Merged
Conversation
…resource conflicts (#4389) <!-- CURSOR_SUMMARY --> > [!NOTE] > **Medium Risk** > Changes Azure integration test setup logic to delete/retry on "ghost" 409 Conflict states instead of skipping, which can make previously non-fatal flakes fail loudly and may increase cleanup/destructive actions in shared subscriptions. Adds optional per-run resource-group isolation to reduce cross-test interference. > > **Overview** > Improves Azure integration test robustness by handling *ghost* control-plane conflicts (create returns `409` but subsequent `Get` is `404`) with **automatic remediation**: attempt a best-effort delete, wait, retry creation once, and **fail** if the resource remains unrecoverable (replacing prior `t.Skip` behavior for VM/VMSS/role-assignment cases). > > Adds optional parallel-run isolation by deriving `integrationTestResourceGroup` from `AZURE_INTEGRATION_TEST_RUN_ID` (sanitized/length-capped) and updates integration-test docs and the adapter-creation skill to reflect the new resource-group behavior and the “auto-remediate then fail” policy. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 013173ce82183b498ce1d32f5d795d4a090a637c. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> GitOrigin-RevId: 19315221a8b7e93d5db24a6141edb0401b10f7f8
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary Add a new Azure adapter for Load Balancer Backend Address Pools (ENG-3327). ## Changes - **Client interface**: Created `load-balancer-backend-address-pools-client.go` with `Get` and `NewListPager` methods - **Mock**: Generated mock client for unit testing - **Adapter implementation**: `network-load-balancer-backend-address-pool.go` implementing `SearchableWrapper` with: - `Get` method requiring `loadBalancerName` and `backendAddressPoolName` query parts - `Search` and `SearchStream` methods requiring `loadBalancerName` query part - Health status mapping from provisioning state - Input validation for empty query parts - **Linked item queries**: - Parent: NetworkLoadBalancer - VirtualNetwork (pool and address level) - Subnet (from backend addresses) - NetworkInterface (from backend IP configurations) - InboundNatRule, LoadBalancingRule, OutboundRule references - FrontendIPConfiguration (from regional LB references) - stdlib NetworkIP (from backend address IP addresses) - **Registration**: Added to `adapters.go` in both active and placeholder blocks - **Unit tests**: Comprehensive tests including StaticTests for linked queries - **Integration test**: Setup/Run/Teardown structure with Get, Search, VerifyLinkedItems, and VerifyItemAttributes tests ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.Network/loadBalancers/backendAddressPools/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 10 link types verified (parent LB, VNets, subnets, NICs, NAT rules, LB rules, outbound rules, frontend IPs, IP addresses). IP links included. - [x] **PotentialLinks**: 9 types listed, matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, Search, SearchStream, StaticTests, ErrorHandling, empty validation) - [x] **Integration test**: Present, follows Setup/Run/Teardown structure All checklist items passed. Ready for review. <!-- CURSOR_AGENT_PR_BODY_END --> Linear Issue: [ENG-3327](https://linear.app/overmind/issue/ENG-3327/create-azure-adapter-networkloadbalancerbackendaddresspool) <div><a href="https://cursor.com/agents/bc-6a1336c3-9cda-48d4-a15a-7a3d815ee9eb"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-6a1336c3-9cda-48d4-a15a-7a3d815ee9eb"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Passing integration test : <img width="744" height="992" alt="image" src="https://github.com/user-attachments/assets/7e6806e1-fe22-4786-b4dc-7ded89f001f8" /> GitOrigin-RevId: 4c6f3ae3a9e4029379959b970b67009d945c98cf
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary Adds a new Azure adapter for Load Balancer Probes (`NetworkLoadBalancerProbe`). Probes are child resources of Load Balancers that define health check configurations for backend pool members. ## Changes - **Client interface** (`sources/azure/clients/load-balancer-probes-client.go`): New `LoadBalancerProbesClient` interface wrapping `armnetwork.LoadBalancerProbesClient` with `Get` and `NewListPager` methods - **Mock** (`sources/azure/shared/mocks/mock_load_balancer_probes_client.go`): Generated mock for unit testing - **Adapter** (`sources/azure/manual/network-load-balancer-probe.go`): `SearchableWrapper` implementation with: - `Get(scope, loadBalancerName, probeName)` - retrieves a specific probe - `Search(scope, loadBalancerName)` - lists all probes under a load balancer - `SearchStream` - streaming variant of Search - Health status mapping from provisioning state - Linked items: parent LoadBalancer (GET), LoadBalancingRules (GET) - **Registration** (`sources/azure/manual/adapters.go`): Registered in both init and placeholder blocks - **Unit tests** (`sources/azure/manual/network-load-balancer-probe_test.go`): Comprehensive tests including Get, Search, StaticTests, error handling, empty name validation, nil name handling - **Integration test** (`sources/azure/integration-tests/network-load-balancer-probe_test.go`): Full Setup/Run/Teardown test against live Azure APIs ## Bidirectional Links The parent `NetworkLoadBalancer` adapter already links to probes via GET (iterating `Properties.Probes`) and includes `NetworkLoadBalancerProbe` in `PotentialLinks()`. The child probe adapter links back to the parent via GET. Both directions are tested. ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.Network/loadBalancers/probes/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 2 link types verified (parent LoadBalancer GET, LoadBalancingRules GET). No IP/DNS fields in Probe struct. - [x] **PotentialLinks**: 2 types listed (`NetworkLoadBalancer`, `NetworkLoadBalancerLoadBalancingRule`), matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, Get_WithInsufficientQueryParts, Get_WithEmptyLoadBalancerName, Get_WithEmptyProbeName, Search, Search_WithNilName, Search_InvalidQueryParts, Search_WithEmptyLoadBalancerName, ErrorHandling_Get, ErrorHandling_Search, Get_NoProperties, StaticTests) - [x] **Integration test**: All sub-tests passing (Setup, Run/GetProbe, Run/SearchProbes, Run/VerifyLinkedItems, Run/VerifyItemAttributes, Teardown) against live Azure APIs All checklist items passed. Ready for review. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-863ee979-1cff-4ba2-9947-c616fe0372ee"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-863ee979-1cff-4ba2-9947-c616fe0372ee"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> GitOrigin-RevId: c44110ae2ba31335086570b41a867ca262fdde88
…n (#4413) <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary This PR adds an Azure adapter for PostgreSQL Flexible Server Configurations using the `azure-adapter-creation` skill. The adapter discovers server configuration settings (like `shared_buffers`, `work_mem`, etc.) that can be queried as child resources of a PostgreSQL Flexible Server. ## Changes - **Client interface**: `sources/azure/clients/dbforpostgresql-configurations-client.go` - **Adapter implementation**: `sources/azure/manual/dbforpostgresql-flexible-server-configuration.go` - **Unit tests**: `sources/azure/manual/dbforpostgresql-flexible-server-configuration_test.go` - **Integration test**: `sources/azure/integration-tests/dbforpostgresql-flexible-server-configuration_test.go` - **Generated mock**: `sources/azure/shared/mocks/mock_dbforpostgresql_configurations_client.go` - **Registration**: Added to `sources/azure/manual/adapters.go` ## Adapter Details | Property | Value | | --- | --- | | Wrapper Type | `SearchableWrapper` (child of Flexible Server) | | Item Type | `DBforPostgreSQLFlexibleServerConfiguration` | | SDK Package | `armpostgresqlflexibleservers/v5` (already in go.mod) | | Get | `client.Get(ctx, resourceGroupName, serverName, configurationName)` | | Search | Lists all configurations for a given server | | Unique Attribute | Composite key: `serverName|configurationName` | | IAM Permissions | `Microsoft.DBforPostgreSQL/flexibleServers/configurations/read` | | Predefined Role | `Reader` | ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.DBforPostgreSQL/flexibleServers/configurations/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 1 link verified (GET to parent DBforPostgreSQLFlexibleServer). No IP/DNS fields in Configuration properties. - [x] **PotentialLinks**: 1 type listed (`DBforPostgreSQLFlexibleServer`), matches LinkedItemQueries - [x] **Bidirectional links**: Parent adapter (`dbforpostgresql-flexible-server.go`) already has SEARCH link to this child type and includes it in PotentialLinks - [x] **Unit tests**: All passing (Get, Search, SearchStream, GetWithInsufficientQueryParts, GetWithEmptyServerName, GetWithEmptyConfigurationName, SearchWithEmptyServerName, SearchWithNoQueryParts, Search_ConfigurationWithNilName, ErrorHandling_Get, ErrorHandling_Search) - [x] **Integration test**: All sub-tests passing (Setup, Run, Teardown) against live Azure APIs - GetPostgreSQLFlexibleServerConfiguration: Retrieved configuration successfully - SearchPostgreSQLFlexibleServerConfigurations: Found 530 configurations - VerifyLinkedItems: Verified 1 linked query to parent server - VerifyItemAttributes: Validated type, scope, and unique attribute All checklist items passed. Ready for review. ## Related Closes ENG-3370 <!-- CURSOR_AGENT_PR_BODY_END --> Linear Issue: [ENG-3370](https://linear.app/overmind/issue/ENG-3370/create-azure-adapter-dbforpostgresqlflexibleserverconfiguration) <div><a href="https://cursor.com/agents/bc-7b555039-e8d5-4d26-a42c-426a39085938"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-7b555039-e8d5-4d26-a42c-426a39085938"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> GitOrigin-RevId: 0c189d2da9845e789cb27ef0c9b3ffb62a3dfa60
