Bump the images group across 2 directories with 4 updates - #14
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the images group across 2 directories with 4 updates#14dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
This was referenced Sep 4, 2026
dependabot
Bot
force-pushed
the
dependabot/docker/images-f065ea9200
branch
6 times, most recently
from
September 10, 2026 19:53
a4d5a0f to
9b88d7d
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dependabot
Bot
force-pushed
the
dependabot/docker/images-f065ea9200
branch
4 times, most recently
from
September 11, 2026 17:29
f66148d to
778e10e
Compare
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
…e HyperDX door Review findings #7, #63, #109, #14. The probe's ServiceAccount holds `workspaces: patch` for the dry-run in `sec.agent.spec`, which RBAC reads as "may rewrite any Workspace spec" and nothing refused; it now matches the agent's spec-is-read-only policy, whose carve-outs it has no use for, so every spec write of its own is denied. `endpoints: delete` was in the agent's rules with no row in the table that IS the role: the intercept controller deletes the legacy Endpoints object Kubernetes abandons for an intercepted Service. The admission DELETE fence already pins it to ws-/wt-/env- namespaces beside pods and services. The `kloudlite-slo-drill` Role and binding granted delete on every pod in kube-system, the agent DaemonSet's included, for a dead-node drill that is a hard skip; both are gone and the header says why. The `serviceaccounts: impersonate` grant stays until the probe change in batch 2.3 replaces it, and now says so. The `deployments` row the roll guard needs was missing from the table. The HyperDX ingress carried no rate limit and no source restriction: it takes the app ingress's 50 r/s and 5x burst, plus a whitelist on the operator CIDR. The value is a literal — helm substitutes nothing — so it ships as env.example.sh's placeholder and must be set before installing.
Bumps the images group with 2 updates in the / directory: debian and alpine. Bumps the images group with 2 updates in the /web directory: oven/bun and node. Updates `debian` from `abd67ff` to `8820086` Updates `alpine` from 3.20 to 3.24 Updates `oven/bun` from 1.3.14 to 1.4.2 Updates `node` from 22-bookworm-slim to 26-bookworm-slim --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: images - dependency-name: debian dependency-version: bookworm-slim dependency-type: direct:production dependency-group: images - dependency-name: node dependency-version: 26-bookworm-slim dependency-type: direct:production dependency-group: images - dependency-name: oven/bun dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: images ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/docker/images-f065ea9200
branch
from
September 12, 2026 04:45
778e10e to
21559f9
Compare
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
…all say so #57 the settings roll's error was dropped on the floor and every save audited as "ok"; #58 one unreachable region 500ed the whole Clusters list; #59 the schema's env column reads this process's environment, not the reader's; #14 the workspace lookup's own superadmin arm skipped may_act_on and so left no superadmin.acting line; #21 /v1/volumes?owner= authorized with may_act_on, which made the listing wider than every delete rule on the same volumes.
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
Review findings #9, #10, #13, #14, #25, #26, #83-#89. The mongo client had no timeout of any kind: connect, server selection and every query now carry one, and `max_time` is a SERVER-side ceiling, so a query the api walked away from stops rather than running on. Every listing takes a limit. `credentials_for` gets the compound index its own query shape needs — Cosmos will not combine three single-field ones — and the fingerprint repair runs once per cluster behind a `meta` sentinel rather than as an unindexed regex scan on every connect, forever. `remove_superadmin` is a compare-and-swap: two concurrent removes each saw two administrators and each deleted one, leaving a cluster nobody could administer. The delete now counts what is left and puts the row back, exactly as it was, if it emptied the roster. Both superadmin writes record the audit row BEFORE the effect, and refuse when it cannot be written. Argv and paths: `kl` takes `--` before a context or a source ref and creates its buildx metadata file instead of naming a guessable one in /tmp; `kl-connect` percent-encodes a target into the path, reads `$HOSTNAME` instead of forking, and names `kl-connect` in the PATH note it always got wrong. The gateway checks a workspace id is a DNS label before it becomes part of a kube API URL and splits each tunnel frame out of a `BytesMut` rather than allocating one. The worker's heartbeat goes through `tokio::fs`, and `KLOUDLITE_MERGE_CACHE_BYTES` is a real variable now rather than a constant that only looked like one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Cooldown could not be applied because no publication date was available from the registry.
Bumps the images group with 2 updates in the / directory: debian and alpine.
Bumps the images group with 2 updates in the /web directory: oven/bun and node.
Updates
debianfromabd67ffto8820086Updates
alpinefrom 3.20 to 3.24Updates
oven/bunfrom 1.3.14 to 1.4.2Updates
nodefrom 22-bookworm-slim to 26-bookworm-slim