Repository navigation
Conversation
- Move the GHCR and Docker Hub logins ahead of the build in publish.yml so credential problems fail fast instead of after the long build and smoke/scan stages. - Upgrade perl-base alongside libpcre2-8-0 in the runtime image to pick up the fixed package. - Document the required DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets and how to recover from Docker Hub "unauthorized" errors. - Add a regression test asserting both logins precede the candidate build.
- Bump version to 1.6.1 across packages, lockfile, OpenAPI, Helm chart, Dockerfile labels, health endpoint and UI header. - Update zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5); backend imports move to "zod/v3" so validation behaviour is unchanged. - Pin @azure/msal-node to 7.1.1 via npm override (GHSA-xcx6-jx8p-x3h5); refresh @azure/identity, body-parser, fast-uri, iconv-lite and others. - Publish only <version>, latest, batteries-<version> and batteries tags; drop major, minor and commit-SHA tag families. - Add a clean-install check (git archive export, cold npm cache) to CI, and gate image publishing on it in the release workflow.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Backend schemas still use the vulnerable zod/v3 parser, which processes every element in oversized arrays despite .max() failures, leaving the critical resource-exhaustion issue unresolved by the package upgrade.
1 open issue
What changed in this PR
Prepares Pabawi 1.6.1 with dependency updates, consistent release metadata, and stricter container publishing checks.
Changes:
- Refreshes dependencies and updates backend imports to Zod’s v3 compatibility API.
- Adds cold-cache source-install checks, moves registry authentication before builds, and simplifies release tags.
- Updates version metadata, release notes, deployment guidance, and workflow tests.
| File | Description |
|---|---|
| scripts/deployment/docker-images.test.mjs | Tests release tags and authentication order. |
| package.json | Bumps version and overrides MSAL dependency. |
| package-lock.json | Records refreshed dependencies and versions. |
| frontend/src/components/Navigation.svelte | Displays version 1.6.1. |
| frontend/package.json | Bumps frontend version. |
| docs/openapi.yaml | Updates API version metadata. |
| docs/deployment/docker.md | Documents registry credentials and publishing checks. |
| Dockerfile.ubuntu | Updates image version label. |
| Dockerfile.alpine | Updates image version label. |
| Dockerfile | Updates version label and upgrades perl-base. |
| charts/pabawi/Chart.yaml | Updates application version. |
| CHANGELOG.md | Records security and release-process changes. |
| backend/test/security/jazzy-launching-wombat-regressions.test.ts | Uses Zod v3 compatibility import. |
| backend/test/properties/config/secret-validation.property.test.ts | Uses compatible Zod error class. |
| backend/src/validation/rbacSchemas.ts | Uses Zod v3 for RBAC schemas. |
| backend/src/validation/commonSchemas.ts | Uses Zod v3 for shared schemas. |
| backend/src/utils/errorHandling.ts | Uses compatible Zod error class. |
| backend/src/services/PuppetExecution.ts | Uses Zod v3 for Puppet validation. |
| backend/src/services/journal/types.ts | Uses Zod v3 for journal schemas. |
| backend/src/services/ExecutionDispatcher.ts | Uses Zod v3 for execution validation. |
| backend/src/server.ts | Updates health endpoint version. |
| backend/src/routes/users.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/tasks.ts | Uses Zod v3 validation. |
| backend/src/routes/streaming.ts | Uses Zod v3 validation. |
| backend/src/routes/setup.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/roles.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/puppetHistory.ts | Uses Zod v3 validation. |
| backend/src/routes/puppet.ts | Uses Zod v3 validation. |
| backend/src/routes/playbooks.ts | Uses Zod v3 validation. |
| backend/src/routes/playbookBrowser.ts | Uses Zod v3 validation. |
| backend/src/routes/permissions.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/packages.ts | Uses Zod v3 validation. |
| backend/src/routes/ldapAdministration.ts | Uses Zod v3 validation. |
| backend/src/routes/journal.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/inventory.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/utils.ts | Uses Zod v3 in integration helpers. |
| backend/src/routes/integrations/puppetserver.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/puppetdb.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/proxmox.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/monitoringOverview.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/monitoringActions.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/monitoring.ts | Uses Zod v3 validation. |
| backend/src/routes/integrations/azure.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/integrations/aws.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/hiera.ts | Uses Zod v3 validation. |
| backend/src/routes/groups.ts | Uses Zod v3 schemas and errors. |
| backend/src/routes/facts.ts | Uses Zod v3 validation. |
| backend/src/routes/executions.ts | Uses Zod v3 validation. |
| backend/src/routes/entraIdAuth.ts | Uses Zod v3 validation. |
| backend/src/routes/debug.ts | Uses Zod v3 validation. |
| backend/src/routes/crashDumps.ts | Uses Zod v3 validation. |
| backend/src/routes/console.ts | Uses Zod v3 validation. |
| backend/src/routes/commands.ts | Uses Zod v3 validation. |
| backend/src/routes/auth.ts | Uses Zod v3 schemas and errors. |
| backend/src/mcp/McpToolHandlers.ts | Uses Zod v3 for tool schemas. |
| backend/src/mcp/McpServer.ts | Uses compatible Zod schema types. |
| backend/src/integrations/ssh/hostTrust.ts | Uses Zod v3 for trust validation. |
| backend/src/config/schema.ts | Uses Zod v3 for configuration schemas. |
| backend/src/config/ldap.ts | Uses Zod v3 for LDAP schemas. |
| backend/src/config/ConfigService.ts | Uses Zod v3 configuration validation. |
| backend/package.json | Bumps backend version and upgrades Zod. |
| .github/workflows/publish.yml | Gates publishing on clean installation; simplifies tags and moves logins earlier. |
| .github/workflows/ci.yml | Adds cold-cache source-archive installation check. |
Review effort: Balanced
|
|
||
| import { Router, type Request, type Response } from 'express'; | ||
| import { z } from 'zod'; | ||
| import { z } from "zod/v3"; |
Member
Author
|
@copilot-pull-request-reviewer Fixing. Will be in the next commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.