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary Create Azure adapter for SQL Database Schemas (child resource of SQL Server → SQL Database). ## Changes - **Client interface** (`sources/azure/clients/sql-database-schemas-client.go`): Wraps Azure SDK `DatabaseSchemasClient` with `Get` and `ListByDatabase` methods - **Adapter implementation** (`sources/azure/manual/sql-database-schema.go`): SearchableWrapper with 3-level composite key (serverName, databaseName, schemaName) - **Registration** (`sources/azure/manual/adapters.go`): Register adapter in both active and placeholder blocks - **Unit tests** (`sources/azure/manual/sql-database-schema_test.go`): Comprehensive test coverage including edge cases - **Integration test** (`sources/azure/integration-tests/sql-database-schema_test.go`): Tests against live Azure APIs ## Architecture - **Parent chain**: SQL Server → SQL Database → Database Schema - **Wrapper type**: SearchableWrapper (deeply nested, 3 path params after resourceGroup) - **`Get`** requires: serverName, databaseName, schemaName - **`Search`** requires: serverName, databaseName (lists all schemas under that database) - **Links back** to parent SQLDatabase resource via composite key The parent adapter `sql-database.go` already has a SEARCH link to SQLDatabaseSchema (added in a prior PR). ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.Sql/servers/databases/schemas/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 1 link verified (parent SQLDatabase via GET) - [x] **PotentialLinks**: 1 type listed (SQLDatabase), matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, Search, SearchStream, StaticTests, ErrorHandling, edge cases) - [x] **Integration test**: All sub-tests passing (Setup, Run, Teardown) against live Azure APIs All checklist items passed. Ready for review. Closes: ENG-3372 <!-- CURSOR_AGENT_PR_BODY_END --> Linear Issue: [ENG-3372](https://linear.app/overmind/issue/ENG-3372/create-azure-adapter-sqldatabaseschema) <div><a href="https://cursor.com/agents/bc-8bd525e4-23d3-4eed-8410-68336a47f8b6"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-8bd525e4-23d3-4eed-8410-68336a47f8b6"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> GitOrigin-RevId: a2944706e235d4e386a3c9ba5412ed938d0fce25
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary This PR adds a new Azure adapter for PostgreSQL Flexible Server Replicas. The adapter discovers read replicas of PostgreSQL Flexible Servers and links them to related infrastructure resources. ## Changes - **Client interface** (`sources/azure/clients/dbforpostgresql-flexible-server-replica-client.go`): Wrapper combining `ReplicasClient` (for listing replicas via `NewListByServerPager`) and `ServersClient` (for `Get` since replicas are servers themselves) - **Adapter implementation** (`sources/azure/manual/dbforpostgresql-flexible-server-replica.go`): - `SearchableWrapper` implementation with `Get`, `Search`, `SearchStream` methods - Composite unique attribute: `serverName + replicaName` - Health mapping from server state (Ready, Starting, Stopping, etc.) - Links to: parent server, FQDN (DNS), subnet, VNet, private DNS zone, managed identities, private endpoints, Key Vault resources - **Registration** (`sources/azure/manual/adapters.go`): Register adapter with SDK clients - **Unit tests** (`sources/azure/manual/dbforpostgresql-flexible-server-replica_test.go`): Comprehensive tests for Get, Search, SearchStream, validation errors, health mapping - **Integration test** (`sources/azure/integration-tests/dbforpostgresql-flexible-server-replica_test.go`): End-to-end test against live Azure APIs ## Technical Details - **Item type**: `DBforPostgreSQLFlexibleServerReplica` (already defined in `item-types.go`) - **Parent adapter**: `dbforpostgresql-flexible-server.go` already has SEARCH link to this child type - **Wrapper type**: `SearchableWrapper` — `Get` requires `serverName` + `replicaName`, `Search` lists replicas under a parent server ## Self-Review Checklist - [x] **IAMPermissions**: Present, references `Microsoft.DBforPostgreSQL/flexibleServers/read` and `Microsoft.DBforPostgreSQL/flexibleServers/replicas/read` - [x] **PredefinedRole**: Present, uses `Reader` - [x] **LinkedItemQueries**: 9 link types verified (DBforPostgreSQLFlexibleServer, NetworkSubnet, NetworkVirtualNetwork, NetworkPrivateDNSZone, NetworkPrivateEndpoint, ManagedIdentityUserAssignedIdentity, KeyVaultVault, KeyVaultKey, NetworkDNS) - [x] **PotentialLinks**: 9 types listed, matches LinkedItemQueries - [x] **Unit tests**: All passing (Get, Search, SearchStream, StaticTests, ErrorHandling, HealthMapping, validation edge cases) - [x] **Integration test**: All sub-tests passing (Setup, Run, Teardown) against live Azure APIs All checklist items passed. Ready for review. ## Related Issues Closes ENG-3371 <!-- CURSOR_AGENT_PR_BODY_END --> Linear Issue: [ENG-3371](https://linear.app/overmind/issue/ENG-3371/create-azure-adapter-dbforpostgresqlflexibleserverreplica) <div><a href="https://cursor.com/agents/bc-1fe05f63-e95d-4304-887c-5b3922877436"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-1fe05f63-e95d-4304-887c-5b3922877436"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Lionel Wilson <Lionel-Wilson@users.noreply.github.com> GitOrigin-RevId: f9af49b051c4edd8a75861cf4f554e99fb88fb5d
## Summary - Add end-to-end GitHub Check Run lifecycle to the GitHub App: create an in-progress check run in `StartChangeAnalysis` for immediate UX, conclude it in the River worker with pass/fail based on configured `CheckRunMode` (or `neutral` on failure/timeout) - Extend `SignalConfig` proto with `CheckRunMode` enum (REPORT_ONLY default, FAIL_HIGH_SEVERITY, FAIL_ANY_RISK) and add `github_check_run_id` column to `changes` table - Graceful degradation: silently skipped when `checks:write` not granted; default mode always concludes as success ## Linear Ticket - **Ticket**: [ENG-3353](https://linear.app/overmind/issue/ENG-3353/implement-github-app-check-runs-phase-1) — Implement GitHub App Check Runs (Phase 1) - **Purpose**: Enable teams to gate PR merges on Overmind risk analysis results via GitHub branch protection - **Project**: GitHub App v2 ## Changes ### Proto & Config - `CheckRunMode` enum added to `sdp/config.proto` with three modes; `check_run_mode` field 4 on `SignalConfig` - Generated Go and TypeScript protobuf code updated ### GitHub App Library (`githubapp.go`) - `CheckRunName` constant (`"Overmind / Risk Analysis"`) — stable identifier for branch protection - `GetPRHeadSHA` — fetches PR head SHA via GitHub API (per ADR 0021) - `CheckInstallationCanCreateChecks` — verifies `checks:write` permission - `CreateCheckRun` / `ConcludeCheckRun` — create in-progress and conclude completed check runs - Unit tests covering all new functions including 403 handling ### Check Run Output & Conclusion (`checkrun_summary.go`) - `buildCheckRunSummary` — risk count by severity, blast radius, link with UTM tracking - `evaluateCheckRunConclusion` — mode-based pass/fail logic - `concludeCheckRunForWorker` — bridge function injected into River worker ### RPC Handler Wiring (`changesservice.go`) - `checkGithubAppCanCreateChecks` — permission check method - Check run creation in `StartChangeAnalysis` after existing PR comment setup - Check run ID persisted to DB and passed to River job args ### River Worker Wiring (`change_analysis.go`) - `concludeAnalysisCheckRun` on success path (before PR comment) - `concludeAnalysisCheckRunNeutral` on failure path (`FailRiskJob`) - `ConcludeCheckRunFunc` injected from `main.go` to avoid circular imports ### Database - `github_check_run_id bigint` column on `changes` table (nullable, with comment) - `SetGithubCheckRunID` SQLC query - Atlas migration generated ### Documentation - ADR 0021: Head SHA resolution decision documented - PRD updated with engineering decisions appended below open questions ## Approved Plan - **Plan approver**: Daniel Carabas - **Linear ticket**: [ENG-3353](https://linear.app/overmind/issue/ENG-3353/implement-github-app-check-runs-phase-1) > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). ## Pre-PR Review <details> <summary>Review findings: 0 Blocking, 4 Warnings, 4 Advisories</summary> **Groups run:** Security, Architecture, Database **Groups skipped:** Frontend (only generated protobuf code in sdp-js/), DevOps (no matching paths) **Groups failed:** none **Result:** 0 Blocking, 4 Warnings, 4 Advisories ### Warning (should address) - [Security] `buildCheckRunSummary` interpolates `r.Title` into markdown without escaping (checkrun_summary.go ~line 63). Malformed titles could break check run formatting. - [Security] `concludeAnalysisCheckRun` loads risks with `GetChangeRisks` filtering only by `change_external_id`, not `account_name`. Isolation maintained via FK but tenant-scoped convention suggests adding `account_name`. - [Security] No tests for the check-run creation path in `StartChangeAnalysis` or worker-side conclusion/neutral behaviour. - [Security] `ticket_link` parsed to `owner/repo` could target another repo within org-wide installation scope. Low risk. ### Advisory (consider) - [Architecture] Cross-cutting scope: 6 top-level directories. - [Architecture] Check runs