | Advisory's patched
version (29.3.1) not published for this import path |
| #151 | `github.com/docker/docker` | **medium** | No patched version in
Go module proxy |

## Other changes

- Added `ReadTimeout` to the flagd-proxy metrics server's `http.Server`
(`flagd-proxy/pkg/service/server.go`) per CodeRabbit review feedback,
hardening the plain HTTP/h2c port against slow-client resource
exhaustion.

## Verification

- `make test`, `make build`, and `go vet` pass across all Go modules
(`core`, `flagd`, `flagd-proxy`, `flagd-proxy/tests/loadtest`,
`test/zero-downtime-flagd-proxy`).
- `test/integration`: `go build ./...`, `go vet ./...`, and `go test`
(compile-only; actual container run needs a Docker daemon) all pass.
- `playground-app`: `npm run build` succeeds; `npm install
--package-lock-only --dry-run` reports up to date.

---------

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
Co-authored-by: Todd Baert <todd.baert@dynatrace.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AlexsJones AlexsJones Awaiting requested review from AlexsJones

Assignees

No one assigned

Labels

autorelease: pending

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@AlexsJones @beeme1mr @toddbaert