Bump actions/attest-build-provenance from 3.0.0 to 4.2.2 - #8
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/attest-build-provenance-4.2.2
branch
from
September 3, 2026 17:07
f0900bd to
8f14afb
Compare
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 3.0.0 to 4.2.2. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@977bb37...4d10147) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/attest-build-provenance-4.2.2
branch
from
September 4, 2026 15:13
8f14afb to
2e20a3a
Compare
Author
|
Superseded by #15. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/attest-build-provenance-4.2.2
branch
September 4, 2026 15:56
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
…olved, and a failed patch puts back what it wrote Review findings #8, #9, #10, #43–#51, #93. - `exec`'s job half read both streams with `read_to_end`: a command that printed without bound was the pod's memory. Both go through the same 4 MiB `Ring` a detached process uses, and `truncated` is what the ring dropped. - `/fs/stat` read a whole file to sniff 8 KiB of it, and `grep` read every entry before deciding it was too large; both are bounded now. - `confine` answers the RESOLVED path, so what was checked is what the caller opens — a symlink swapped after the check cannot redirect a write. - A non-string argv entry was dropped silently, which shifted every argument after it; one helper in `tools/mod.rs` refuses it for `exec` and `watch`. - `/fs/changes` walked git status twice for one answer; `numstat` takes the caller's changes. - `Registry` rebuilt every set's schemas on every call to find one name; the index is built once. - `patch` restores the files it already wrote when a later write or delete fails, as `edit` does, and the temp name carries the pid and a counter. - `process_write` holds stdin behind an async mutex: a concurrent second write waits instead of being told the process takes no more input. - Graft: a timed-out call drops its pending entry, the tree watcher uses `is_ignored_dir`, `which` checks the executable bit, the child's `tools/list` is compared once against the copied schema table, and the dead lines go. - An explicit body limit on the router: axum's 2 MiB default refused a write the file tools themselves accept.
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
Review findings #3, #4, #5, #6, #7, #8, #9, #12, #15, #18, #19, #20, #82. No listing here had a ceiling. `_catalog` stat-ed every unmarked image an owner had to answer a page of two; `referrers` read every signature of a subject on every pull of it; `api_refs`, `volumes`, `volumehistory` and `index::list` each answered whatever was there. Each now takes `?n=`, pages with the object store's own start-after where it has one, and says so with a `Link`. `api_files` reads a size only when asked for one, and `check_repo` scans as far as it can act and no further. The ownership map's own bounds: a map write times out inside the lease that authorised it rather than at it, the epoch is re-checked after every bounded write, a prune pass gets one lease TTL as a whole instead of one per entry, `all()` scans without the role lock held, and a clock reading before a compiled-in floor decides nothing at all — it would have read every live lease as expired and granted every repo away from its owner. Also: the three image write routes get a body limit, and a by-tag push hashes sha512 only for an image that actually holds a sha512 manifest. `deepen-not` lists the repo's refs once and resolves a shorthand under git's own prefixes, not by whichever ref happens to end in that name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/attest-build-provenance from 3.0.0 to 4.2.2.
Release notes
Sourced from actions/attest-build-provenance's releases.
... (truncated)
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)a2bbfa2bump actions/attest from 4.0.0 to 4.1.0 (#838)0856891update RELEASE.md docs (#836)