user-visible without PostHog feature flag — account-level CheckRunMode + installation permission used as rollout levers. - [Architecture] Adding checks:write triggers GitHub permission-update notification to existing installs. Plan customer notification. - [Architecture] User-facing docs at docs.overmind.tech don't yet cover Check Runs. ### Clean Areas - Auth chain, SQL parameterization, SSRF, secrets, dependencies all verified clean - Database: SQLC-generated code correct, migration additive, account_name in query, nullable column documented </details> ## Deviations from Approved Plan > Implementation matches the approved plan — no material deviations. Made with [Cursor](https://cursor.com) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Adds new GitHub API interactions (creating/concluding Check Runs) and threads new state through RPC/job execution plus a DB migration; failures are intended to be non-blocking but could affect PR UX if misconfigured permissions/URLs occur. > > **Overview** > Adds an end-to-end **GitHub Check Run** flow for PR risk analysis: `StartChangeAnalysis` now (when permitted) resolves the PR head SHA from GitHub, creates an `in_progress` check, persists its ID, and passes it into the River job. > > On completion the worker builds a condensed check output (`checkrun_summary.go`) and concludes the check as `success`/`failure` based on a new per-account `SignalConfig.check_run_mode` (default *report-only*), and concludes as `neutral` on non-retryable failures/timeouts. > > Includes the new `github_check_run_id` column + SQLC setter, new GitHub App helpers for checks permissions/SHA lookup/create/conclude (with tests), regenerated proto/TS/Go bindings, and ADR/PRD documentation for the head-SHA resolution decision. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 73360d60c4beccecea47e179b29ed0331498a764. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> GitOrigin-RevId: 4337950d45fde23f323b414c3f3e0a09f744838a
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> # GitHub Webhook Lifecycle Events This PR implements handling for GitHub App installation lifecycle webhook events (`deleted`, `suspend`, and `unsuspend`). ## Changes ### Database Schema - Added `github_suspended_at` column to `accounts` table to track suspension state locally - Created migration `20260326000000_add_github_suspended_at.sql` ### SQLC Queries - **`HandleGithubInstallationDeleted`**: Atomically clears `installation_id`, `suspended_at`, and removes `GithubOrganisationProfile` from `signal_config` - **`HandleGithubInstallationSuspended`**: Sets `suspended_at` to NOW() and removes `GithubOrganisationProfile` - **`HandleGithubInstallationUnsuspended`**: Clears `suspended_at` - **`UnsetGithubInstallation`**: Atomic cleanup query for manual removal - **`GetAccountGithubSuspendedAt`**: Retrieves suspension timestamp All queries use PostgreSQL's `jsonb - 'key'` operator for atomic profile removal, eliminating read-modify-write races. ### Webhook Handlers Added three new handlers in `githubservice.go`: - `handleGithubInstallationDeleted`: Processes `installation.deleted` events - `handleGithubInstallationSuspended`: Processes `installation.suspend` events - `handleGithubInstallationUnsuspended`: Processes `installation.unsuspend` events Each handler: - Validates the webhook payload - Calls the corresponding atomic SQLC query - Logs the result with appropriate context - Returns 200 OK even if no matching account is found (idempotent) ### Backend API Changes - **`GetGithubAppInformation`**: Now checks `github_suspended_at` and returns early with `suspended=true` when the installation is suspended, avoiding GitHub API calls that would fail - **`UnsetGithubInstallationID`**: Refactored to use the new atomic `UnsetGithubInstallation` query instead of separate update + read-modify-write operations ### Protocol Buffers - Added `optional bool suspended = 13` field to `GithubAppInformation` message in `sdp/config.proto` - Regenerated Go and TypeScript protobuf code ## Design Decisions 1. **Suspension state is stored locally** - The `github_suspended_at` column avoids relying on GitHub API calls which fail for suspended installations 2. **Installation ID is retained on suspend** - Only cleared on delete, enabling automatic restoration on unsuspend 3. **GithubOrganisationProfile is removed on both suspend and delete** - The cached profile becomes stale when installation tokens are non-functional 4. **All operations are atomic** - Single UPDATE queries with jsonb operators prevent race conditions 5. **No source lifecycle changes** - GitHub installations are independent from srcman-managed sources ## Testing The changes should be tested by: - Verifying webhook handlers respond correctly to `installation.deleted`, `installation.suspend`, and `installation.unsuspend` events - Confirming `GetGithubAppInformation` returns `suspended=true` when `github_suspended_at` is set - Testing that unsuspend automatically restores the integration without user action - Validating that delete permanently removes the installation ID <!-- CURSOR_AGENT_PR_BODY_END --> Linear Issue: [ENG-3330](https://linear.app/overmind/issue/ENG-3330/github-webhook-lifecycle-events-deleted-suspend-unsuspend) <div><a href="https://cursor.com/agents/bc-cb562311-6cb4-434f-b5ef-d6ecbe075625"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-cb562311-6cb4-434f-b5ef-d6ecbe075625"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> GitOrigin-RevId: e736709f5a25eb7d66c6d71110b66970051ab5e7
…439) ## Summary Pre-Phase 1 housekeeping for the **Organizational Rules** project ([ENG-3404](https://linear.app/overmind/issue/ENG-3404/move-oql-prototype-into-tools)). Moves the OQL prototype into `tools/oql-prototype/`, integrates it with the monorepo's single `go.mod`, and cleans up all references — so Phase 1 implementation plans can import prototype packages directly. - **Move & merge modules**: `git mv oql-prototype tools/oql-prototype`, delete both standalone `go.mod`/`go.sum` files, rewrite all 11 Go import paths to `github.com/overmindtech/workspace/tools/oql-prototype/...` - **Dependency hygiene**: Migrate archived `gopkg.in/yaml.v3` to active fork `go.yaml.in/yaml/v3` - **CI coverage**: Add path filters and dedicated test jobs for both `tools/oql-prototype` and `tools/area51-cli` - **Documentation**: Update all 8 external docs referencing the old path, both prototype READMEs, add Tools section to `ARCHITECTURE.md` and `INDEX.md` - **Lint cleanup**: Fix all 64 pre-existing `golangci-lint` issues (errcheck, staticcheck QF1012/S1008/SA4010, canonicalheader, gosec, intrange, predeclared, usestdlibvars, errchkjson) ## Plan [ENG-3404 — Move oql-prototype into tools/](https://linear.app/overmind/issue/ENG-3404/move-oql-prototype-into-tools) ## Test plan - [x] `go build ./tools/oql-prototype/...` — zero errors - [x] `go test ./tools/oql-prototype/...` — `testbank/loader_test.go` passes - [x] `golangci-lint run ./tools/oql-prototype/...` — 0 issues - [x] Stale reference sweep — no orphan references to old root-level path - [x] `go mod tidy` — clean Made with [Cursor](https://cursor.com) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Moderate risk because it changes a widely-used YAML dependency/import path across multiple packages and adjusts CI gating; runtime behavior should be equivalent but could affect YAML encoding/decoding edge cases and test coverage triggers. > > **Overview** > Moves the OQL prototype into `tools/oql-prototype/` and integrates it into the monorepo by deleting its standalone `go.mod` files and rewriting imports to `github.com/overmindtech/workspace/tools/oql-prototype/...`. > > Updates Go codebase YAML usage to the maintained fork `go.yaml.in/yaml/v3` (and adjusts `go.mod`), plus assorted lint-driven cleanups in the prototype (stricter error handling, safer file permissions, minor stdlib modernizations). > > Extends `.github/workflows/ci.yml` with new path filters and dedicated `go test` jobs for `tools/oql-prototype` and `tools/area51-cli`, and updates docs to reference the new `tools/` locations and list these tools in repo architecture/index docs. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 576e0dd5a46194a6af96e574591f797aa431d209. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> GitOrigin-RevId: c045678a91918e88df35860dc60c54294dbb1887
…age (#4438) Consolidate the duplicated CLI authentication code (OAuth device flow, API key exchange, token file caching, scope checking) into a shared go/cliauth package with a Logger interface for output flexibility. This eliminates three copies of the same auth functions across the public CLI, gateway assistant, and (upcoming) area51-cli. The shared package also brings security improvements: 0600/0700 file permissions on token files, nil guards for corrupt token entries, and safe slice handling to prevent caller mutation. Consumers are refactored to use go/cliauth: - cli/cmd/ uses a ptermLogger adapter - services/gateway/cmd/assistant.go uses a logrusLogger adapter - Copybara config updated to export go/cliauth to the public CLI repo <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Refactors CLI authentication/token caching into a new shared package and changes how both the main CLI and gateway assistant obtain tokens, which could affect login flows and local token file handling. Risk is mitigated by added tests and stricter token file permissions/validation. > > **Overview** > Consolidates duplicated CLI authentication into a new shared `go/cliauth` package, covering OAuth device flow, API key exchange, scope checking, and local token caching behind a small `Logger` interface. > > Updates the public `cli` and `services/gateway` assistant to use `cliauth` via `pterm`/`logrus` adapters, removing their embedded auth helpers and shifting tests to validate the shared implementation. > > Tweaks CI/path filters and utility Go tests so changes to `go/cliauth` (and other shared Go packages) correctly trigger dependent jobs, and collapses multiple utility `go test` steps into a single parallel run; Copybara config now exports `go/cliauth` to the public CLI repo as well. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 75a3bce4f9ff41f0d56f08630ba5cc53b05bb2dd. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: David Schmitt <david.schmitt@overmind.tech> GitOrigin-RevId: 96e4ff0fc5d6433646b3471f5d4824481e50fa5b
