Bump EmbarkStudios/cargo-deny-action from b66acf5e9fe20f8aba065be86778a8a4c846f902 to 3c6349835b2b7b196a839186cb8b78e02f7b5f25 - #7
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/github_actions/EmbarkStudios/cargo-deny-action-3c6349835b2b7b196a839186cb8b78e02f7b5f25
branch
from
September 3, 2026 17:07
06f307c to
e266268
Compare
Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from b66acf5e9fe20f8aba065be86778a8a4c846f902 to 3c6349835b2b7b196a839186cb8b78e02f7b5f25. - [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases) - [Commits](EmbarkStudios/cargo-deny-action@b66acf5...3c63498) --- updated-dependencies: - dependency-name: EmbarkStudios/cargo-deny-action dependency-version: 3c6349835b2b7b196a839186cb8b78e02f7b5f25 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/EmbarkStudios/cargo-deny-action-3c6349835b2b7b196a839186cb8b78e02f7b5f25
branch
from
September 4, 2026 15:13
e266268 to
8fc7b31
Compare
Author
|
Superseded by #15. |
dependabot
Bot
deleted the
dependabot/github_actions/EmbarkStudios/cargo-deny-action-3c6349835b2b7b196a839186cb8b78e02f7b5f25
branch
September 4, 2026 15:56
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
…e HyperDX door Review findings #7, #63, #109, #14. The probe's ServiceAccount holds `workspaces: patch` for the dry-run in `sec.agent.spec`, which RBAC reads as "may rewrite any Workspace spec" and nothing refused; it now matches the agent's spec-is-read-only policy, whose carve-outs it has no use for, so every spec write of its own is denied. `endpoints: delete` was in the agent's rules with no row in the table that IS the role: the intercept controller deletes the legacy Endpoints object Kubernetes abandons for an intercepted Service. The admission DELETE fence already pins it to ws-/wt-/env- namespaces beside pods and services. The `kloudlite-slo-drill` Role and binding granted delete on every pod in kube-system, the agent DaemonSet's included, for a dead-node drill that is a hard skip; both are gone and the header says why. The `serviceaccounts: impersonate` grant stays until the probe change in batch 2.3 replaces it, and now says so. The `deployments` row the roll guard needs was missing from the table. The HyperDX ingress carried no rate limit and no source restriction: it takes the app ingress's 50 r/s and 5x burst, plus a whitelist on the operator CIDR. The value is a literal — helm substitutes nothing — so it ships as env.example.sh's placeholder and must be set before installing.
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
Review findings #6, #7, #11, #15, #16, #18, #80, #81, #129. Every fix here is one shape: a read that failed was being turned into a value somebody then acted on. A stat that errored listed an image as empty; a visibility read that errored flipped a public repo out of every listing; a body read that errored told the pusher their pack had holes. They now skip, and say what happened. Alongside them: poisoned mutexes recover instead of wedging the node (`LockOrRecover`), accepted peer streams get the dead-peer bounds the dialling side already had, the stranded-merge lane paces whatever its scan found, `remove_protection` validates its pattern like `set` does, a marker's description can no longer forge the fields after it, a blank or too-short `KLOUDLITE_JWT_SECRET` refuses the boot by name instead of panicking, and `head_target` has no `unwrap`.
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
Review findings #3, #4, #5, #6, #7, #8, #9, #12, #15, #18, #19, #20, #82. No listing here had a ceiling. `_catalog` stat-ed every unmarked image an owner had to answer a page of two; `referrers` read every signature of a subject on every pull of it; `api_refs`, `volumes`, `volumehistory` and `index::list` each answered whatever was there. Each now takes `?n=`, pages with the object store's own start-after where it has one, and says so with a `Link`. `api_files` reads a size only when asked for one, and `check_repo` scans as far as it can act and no further. The ownership map's own bounds: a map write times out inside the lease that authorised it rather than at it, the epoch is re-checked after every bounded write, a prune pass gets one lease TTL as a whole instead of one per entry, `all()` scans without the role lock held, and a clock reading before a compiled-in floor decides nothing at all — it would have read every live lease as expired and granted every repo away from its owner. Also: the three image write routes get a body limit, and a by-tag push hashes sha512 only for an image that actually holds a sha512 manifest. `deepen-not` lists the repo's refs once and resolves a shorthand under git's own prefixes, not by whichever ref happens to end in that name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps EmbarkStudios/cargo-deny-action from b66acf5e9fe20f8aba065be86778a8a4c846f902 to 3c6349835b2b7b196a839186cb8b78e02f7b5f25.
Commits