Skip to content

🚚 release#552

Merged
mfiedorowicz merged 10 commits into
releasefrom
develop
Jul 8, 2026
Merged

🚚 release#552
mfiedorowicz merged 10 commits into
releasefrom
develop

Conversation

@mfiedorowicz

@mfiedorowicz mfiedorowicz commented Jul 8, 2026

Copy link
Copy Markdown
Member

No description provided.

mfiedorowicz and others added 10 commits May 25, 2026 17:25
@mfiedorowicz
feat(dbstore): indexes and counter to make ingestion_logs list querie…
37359fe 
…s scale (#535)
@mfiedorowicz
feat(dbstore): composite (updated_at DESC, id DESC) index for list sh…
e07abac 
…ape (#536)
@mfiedorowicz
fix(dbstore): order INSERT input on counter triggers to prevent deadl…
defaa55 
…ock (#540)
@mfiedorowicz
fix(deps): drop vulnerable docker/docker via testcontainers-go v0.42.0 (
0b3d27f 
#542)
@mfiedorowicz
chore: Go 1.26.4 toolchain (CVE-2026-42504) and hydra client v26 (#543)
0bf93af
@unlisted
feat(reconciler): add per-record auto-apply policy hook (OBS-2988) (#539
7bb4327 
)
@davidlanouette
chore(repo): Add David to the code owners (#547)
f660511 
Signed-off-by: David Lanouette <dlanouette@netboxlabs.com>
@jajeffries @cursoragent
feat(ENGHLP-1235): add custom OpenTelemetry spans for ingest and NetB…
73f57e8 
…ox client (#546)

Co-authored-by: Cursor <cursoragent@cursor.com>
@mfiedorowicz
fix(differ): return structured errors with plugin error details (#550)
48787c8
@mfiedorowicz
feat(reconciler): requeue deduplicated entities for re-plan and apply (…
85f2aa0 
…#551)
@mfiedorowicz mfiedorowicz self-assigned this Jul 8, 2026
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Vulnerability Scan: Passed — diode-reconciler

Image: diode-reconciler:scan

No vulnerabilities found.

Commit: 531a5a5

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Vulnerability Scan: Passed — diode-auth

Image: diode-auth:scan

Source Library CVE Severity Installed Fixed Title
usr/bin/hydra github.com/docker/docker CVE-2026-34040 🟠 HIGH v28.3.3+incompatible 29.3.1 Moby: Moby: Authorization bypass vulnerability
usr/bin/hydra github.com/docker/docker CVE-2026-33997 🟡 MEDIUM v28.3.3+incompatible 29.3.1 moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plu
usr/bin/hydra github.com/go-jose/go-jose/v3 CVE-2026-34986 🟠 HIGH v3.0.4 3.0.5 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-33815 🔴 CRITICAL v5.7.5 5.9.0 github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-33816 🔴 CRITICAL v5.7.5 5.9.0 github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-41889 ⚪ LOW v5.7.5 5.9.2 github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditio
usr/bin/hydra go.opentelemetry.io/otel CVE-2026-29181 🟠 HIGH v1.40.0 1.41.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service
usr/bin/hydra go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp CVE-2026-39882 🟡 MEDIUM v1.37.0 1.43.0 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1 ...
usr/bin/hydra go.opentelemetry.io/otel/sdk CVE-2026-39883 🟠 HIGH v1.40.0 1.43.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code exe
usr/bin/hydra golang.org/x/crypto CVE-2026-39828 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution
usr/bin/hydra golang.org/x/crypto CVE-2026-39829 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-39830 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource
usr/bin/hydra golang.org/x/crypto CVE-2026-39831 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to mis
usr/bin/hydra golang.org/x/crypto CVE-2026-39832 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass du
usr/bin/hydra golang.org/x/crypto CVE-2026-39835 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via
usr/bin/hydra golang.org/x/crypto CVE-2026-42508 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts:
usr/bin/hydra golang.org/x/crypto CVE-2026-46595 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to sk
usr/bin/hydra golang.org/x/crypto CVE-2026-46597 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-39827 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via
usr/bin/hydra golang.org/x/crypto CVE-2026-39833 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass du
usr/bin/hydra golang.org/x/crypto CVE-2026-39834 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due
usr/bin/hydra golang.org/x/crypto CVE-2026-46598 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of
usr/bin/hydra golang.org/x/net CVE-2026-25681 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross
usr/bin/hydra golang.org/x/net CVE-2026-27136 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via H
usr/bin/hydra golang.org/x/net CVE-2026-33814 🟠 HIGH v0.48.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service
usr/bin/hydra golang.org/x/net CVE-2026-39821 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via i
usr/bin/hydra golang.org/x/net CVE-2026-25680 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive
usr/bin/hydra golang.org/x/net CVE-2026-42502 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via u
usr/bin/hydra golang.org/x/net CVE-2026-42506 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arb
usr/bin/hydra stdlib CVE-2026-25679 🟠 HIGH v1.26.0 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
usr/bin/hydra stdlib CVE-2026-27137 🟠 HIGH v1.26.0 1.26.1 crypto/x509: Incorrect enforcement of email constraints in crypto/x509
usr/bin/hydra stdlib CVE-2026-27145 🟠 HIGH v1.26.0 1.25.11, 1.26.4 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive process
usr/bin/hydra stdlib CVE-2026-32280 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certific
usr/bin/hydra stdlib CVE-2026-32281 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certifica
usr/bin/hydra stdlib CVE-2026-32283 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key up
usr/bin/hydra stdlib CVE-2026-33810 🟠 HIGH v1.26.0 1.26.2 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorr
usr/bin/hydra stdlib CVE-2026-33811 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net: golang: Go net package: Denial of Service via long CNAME response in Lookup
usr/bin/hydra stdlib CVE-2026-33814 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service
usr/bin/hydra stdlib CVE-2026-39820 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
usr/bin/hydra stdlib CVE-2026-39836 🟠 HIGH v1.26.0 1.25.10, 1.26.3 ELSA-2026-22121: golang security update (IMPORTANT)
usr/bin/hydra stdlib CVE-2026-42499 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/mail: golang: net/mail: Denial of Service via pathological email address par
usr/bin/hydra stdlib CVE-2026-42504 🟠 HIGH v1.26.0 1.25.11, 1.26.4 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
usr/bin/hydra stdlib CVE-2026-27142 🟡 MEDIUM v1.26.0 1.25.8, 1.26.1 html/template: URLs in meta content attribute actions are not escaped in html/te
usr/bin/hydra stdlib CVE-2026-32282 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
usr/bin/hydra stdlib CVE-2026-32288 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously
usr/bin/hydra stdlib CVE-2026-32289 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 html/template: golang: html/template: Cross-Site Scripting (XSS) via improper co
usr/bin/hydra stdlib CVE-2026-39823 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 html/template: golang: Go html/template: Cross-Site Scripting via improper URL e
usr/bin/hydra stdlib CVE-2026-39825 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query
usr/bin/hydra stdlib CVE-2026-39826 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 html/template: golang: html/template: Cross-site scripting due to incorrect scri
usr/bin/hydra stdlib CVE-2026-42507 🟡 MEDIUM v1.26.0 1.25.11, 1.26.4 net/textproto: golang: Golang net/textproto: Misleading error messages via input
usr/bin/hydra stdlib CVE-2026-27138 ⚪ LOW v1.26.0 1.26.1 crypto/x509: Panic in name constraint checking for malformed certificates in cry
usr/bin/hydra stdlib CVE-2026-27139 ⚪ LOW v1.26.0 1.25.8, 1.26.1 os: FileInfo can escape from a Root in golang os module