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [cloud.google.com/go/aiplatform](https://redirect.github.com/googleapis/google-cloud-go) | `v1.120.0` → `v1.121.0` |  |  | | [cloud.google.com/go/auth](https://redirect.github.com/googleapis/google-cloud-go) | `v0.18.2` → `v0.19.0` |  |  | | [cloud.google.com/go/dataplex](https://redirect.github.com/googleapis/google-cloud-go) | `v1.28.0` → `v1.29.0` |  |  | | [cloud.google.com/go/iam](https://redirect.github.com/googleapis/google-cloud-go) | `v1.5.3` → `v1.6.0` |  |  | | [cloud.google.com/go/run](https://redirect.github.com/googleapis/google-cloud-go) | `v1.15.0` → `v1.16.0` |  |  | | [cloud.google.com/go/spanner](https://redirect.github.com/googleapis/google-cloud-go) | `v1.88.0` → `v1.89.0` |  |  | | [github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2](https://redirect.github.com/Azure/azure-sdk-for-go) | `v2.0.1` → `v2.0.2` |  |  | | [github.com/aws/aws-sdk-go-v2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.4` → `v1.41.5` |  |  | | [github.com/aws/aws-sdk-go-v2/config](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.32.12` → `v1.32.13` |  |  | | [github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.19.12` → `v1.19.13` |  |  | | [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.18.20` → `v1.18.21` |  |  | | [github.com/aws/aws-sdk-go-v2/service/apigateway](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.39.0` → `v1.39.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.64.3` → `v1.64.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.60.3` → `v1.60.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudwatch](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.55.2` → `v1.55.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/directconnect](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.38.14` → `v1.38.15` |  |  | | [github.com/aws/aws-sdk-go-v2/service/dynamodb](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.56.2` → `v1.57.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.296.0` → `v1.296.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ecs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.74.0` → `v1.74.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/efs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.13` → `v1.41.14` |  |  | | [github.com/aws/aws-sdk-go-v2/service/eks](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.81.1` → `v1.81.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.33.22` → `v1.33.23` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.54.9` → `v1.54.10` |  |  | | [github.com/aws/aws-sdk-go-v2/service/iam](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.53.6` → `v1.53.7` |  |  | | [github.com/aws/aws-sdk-go-v2/service/kms](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.50.3` → `v1.50.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/lambda](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.88.3` → `v1.88.5` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkfirewall](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.59.6` → `v1.59.7` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkmanager](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.7` → `v1.41.8` |  |  | | [github.com/aws/aws-sdk-go-v2/service/rds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.116.3` → `v1.117.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/route53](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.62.4` → `v1.62.5` |  |  | | [github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.97.1` → `v1.97.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sesv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.60.1` → `v1.60.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sns](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.39.14` → `v1.39.15` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sqs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.42.24` → `v1.42.25` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ssm](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.68.3` → `v1.68.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sts](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.9` → `v1.41.10` |  |  | | [github.com/getsentry/sentry-go](https://redirect.github.com/getsentry/sentry-go) | `v0.43.0` → `v0.44.1` |  |  | | [github.com/googleapis/gax-go/v2](https://redirect.github.com/googleapis/gax-go) | `v2.19.0` → `v2.20.0` |  |  | | [github.com/harness/harness-go-sdk](https://redirect.github.com/harness/harness-go-sdk) | `v0.7.16` → `v0.7.17` |  |  | | [github.com/jackc/pgx/v5](https://redirect.github.com/jackc/pgx) | `v5.8.0` → `v5.9.1` |  |  | | [github.com/nats-io/nats-server/v2](https://redirect.github.com/nats-io/nats-server) | `v2.12.5` → `v2.12.6` |  |  | | [github.com/nats-io/nats.go](https://redirect.github.com/nats-io/nats.go) | `v1.49.0` → `v1.50.0` |  |  | | [github.com/openai/openai-go/v3](https://redirect.github.com/openai/openai-go) | `v3.29.0` → `v3.30.0` |  |  | | [github.com/posthog/posthog-go](https://redirect.github.com/posthog/posthog-go) | `v1.11.1` → `v1.11.2` |  |  | | [github.com/riverqueue/river](https://redirect.github.com/riverqueue/river) | `v0.31.0` → `v0.32.0` |  |  | | [github.com/riverqueue/river/riverdriver/riverpgxv5](https://redirect.github.com/riverqueue/river) | `v0.31.0` → `v0.32.0` |  |  | | [github.com/riverqueue/river/rivertype](https://redirect.github.com/riverqueue/river) | `v0.31.0` → `v0.32.0` |  |  | | [github.com/samber/slog-logrus/v2](https://redirect.github.com/samber/slog-logrus) | `v2.5.3` → `v2.5.4` |  |  | | [google.golang.org/api](https://redirect.github.com/googleapis/google-api-go-client) | `v0.272.0` → `v0.273.0` |  |  | | [sigs.k8s.io/controller-runtime/tools/setup-envtest](https://redirect.github.com/kubernetes-sigs/controller-runtime) | `v0.0.0-20260318145839-6c9615a2a166` → `v0.0.0-20260324065417-8c5081a9b6ba` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. ##⚠️ Warning These modules are almost certainly going to break everything. They do every time they update. If you update even one repo's OTEL modules, go will then pull in new versions due to [MVS](https://research.swtch.com/vgo-mvs) which will cause your repo to break. All [otel pull requests](https://redirect.github.com/pulls?q=is%3Aopen+is%3Apr+user%3Aovermindtech+archived%3Afalse+label%3Aobservability+) need to be merged basically at the same time, and after all of the modules have been updated to be compatible with each other. ##⚠️ Warning These modules contain database migrations that need to be added manually to our atlas migrations. Check the contents of https://github.com/riverqueue/river/tree/master/rivermigrate/migration before merging this update. --- ### Release Notes <details> <summary>googleapis/google-cloud-go (cloud.google.com/go/auth)</summary> ### [`v0.19.0`](https://redirect.github.com/googleapis/google-cloud-go/blob/HEAD/CHANGES.md#v0190) - bigquery: - Support customer-managed encryption keys. - bigtable: - Improved emulator support. - Support GetCluster. - datastore: - Add general mutations. - Support pointer struct fields. - Support transaction options. - firestore: - Add Transaction.GetAll. - Support document cursors. - logging: - Support concurrent RPCs to the service. - Support per-entry resources. - profiler: - Add config options to disable heap and thread profiling. - Read the project ID from $GOOGLE\_CLOUD\_PROJECT when it's set. - pubsub: - BEHAVIOR CHANGE: Release flow control after ack/nack (instead of after the callback returns). - Add SubscriptionInProject. - Add OpenCensus instrumentation for streaming pull. - storage: - Support CORS. </details> <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)</summary> ### [`v1.41.5`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2024-03-26) [Compare Source](https://redirect.github.com/aws/aws-sdk-go-v2/compare/v1.41.4...v1.41.5) #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime`: [v1.5.0](service/bedrockagentruntime/CHANGELOG.md#v150-2024-03-26) - **Feature**: This release adds support to customize prompts sent through the RetrieveAndGenerate API in Agents for Amazon Bedrock. - `github.com/aws/aws-sdk-go-v2/service/costexplorer`: [v1.37.0](service/costexplorer/CHANGELOG.md#v1370-2024-03-26) - **Feature**: Adds support for backfill of cost allocation tags, with new StartCostAllocationTagBackfill and ListCostAllocationTagBackfillHistory API. - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.154.0](service/ec2/CHANGELOG.md#v11540-2024-03-26) - **Feature**: Documentation updates for Elastic Compute Cloud (EC2). - `github.com/aws/aws-sdk-go-v2/service/ecs`: [v1.41.5](service/ecs/CHANGELOG.md#v1415-2024-03-26) - **Documentation**: This is a documentation update for Amazon ECS. - `github.com/aws/aws-sdk-go-v2/service/finspace`: [v1.24.0](service/finspace/CHANGELOG.md#v1240-2024-03-26) - **Feature**: Add new operation delete-kx-cluster-node and add status parameter to list-kx-cluster-node operation. </details> <details> <summary>getsentry/sentry-go (github.com/getsentry/sentry-go)</summary> ### [`v0.44.1`](https://redirect.github.com/getsentry/sentry-go/releases/tag/v0.44.1): 0.44.1 [Compare Source](https://redirect.github.com/getsentry/sentry-go/compare/v0.44.0...v0.44.1) > \[!NOTE]\ > v0.44.0 had to be released as v0.44.1 due to a technical issue. ##### New Features ✨ - Add RemoveAttribute api on the scope. by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1224](https://redirect.github.com/getsentry/sentry-go/pull/1224) - Deprecate `Scope.SetExtra`, `Scope.SetExtras`, and `Scope.RemoveExtra` in favor of `Scope.SetAttributes` and `Scope.RemoveAttribute` by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1224](https://redirect.github.com/getsentry/sentry-go/pull/1224) - The recommended migration path is to use `SetAttributes` to attach values to logs and metrics. Note that attributes do not appear on error events; if you only capture errors, use `SetTag` or `SetContext` instead. - Before: ```go scope.SetExtra("key.string", "str") scope.SetExtra("key.int", 42) ``` - After (for error events) — use tags and contexts: ```go scope.SetTag("key.string", "str") scope.SetContext("my_data", sentry.Context{"key.int": 42}) ``` - After (for logs and metrics) — use attributes: ```go scope.SetAttributes( attribute.String("key.string", "str"), attribute.Int("key.int", 42), ) ``` - Add support for homogenous arrays by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1203](https://redirect.github.com/getsentry/sentry-go/pull/1203) - Add support for client reports by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1192](https://redirect.github.com/getsentry/sentry-go/pull/1192) - Add org id propagation in sentry\_baggage by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1210](https://redirect.github.com/getsentry/sentry-go/pull/1210) - Add OrgID and StrictTraceContinuation client options. by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1210](https://redirect.github.com/getsentry/sentry-go/pull/1210) - Add the option to set attributes on the scope by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1208](https://redirect.github.com/getsentry/sentry-go/pull/1208) ##### Bug Fixes 🐛 - (serialization) Pre-serialize mutable event fields to prevent race panics by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1214](https://redirect.github.com/getsentry/sentry-go/pull/1214) - Use HEROKU\_BUILD\_COMMIT with HEROKU\_SLUG\_COMMIT as fallback by [@​ericapisani](https://redirect.github.com/ericapisani) in [#​1220](https://redirect.github.com/getsentry/sentry-go/pull/1220) ##### Internal Changes 🔧 ##### Ai - Add AGENTS.md and testing guidelines by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1216](https://redirect.github.com/getsentry/sentry-go/pull/1216) - Add dotagents configuration by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1211](https://redirect.github.com/getsentry/sentry-go/pull/1211) ##### Deps - Bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 in /zerolog by [@​dependabot](https://redirect.github.com/dependabot) in [#​1231](https://redirect.github.com/getsentry/sentry-go/pull/1231) - Bump github.com/gofiber/fiber/v2 from 2.52.11 to 2.52.12 in /fiber by [@​dependabot](https://redirect.github.com/dependabot) in [#​1209](https://redirect.github.com/getsentry/sentry-go/pull/1209) ##### Other - Pin GitHub Actions to full-length commit SHAs by [@​joshuarli](https://redirect.github.com/joshuarli) in [#​1230](https://redirect.github.com/getsentry/sentry-go/pull/1230) - Bump getsentry/craft to 2.24.1 by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1225](https://redirect.github.com/getsentry/sentry-go/pull/1225) - Handle independent go module versions for integrations by [@​giortzisg](https://redirect.github.com/giortzisg) in [#​1217](https://redirect.github.com/getsentry/sentry-go/pull/1217) ### [`v0.44.0`](https://redirect.github.com/getsentry/sentry-go/releases/tag/v0.44.0): 0.44.0 [Compare Source](https://redirect.github.com/getsentry/sentry-go/compare/v0.43.0...v0.44.0) </details> <details> <summary>googleapis/gax-go (github.com/googleapis/gax-go/v2)</summary> ### [`v2.20.0`](https://redirect.github.com/googleapis/gax-go/releases/tag/v2.20.0): v2: v2.20.0 [Compare Source](https://redirect.github.com/googleapis/gax-go/compare/v2.19.0...v2.20.0) ##### Features - hook metric recording into gax.Invoke ([#​494](https://redirect.github.com/googleapis/gax-go/issues/494)) ([1f3e9aef](https://redirect.github.com/googleapis/gax-go/commit/1f3e9aef)) - add TelemetryErrorInfo and ExtractTelemetryErrorInfo ([#​487](https://redirect.github.com/googleapis/gax-go/issues/487)) ([defdded3](https://redirect.github.com/googleapis/gax-go/commit/defdded3)) </details> <details> <summary>harness/harness-go-sdk (github.com/harness/harness-go-sdk)</summary> ### [`v0.7.17`](https://redirect.github.com/harness/harness-go-sdk/compare/v0.7.16...v0.7.17) [Compare Source](https://redirect.github.com/harness/harness-go-sdk/compare/v0.7.16...v0.7.17) </details> <details> <summary>jackc/pgx (github.com/jackc/pgx/v5)</summary> ### [`v5.9.1`](https://redirect.github.com/jackc/pgx/compare/v5.9.0...v5.9.1) [Compare Source](https://redirect.github.com/jackc/pgx/compare/v5.9.0...v5.9.1) ### [`v5.9.0`](https://redirect.github.com/jackc/pgx/compare/v5.8.0...v5.9.0) [Compare Source](https://redirect.github.com/jackc/pgx/compare/v5.8.0...v5.9.0) </details> <details> <summary>nats-io/nats-server (github.com/nats-io/nats-server/v2)</summary> ### [`v2.12.6`](https://redirect.github.com/nats-io/nats-server/releases/tag/v2.12.6) [Compare Source](https://redirect.github.com/nats-io/nats-server/compare/v2.12.5...v2.12.6) #### Changelog Refer to the [2.12 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_212) for backwards compatibility notes with 2.11.x. ##### Go Version - 1.25.8 ##### Dependencies - golang.org/x/crypto v0.49.0 ([#​7953](https://redirect.github.com/nats-io/nats-server/issues/7953)) - github.com/nats-io/jwt/v2 v2.8.1 ([#​7960](https://redirect.github.com/nats-io/nats-server/issues/7960)) - golang.org/x/sys v0.42.0 ([#​7923](https://redirect.github.com/nats-io/nats-server/issues/7923)) - golang.org/x/time v0.15.0 ([#​7923](https://redirect.github.com/nats-io/nats-server/issues/7923)) ##### CVEs - Fixes CVE-2026-33216, CVE-2026-33217, CVE-2026-33215 (affecting systems using MQTT) - Fixes CVE-2026-33246 (affects systems using leafnodes and service imports) - Fixes CVE-2026-33218 (affects systems using leafnodes) - Fixes CVE-2026-33219 (affects systems using WebSockets) - Fixes CVE-2026-33223, CVE-2026-33222 (affects systems using JetStream) - Fixes CVE-2026-33248 (affects systems using mutual TLS) - Fixes CVE-2026-33247 (affects systems providing credentials on the command line) - Fixes CVE-2026-33249 (affects systems where client publish permissions should be restricted) ##### Improved General - Non-WebSocket leafnode connections can now be proxied using HTTP CONNECT ([#​7781](https://redirect.github.com/nats-io/nats-server/issues/7781)) - The `$SYS.REQ.USER.INFO` response now includes the friendly nametag of the account and/or user if known ([#​7973](https://redirect.github.com/nats-io/nats-server/issues/7973)) JetStream - The stream peer-remove command now accepts a peer ID as well as a server name ([#​7952](https://redirect.github.com/nats-io/nats-server/issues/7952)) MQTT - Protocol compliance has been improved, including more error handling on invalid or malformed MQTT packets ([#​7933](https://redirect.github.com/nats-io/nats-server/issues/7933)) ##### Fixed General - Client connections are no longer registered after an auth callout timeout ([#​7932](https://redirect.github.com/nats-io/nats-server/issues/7932)) - Improved handling of duplicate headers - A correctness bug when validating relative distinguished names has been fixed - Secrets are now redacted correctly in trace logging ([#​7942](https://redirect.github.com/nats-io/nats-server/issues/7942)) - The expvar endpoint on the monitoring port now correctly redacts secrets from the command line arguments - Trace headers are no longer incorrectly parsed when hitting max payload ([#​7954](https://redirect.github.com/nats-io/nats-server/issues/7954)) - When running as a Windows service, switching to lame duck mode should now correctly exit the process ([#​7958](https://redirect.github.com/nats-io/nats-server/issues/7958)) - The configuration digest no longer removes from the used variable tracking, which could cause configuration fields to disappear from the returned config ([#​7959](https://redirect.github.com/nats-io/nats-server/issues/7959)) - A bug which could result in the service import cycle detection failing to detect a genuine cycle has been fixed ([#​7961](https://redirect.github.com/nats-io/nats-server/issues/7961)) - The PROXY protocol v1 header parser no longer incorrectly discards some early protocol bytes from the client ([#​7962](https://redirect.github.com/nats-io/nats-server/issues/7962)) - The `Nats-Trace-Dest` message header for message tracing now requires that the client have publish permissions to the specified subject, an error is returned otherwise - The route pool is now correctly populated if receiving a pong before handling the new route setup ([#​7971](https://redirect.github.com/nats-io/nats-server/issues/7971)) Leafnodes - A panic when receiving a loop detection error before a connect message has been fixed - Messages from leafnodes to non-shared service imports now correctly rebuild the request info header - Leafnodes will now back off on receiving a minimum version required error, no longer requiring blocking the readloop ([#​7970](https://redirect.github.com/nats-io/nats-server/issues/7970)) JetStream - Stream updates on clustered setups with async snapshots enabled should no longer result in the loss of consumer assignments, fixing the regression introduced in 2.12.5 ([#​7939](https://redirect.github.com/nats-io/nats-server/issues/7939)) - Fixed idempotent stream create with sources ([#​7928](https://redirect.github.com/nats-io/nats-server/issues/7928)) - Fixed a bug where mirror goroutines could get stuck stalling the mirror indefinitely ([#​7929](https://redirect.github.com/nats-io/nats-server/issues/7929)) - A panic that could occur when attempting to scale down a stream with an in-flight stream create and consumer create has been fixed ([#​7940](https://redirect.github.com/nats-io/nats-server/issues/7940)) - A panic when paginating on various JetStream API endpoints has been fixed - An interior path traversal bug that could occur when purging JetStream accounts has been fixed - Meta snapshot apply errors are now surfaced correctly so that the cluster monitor does not advance the applied index ([#​7944](https://redirect.github.com/nats-io/nats-server/issues/7944)) - Fixed an issue where extremely large JetStream reservations could overflow and violate tier limits - Stream restores now ensure that the stream name in the restore subject matches that of the restored snapshot archive - Stream ingest now correctly strips a NATS status header if present, avoiding incorrect classification of sourced or mirrored messages as control traffic - The Raft layer now resets the vote correctly when switching to candidate state ([#​7956](https://redirect.github.com/nats-io/nats-server/issues/7956)) - The orphan consumer check no longer unexpectedly deletes direct consumers, which could affect sourcing and mirroring ([#​7957](https://redirect.github.com/nats-io/nats-server/issues/7957)) - The Raft layer no longer commits entries from previous terms by only allowing entries from our current term up to the commit ([#​7955](https://redirect.github.com/nats-io/nats-server/issues/7955)) - Stream restores are now processed directly from the wire without intermediate staging on the filesystem, improving the enforcement of limits and reservations on disk - Stream sourcing now works correctly when sourcing into a stream with the Discard New Per Subject discard policy ([#​7896](https://redirect.github.com/nats-io/nats-server/issues/7896)) MQTT - A panic that could occur when processing invalid fixed32 or fixed64 fields has been fixed ([#​7941](https://redirect.github.com/nats-io/nats-server/issues/7941)) - Persisted MQTT sessions can no longer be restored by a non-matching client ID - Restrict the implicit permissions for MQTT clients to `$MQTT.sub.` and `$MQTT.deliver.pubrel.` prefixes - MQTT password are no longer exposed in the JWT field of monitoring endpoints or advisory messages - NATS special characters (`.`, `>`, `*`, spaces, tabs) are no longer permitted in MQTT client IDs - MQTT session flapping detection now uses monotonic time, fixing cases where it could be sensitive to NTP adjustments or clock drifts WebSockets - WebSocket protocol parsing no longer relies on potentially unbounded in-memory allocations from compressed or uncompressed frames ##### Complete Changes </details> <details> <summary>nats-io/nats.go (github.com/nats-io/nats.go)</summary> ### [`v1.50.0`](https://redirect.github.com/nats-io/nats.go/releases/tag/v1.50.0) [Compare Source](https://redirect.github.com/nats-io/nats.go/compare/v1.49.0...v1.50.0) #### Changelog ##### FIXED - Core NATS: - Fix WebSocket close frame discarding buffered data frames ([#​2032](https://redirect.github.com/nats-io/nats.go/issues/2032)) - JetStream: - Remove status listener in Consume()/Messages() cleanup. Thanks [@​txuna](https://redirect.github.com/txuna) for the contribution ([#​1993](https://redirect.github.com/nats-io/nats.go/issues/1993)) - Fix race condition in `orderedSubscription.Drain()` ([#​2030](https://redirect.github.com/nats-io/nats.go/issues/2030)) - Fixed `OrderedConsumer.Consume()` race in handler ([#​2043](https://redirect.github.com/nats-io/nats.go/issues/2043)) ##### IMPROVED - Core NATS: - De-flake TestAlwaysReconnectOnAccountMaxConnectionsExceededErr ([#​2042](https://redirect.github.com/nats-io/nats.go/issues/2042)) - Wrap EOF/connection reset errors with TLS context after handshake ([#​2031](https://redirect.github.com/nats-io/nats.go/issues/2031)) - JetStream: - Reject control characters in stream and consumer names ([#​2038](https://redirect.github.com/nats-io/nats.go/issues/2038)) - Add missing `AccountLimits` fields in `jetstream` package ([#​2041](https://redirect.github.com/nats-io/nats.go/issues/2041)) - Fix flaky TestConsumerPrioritized/messages test ([#​2033](https://redirect.github.com/nats-io/nats.go/issues/2033)) - KeyValue: - Deduplicate keys in KeyValue.Keys() and document ListKeys behavior ([#​2029](https://redirect.github.com/nats-io/nats.go/issues/2029)) - Fix flaky TestKeyValueWithSources ([#​2036](https://redirect.github.com/nats-io/nats.go/issues/2036)) ##### CHANGED - Bump go version to 1.25 and update dependencies ([#​2044](https://redirect.github.com/nats-io/nats.go/issues/2044), [#​2039](https://redirect.github.com/nats-io/nats.go/issues/2039)) ##### Complete Changes </details> <details> <summary>openai/openai-go (github.com/openai/openai-go/v3)</summary> ### [`v3.30.0`](https://redirect.github.com/openai/openai-go/releases/tag/v3.30.0) [Compare Source](https://redirect.github.com/openai/openai-go/compare/v3.29.0...v3.30.0) #### 3.30.0 (2026-03-25) Full Changelog: [v3.29.0...v3.30.0](https://redirect.github.com/openai/openai-go/compare/v3.29.0...v3.30.0) ##### Features - **api:** add keys field to computer action types ([7abb3c4](https://redirect.github.com/openai/openai-go/commit/7abb3c4b4d1fb3d2757dd70c5a201de4190f298a)) ##### Bug Fixes - **api:** align SDK response types with expanded item schemas ([324c584](https://redirect.github.com/openai/openai-go/commit/324c584ec31315ec18c169918e524741e74d395a)) - **types:** generate shared enum types that are not referenced by other schemas ([e2f2920](https://redirect.github.com/openai/openai-go/commit/e2f2920f510348ea8b7e26e6b2460f802d34998c)) - **types:** make Type required, correct enum in ResponseInputMessageItem ([8c2c7a5](https://redirect.github.com/openai/openai-go/commit/8c2c7a59329e95da117ffdde7b36f43e1fbdbacb)) ##### Chores - **ci:** skip lint on metadata-only changes ([40cf884](https://redirect.github.com/openai/openai-go/commit/40cf884295e1631dc637f6e3e1316e8665e5e694)) - **client:** fix multipart serialisation of Default() fields ([06c04ae](https://redirect.github.com/openai/openai-go/commit/06c04aeca47e7348de94573eefbfaf2e110c4573)) - **internal:** support default value struct tag ([f1afb2a](https://redirect.github.com/openai/openai-go/commit/f1afb2ab20307c50da7ec421ac5cd3e5a9c33fe3)) - **internal:** update gitignore ([bde0a0d](https://redirect.github.com/openai/openai-go/commit/bde0a0d3e4a8b63e2ce28fae207f9546abac0722)) - **tests:** bump steady to v0.19.4 ([a0561c3](https://redirect.github.com/openai/openai-go/commit/a0561c3014b5d5fbeee9d7de58dad3f9be9e2d9f)) - **tests:** bump steady to v0.19.5 ([56c5c36](https://redirect.github.com/openai/openai-go/commit/56c5c3631cb1dec68b8cb68c1e03d62e69fe3a70)) - **tests:** bump steady to v0.19.6 ([44ebe37](https://redirect.github.com/openai/openai-go/commit/44ebe3744e70460f2cacd94ccf21957e30d697a1)) - **tests:** bump steady to v0.19.7 ([1b04072](https://redirect.github.com/openai/openai-go/commit/1b04072ef94542b2a0007e4088ef09d4f5387dcf)) ##### Refactors - **tests:** switch from prism to steady ([2185358](https://redirect.github.com/openai/openai-go/commit/21853589203e202637f9ebc7f7be5d4c73f2a471)) </details> <details> <summary>posthog/posthog-go (github.com/posthog/posthog-go)</summary> ### [`v1.11.2`](https://redirect.github.com/PostHog/posthog-go/releases/tag/v1.11.2) [Compare Source](https://redirect.github.com/posthog/posthog-go/compare/v1.11.1...v1.11.2) #### 1.11.2 - 2026-03-26 - [Full Changelog](https://redirect.github.com/PostHog/posthog-go/compare/v1.11.1...v1.11.2) </details> <details> <summary>riverqueue/river (github.com/riverqueue/river)</summary> ### [`v0.32.0`](https://redirect.github.com/riverqueue/river/releases/tag/v0.32.0) [Compare Source](https://redirect.github.com/riverqueue/river/compare/v0.31.0...v0.32.0) ##### Added - `riverlog.Middleware` now supports `MiddlewareConfig.MaxTotalBytes` (default 8 MB) to cap total persisted `river:log` history per job. When the cap is exceeded, oldest log entries are dropped first while retaining the newest entry. Values over 64 MB are clamped to 64 MB. [PR #​1157](https://redirect.github.com/riverqueue/river/pull/1157). ##### Changed - Improved `riverlog` performance and reduced memory amplification when appending to large persisted `river:log` histories. [PR #​1157](https://redirect.github.com/riverqueue/river/pull/1157). - Reduced snooze-path memory amplification by setting `snoozes` in metadata updates before marshaling, avoiding