Commit: 531a5a5

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Vulnerability Scan: Passed — diode-ingester

Image: diode-ingester:scan

No vulnerabilities found.

Commit: 531a5a5

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Go test coverage

STATUS ELAPSED PACKAGE COVER PASS FAIL SKIP
🟢 PASS 1.26s github.com/netboxlabs/diode/diode-server/auth 44.7% 42 0 0
🟢 PASS 1.59s github.com/netboxlabs/diode/diode-server/auth/cli 0.0% 0 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/authutil 82.8% 5 0 0
🟢 PASS 0.21s github.com/netboxlabs/diode/diode-server/dbstore/postgres 0.0% 0 0 0
🟢 PASS 1.15s github.com/netboxlabs/diode/diode-server/entityhash 79.2% 13 0 0
🟢 PASS 1.14s github.com/netboxlabs/diode/diode-server/entitymatcher 82.8% 97 0 0
🟢 PASS 0.10s github.com/netboxlabs/diode/diode-server/errors 0.0% 0 0 0
🟢 PASS 1.19s github.com/netboxlabs/diode/diode-server/graph 52.0% 81 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/grpckeepalive 100.0% 1 0 0
🟢 PASS 1.48s github.com/netboxlabs/diode/diode-server/ingester 85.4% 66 0 0
🟢 PASS 1.15s github.com/netboxlabs/diode/diode-server/matching 94.1% 66 0 0
🟢 PASS 1.07s github.com/netboxlabs/diode/diode-server/migrator 70.4% 4 0 0
🟢 PASS 3.13s github.com/netboxlabs/diode/diode-server/netboxdiodeplugin 46.8% 23 0 0
🟢 PASS 0.19s github.com/netboxlabs/diode/diode-server/pprof 0.0% 0 0 0
🟢 PASS 5.10s github.com/netboxlabs/diode/diode-server/reconciler 74.1% 101 0 0
🟢 PASS 0.12s github.com/netboxlabs/diode/diode-server/reconciler/changeset 0.0% 0 0 0
🟢 PASS 1.07s github.com/netboxlabs/diode/diode-server/reconciler/differ 49.3% 23 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/server 85.7% 14 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/strcase 100.0% 24 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/telemetry 26.2% 26 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/telemetry/otel 90.2% 25 0 0
🟢 PASS 0.10s github.com/netboxlabs/diode/diode-server/tls 0.0% 0 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/version 100.0% 2 0 0

Total coverage: 54.8%

@mfiedorowicz
mfiedorowicz merged commit c017ee1 into release Jul 8, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leoparente leoparente leoparente approved these changes
@samiura samiura samiura approved these changes
@jajeffries jajeffries Awaiting requested review from jajeffries jajeffries is a code owner
@manrodrigues manrodrigues Awaiting requested review from manrodrigues manrodrigues is a code owner
@MicahParks MicahParks Awaiting requested review from MicahParks MicahParks is a code owner
@grant-nbl grant-nbl Awaiting requested review from grant-nbl grant-nbl is a code owner
@paulstuart paulstuart Awaiting requested review from paulstuart paulstuart is a code owner
@marc-barry marc-barry Awaiting requested review from marc-barry marc-barry is a code owner

Assignees

@mfiedorowicz mfiedorowicz

Labels

build dependencies diode-reconciler diode-server github-actions go

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@mfiedorowicz @leoparente @samiura @unlisted @davidlanouette @jajeffries