an extra full-payload JSON rewrite. [PR #​1159](https://redirect.github.com/riverqueue/river/pull/1159). - Schema names are now quoted in SQL operations, enabling the use of spaces and other odd characters. [PR #​1175](https://redirect.github.com/riverqueue/river/pull/1175). ##### Fixed - `riverpgxv5` now adapts JSON parameters for `simple protocol` / `exec` query modes so `[]byte` JSON payloads are not encoded as `bytea` in pgx text-mode execution paths. This fixes invalid JSON syntax errors when running through protocol-constrained setups like PgBouncer transaction pooling while preserving normal behavior for explicit `bytea` parameters. Fixes [#​1153](https://redirect.github.com/riverqueue/river/issues/1153). [PR #​1155](https://redirect.github.com/riverqueue/river/pull/1155). </details> <details> <summary>samber/slog-logrus (github.com/samber/slog-logrus/v2)</summary> ### [`v2.5.4`](https://redirect.github.com/samber/slog-logrus/releases/tag/v2.5.4) [Compare Source](https://redirect.github.com/samber/slog-logrus/compare/v2.5.3...v2.5.4) Update dependencies **Full Changelog**: <samber/slog-logrus@v2.5.3...v2.5.4> </details> <details> <summary>googleapis/google-api-go-client (google.golang.org/api)</summary> ### [`v0.273.0`](https://redirect.github.com/googleapis/google-api-go-client/releases/tag/v0.273.0) [Compare Source](https://redirect.github.com/googleapis/google-api-go-client/compare/v0.272.0...v0.273.0) ##### Features - **all:** Auto-regenerate discovery clients ([#​3542](https://redirect.github.com/googleapis/google-api-go-client/issues/3542)) ([a4b4711](https://redirect.github.com/googleapis/google-api-go-client/commit/a4b47110f2ba5bf8bdb32174f26f609615e0e8dc)) - **all:** Auto-regenerate discovery clients ([#​3546](https://redirect.github.com/googleapis/google-api-go-client/issues/3546)) ([0cacfa8](https://redirect.github.com/googleapis/google-api-go-client/commit/0cacfa8557f0f7d21166c4dfef84f60c6d9f1a49)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 10am on friday" in timezone Europe/London, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuOTEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIiwib2JzZXJ2YWJpbGl0eSJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 00f09d44c3be5a5b85df63cd59a98985cc2ae721
…440) Depends on https://github.com/overmindtech/workspace/pull/4438 ## Summary Adds an `area51 export-archive` command to download production/dogfood `ChangeArchive` data (protojson format), and hardens both CLIs against credential exfiltration via untrusted `--app`/`--change` URLs. ### New command: `area51 export-archive` - Downloads a full change archive by URL (`--change`) or UUID (`--uuid`) - Supports OAuth device flow and API key authentication (`--api-key` / `OVM_API_KEY`) - Writes output with `0600` permissions to prevent other users from reading production data - Blocks cross-origin redirects to prevent bearer token leakage - Caps error response body reads to 64 KiB to prevent memory exhaustion from malicious servers ### Security: trusted host validation (shared libraries) Addresses the SSRF-style credential exfiltration vector where a crafted `--change` or `--app` URL could send API keys/OAuth tokens to attacker-controlled hosts. **`go/sdp-go`:** - New `IsTrustedHost(host)` — validates against `*.overmind.tech`, `*.overmind-demo.com`, and localhost (case-insensitive, port-aware) - New `ValidateAppURL(url)` — enforces HTTPS for all non-localhost hosts - `NewOvermindInstance` now calls `ValidateAppURL`, rejecting `http://` for remote targets **`go/cliauth`:** - New `ConfirmUntrustedHost(appURL, hasAPIKey, stdin, writer)` — shared interactive `[y/N]` prompt that warns users before sending credentials to non-Overmind domains, with explicit mention of API key exposure when relevant **Both CLIs (`cli/cmd/root.go` + `tools/area51-cli/cmd/export_archive.go`):** - Call `cliauth.ConfirmUntrustedHost` before instance discovery, blocking the flow where a crafted URL exfiltrates credentials ### Files changed | Area | Files | What | | --- | --- | --- | | Shared: sdp-go | `host_trust.go`, `host_trust_test.go`, `instance_detect.go` | Trusted host validation, HTTPS enforcement | | Shared: cliauth | `cliauth.go`, `cliauth_test.go` | Untrusted host confirmation prompt | | Public CLI | `cli/cmd/root.go` | Trust check in `login()` gateway | | Area51 CLI | `cmd/export_archive.go`, `cmd/export_archive_test.go`, `cmd/auth.go`, `cmd/root.go` | New export-archive command with trust check | | Docs | `tools/area51-cli/README.md`, `.gitignore` | Usage docs and ignore built binary | ## Test plan - [x] `go test ./go/sdp-go/` — 37 cases for `IsTrustedHost`, `IsLocalHost`, `ValidateAppURL` (including suffix-bypass attempts) - [x] `go test ./go/cliauth/` — 11 cases for `ConfirmUntrustedHost` (trusted skip, y/yes/YES/n/empty/other, API key warning) - [x] `go test ./tools/area51-cli/cmd/` — parseChangeURL, download permissions, cross-origin redirect blocking - [x] `go build ./cli/...` and `go build ./tools/area51-cli/...` — both compile cleanly <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches authentication/credential-handling paths and adds a new production-data export command; mistakes could leak credentials or allow unintended network targets despite the added safeguards. > > **Overview** > Adds a new `area51 export-archive` CLI command to download protojson `ChangeArchive` data by change URL or UUID, supporting OAuth device flow or API key auth and writing outputs with `0600` permissions. > > Hardens both the public `overmind` CLI and `area51` CLI against credential exfiltration by introducing trusted-host checks (`sdp.IsTrustedHost`), enforcing HTTPS for non-local targets (`sdp.ValidateAppURL` used by `NewOvermindInstance`), prompting on untrusted hosts (`cliauth.ConfirmUntrustedHost`), and blocking cross-origin redirects on authenticated HTTP clients. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 0bf77bdd51136e58cf2e401aca95a2dfe04ecf51. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: David Schmitt <david.schmitt@overmind.tech> GitOrigin-RevId: 34b1ef18d86892017d9d5e667d784fb4a7e4fdde
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [aws](https://registry.terraform.io/providers/hashicorp/aws) ([source](https://redirect.github.com/hashicorp/terraform-provider-aws)) | required_provider | minor | `6.37.0` → `6.38.0` | | [google](https://registry.terraform.io/providers/hashicorp/google) ([source](https://redirect.github.com/hashicorp/terraform-provider-google)) | required_provider | minor | `7.24.0` → `7.25.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>hashicorp/terraform-provider-aws (aws)</summary> ### [`v6.38.0`](https://redirect.github.com/hashicorp/terraform-provider-aws/blob/HEAD/CHANGELOG.md#6380-March-25-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-aws/compare/v6.37.0...v6.38.0) FEATURES: - **New Action:** `aws_dms_start_replication_task_assessment_run` ([#​47058](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47058)) - **New Data Source:** `aws_dynamodb_backups` ([#​47036](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47036)) - **New Data Source:** `aws_msk_topic` ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - **New Data Source:** `aws_savingsplans_offerings` ([#​47081](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47081)) - **New List Resource:** `aws_msk_cluster` ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - **New List Resource:** `aws_msk_serverless_cluster` ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - **New List Resource:** `aws_msk_topic` ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - **New List Resource:** `aws_route53_resolver_rule` ([#​47063](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47063)) - **New List Resource:** `aws_sagemaker_algorithm` ([#​47051](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47051)) - **New List Resource:** `aws_ssm_document` ([#​46974](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46974)) - **New List Resource:** `aws_ssoadmin_account_assignment` ([#​47067](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47067)) - **New List Resource:** `aws_vpc_endpoint` ([#​46977](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46977)) - **New List Resource:** `aws_workmail_domain` ([#​46931](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46931)) - **New Resource:** `aws_msk_topic` ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - **New Resource:** `aws_observabilityadmin_telemetry_enrichment` ([#​47089](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47089)) - **New Resource:** `aws_sagemaker_algorithm` ([#​47051](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47051)) - **New Resource:** `aws_workmail_default_domain` ([#​46931](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46931)) - **New Resource:** `aws_workmail_domain` ([#​46931](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46931)) ENHANCEMENTS: - data-source/aws\_networkfirewall\_firewall\_policy: Add `firewall_policy.enable_tls_session_holding` attribute ([#​47065](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47065)) - resource/aws\_bedrockagentcore\_agent\_runtime: Add `authorizer_configuration.custom_jwt_authorizer.custom_claim` configuration block ([#​47049](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47049)) - resource/aws\_bedrockagentcore\_gateway: Add `authorizer_configuration.custom_jwt_authorizer.custom_claim` configuration block ([#​47049](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47049)) - resource/aws\_bedrockagentcore\_gateway\_target: Add `target_configuration.mcp.api_gateway` configuration block ([#​46916](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46916)) - resource/aws\_dynamodb\_table: Add `restore_backup_arn` argument ([#​47068](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47068)) - resource/aws\_fis\_experiment\_template: Support `KinesisStreams` as a value for `action.target.key` ([#​47010](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47010)) - resource/aws\_fis\_experiment\_template: Support `VPCEndpoints` as a value for `action.target.key` ([#​47045](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47045)) - resource/aws\_mq\_broker: Change `user` block to Optional ([#​46883](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46883)) - resource/aws\_msk\_cluster: Add resource identity support ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - resource/aws\_msk\_serverless\_cluster: Add resource identity support ([#​46490](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46490)) - resource/aws\_networkfirewall\_firewall\_policy: Add `firewall_policy.enable_tls_session_holding` argument ([#​47065](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47065)) - resource/aws\_securityhub\_insight: Add `filters.aws_account_name` configuration block ([#​47027](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47027)) - resource/aws\_securityhub\_insight: Add `filters.compliance_associated_standards_id` configuration block ([#​47027](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47027)) - resource/aws\_securityhub\_insight: Add `filters.compliance_security_control_id` configuration block ([#​47027](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47027)) - resource/aws\_securityhub\_insight: Add `filters.compliance_security_control_parameters_name` configuration block ([#​47027](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47027)) - resource/aws\_securityhub\_insight: Add `filters.compliance_security_control_parameters_value` configuration block ([#​47027](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47027)) - resource/aws\_ssoadmin\_account\_assignment: Add Resource Identity support ([#​47067](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47067)) BUG FIXES: - resource/aws\_api\_gateway\_method: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_apigatewayv2\_integration: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_apigatewayv2\_route: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_apigatewayv2\_stage: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_appmesh\_gateway\_route: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_appmesh\_route: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_appmesh\_virtual\_gateway: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_appmesh\_virtual\_node: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_appmesh\_virtual\_router: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_appmesh\_virtual\_service: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_cloudfront\_distribution\_tenant: Fix panic when managed certificate is not found during creation ([#​46982](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46982)) - resource/aws\_controltower\_control: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_default\_route\_table: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_gateway\_association: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_hosted\_private\_virtual\_interface: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_hosted\_private\_virtual\_interface\_accepter: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_hosted\_public\_virtual\_interface: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_hosted\_public\_virtual\_interface\_accepter: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_hosted\_transit\_virtual\_interface: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_hosted\_transit\_virtual\_interface\_accepter: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_private\_virtual\_interface: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_public\_virtual\_interface: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_dx\_transit\_virtual\_interface: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_ecs\_express\_gateway\_service: Fix `Provider produced inconsistent result after apply` error when `environment` variables are defined in non-alphabetical order ([#​46771](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46771)) - resource/aws\_elasticache\_reserved\_cache\_node: Fix `Provider returned invalid result object after apply` errors where computed attributes remained unknown after create ([#​47012](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47012)) - resource/aws\_kinesis\_stream: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_mq\_broker: Fix non-idempotent behavior for RabbitMQ brokers with `user` block ([#​46883](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46883)) - resource/aws\_network\_acl: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_network\_interface\_sg\_attachment: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_opensearch\_domain: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_route53recoverycontrolconfig\_routing\_control: Fix panic on concurrent creates when API returns ConflictException ([#​47038](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47038)) - resource/aws\_route\_table\_association: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_serverlessapplicationrepository\_cloudformation\_stack: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_servicecatalog\_product: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_ses\_active\_receipt\_rule\_set: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_ssm\_default\_patch\_baseline: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_vpc\_dhcp\_options\_association: Fix import to honor `@region` suffix when using resource-level `region` attribute ([#​47043](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47043)) - resource/aws\_wafv2\_web\_acl\_rule: Fix `Unable to unmarshal DynamicValue` error when `statement.managed_rule_group_statement.rule_action_override` block is specified ([#​46998](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/46998)) - resource/aws\_wafv2\_web\_acl\_rule\_group\_association: Fix `WAFOptimisticLockException` errors when multiple associations target the same Web ACL ([#​47037](https://redirect.github.com/hashicorp/terraform-provider-aws/issues/47037)) </details> <details> <summary>hashicorp/terraform-provider-google (google)</summary> ### [`v7.25.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7250-Unreleased) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.24.0...v7.25.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 10am on friday" in timezone Europe/London, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45MS41IiwidXBkYXRlZEluVmVyIjoiNDMuOTEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwidGVycmFmb3JtIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 490523fcf2a01ced2265937b6b3ca41a169568b2
## Summary - Bumps `github.com/buger/jsonparser` from v1.1.1 to v1.1.2 to fix CVE-2026-32285 (GO-2026-4514) — uncaught exception in `Delete()` on malformed JSON input - The `google.golang.org/grpc` vulnerability (CVE-2026-33186) was already resolved; go.mod has v1.79.3 which is the fix version ## Linear Ticket - **Ticket**: [ENG-3461](https://linear.app/overmind/issue/ENG-3461/snyk-vulnerabilities-for-march-30th) — Snyk vulnerabilities for March 30th - **Purpose**: Resolve High/Critical Snyk findings for the weekly vulnerability check - **Priority**: Urgent ## Changes - `go.mod`: `github.com/buger/jsonparser` v1.1.1 → v1.1.2 (indirect dependency) - `go.sum`: Updated checksums for jsonparser v1.1.2 ## Vulnerability Details | CVE | Package | Severity | Fix | | --- | --- | --- | --- | | CVE-2026-33186 | `google.golang.org/grpc` | Critical (9.3) | Already at v1.79.3 | | CVE-2026-32285 | `github.com/buger/jsonparser` | High (8.7) | Bumped to v1.1.2 | ## Deviations from Approved Plan > No approved plan is associated with this PR. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Low risk dependency bump with no application code changes; main risk is minor behavioral differences in JSON parsing under malformed inputs. > > **Overview** > Updates the indirect dependency `github.com/buger/jsonparser` from `v1.1.1` to `v1.1.2` in `go.mod`, with corresponding `go.sum` checksum updates. > > This is a dependency-only change intended to pick up the upstream security fix for malformed JSON handling (CVE-2026-32285). > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit f5bf71f97b5e748b4bc2d271755e788d18413e20. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> GitOrigin-RevId: 03de4a0e9f9426a31d892195dfe2799690a79e5f
tphoney
approved these changes
Mar 30, 2026
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"><source](https://cursor.com/assets/images/open-in-cursor-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-cursor-light.png"><img](https://cursor.com/assets/images/open-in-cursor-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div](https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara Sync - Release v1.17.3
This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.
Original author: David Schmitt (david.schmitt@overmind.tech)
What happens when this PR is merged?
tag-on-mergeworkflow will automatically create thev1.17.3tag on mainReview Checklist