chore: replace docker with moby#3047
Merged
Merged
chore: replace docker with moby#3047
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
rafanaskin
force-pushed
the
vuln-docker
branch
2 times, most recently
from
April 6, 2026 23:58
5e6bafb to
6d20ecd
Compare
rafanaskin
marked this pull request as ready for review
April 6, 2026 23:58
Contributor
There was a problem hiding this comment.
Pull request overview
This PR replaces the vulnerable Docker client library with Moby submodules to address Go security vulnerabilities. The refactoring updates three test files to use the new API, removes the old Docker dependency entirely, and updates module dependencies.
Changes:
- Replaced
github.com/docker/dockerpackage withgithub.com/moby/moby/clientandgithub.com/moby/moby/api - Updated Docker client initialization and API calls across test fixtures for PostgreSQL, MySQL, and main application tests
- Updated port handling from
nat.Porttonetwork.Portwith parsed port constants - Updated
go.modandgo.sumto reflect dependency changes - Added security note to CHANGELOG documenting the vulnerability fix
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| pkg/testfixtures/storage/postgres.go | Updated Docker client API calls and imports; added postgresPort constant |
| pkg/testfixtures/storage/mysql.go | Updated Docker client API calls and imports; added mySQLPort constant |
| cmd/openfga/main_test.go | Updated Docker client API calls and imports; added port constants for container configuration |
| go.mod | Removed docker/docker dependency, added moby/moby submodule dependencies |
| go.sum | Updated dependency checksums for the Docker→Moby migration |
| CHANGELOG.md | Added security fix note in Unreleased section |
Comments suppressed due to low confidence (1)
cmd/openfga/main_test.go:130
- Local variables
httpPortandgrpcPortshadow the global variables defined at lines 27-28, which have different types. The globals arenetwork.Portobjects used for container port configuration, while the locals are strings representing actual port bindings. This naming conflict is confusing and error-prone. Consider renaming the local variables (e.g.,httpHostPort,grpcHostPort) to distinguish them from the configuration objects.
m, ok := ports[httpPort]
if !ok || len(m) == 0 {
t.Fatalf("failed to get HTTP host port mapping from openfga container")
}
httpPort := m[0].HostPort
m, ok = ports[grpcPort]
if !ok || len(m) == 0 {
t.Fatalf("failed to get grpc host port mapping from openfga container")
}
grpcPort := m[0].HostPort
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3047 +/- ##
==========================================
+ Coverage 90.73% 90.89% +0.16%
==========================================
Files 191 193 +2
Lines 20910 21310 +400
==========================================
+ Hits 18971 19367 +396
- Misses 1288 1290 +2
- Partials 651 653 +2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
Author
|
Hey, I don't have permission to view the |
Contributor
|
Tagging @adriantam and @justincoh to help you out with this @rafanaskin. We have been tracking this problem internally as well. |
Contributor
|
@rafanaskin I'm able to see the issue; It looks like it may have been a flakey error on Snyk's side. I'm unable to retrigger Snyk via PR Could you push another commit to kick off the build again? |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughReplaced test-only Docker client ( Changes
Sequence Diagram(s)(Skipped — changes are dependency/client migration and do not introduce a new multi-component control flow requiring visualization.) Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
Hi @justincoh, I've pushed a new commit to trigger the build again. |
Contributor
|
@rafanaskin Identical nondescript error. I'll take a look at our Snyk setup and get back to you. |
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
pkg/testfixtures/storage/mysql.go (1)
78-82:⚠️ Potential issue | 🟡 MinorClose the image-pull stream.
ImagePullreturns anImagePullResponse, which embedsio.ReadCloser. When consuming the response viaio.Reader(as this code does withio.Copy), the Moby SDK requires callers to invokeClose()to release the underlying HTTP connection. Without it, the connection leaks.♻️ Proposed fix
reader, err := dockerClient.ImagePull(context.Background(), mySQLImage, client.ImagePullOptions{}) require.NoError(t, err) _, err = io.Copy(io.Discard, reader) // consume the image pull output to make sure it's done + closeErr := reader.Close() require.NoError(t, err) + require.NoError(t, closeErr)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/testfixtures/storage/mysql.go` around lines 78 - 82, The ImagePull response (reader) is an io.ReadCloser and must be closed to avoid leaking the HTTP connection; after consuming it with io.Copy (where reader is assigned by dockerClient.ImagePull and io.Copy(io.Discard, reader) is called), call reader.Close() and handle/require its returned error (e.g., require.NoError(t, err)) so the stream is always closed and any close error is surfaced.pkg/testfixtures/storage/postgres.go (1)
85-89:⚠️ Potential issue | 🟡 MinorClose the image pull response stream.
ImagePullreturns anImagePullResponsethat embedsio.ReadCloser. When reading from it as anio.Reader(as done here withio.Copy), the documentation requires callingClose()after processing to properly release the connection. The current code drains the stream but never closes it, resulting in a resource leak.♻️ Proposed fix
reader, err := dockerClient.ImagePull(context.Background(), postgresImage, client.ImagePullOptions{}) require.NoError(t, err) _, err = io.Copy(io.Discard, reader) // consume the image pull output to make sure it's done + closeErr := reader.Close() require.NoError(t, err) + require.NoError(t, closeErr)Note: The same issue exists in
pkg/testfixtures/storage/mysql.go.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/testfixtures/storage/postgres.go` around lines 85 - 89, The ImagePull response (reader) is an io.ReadCloser and although you drain it with io.Copy, you never call Close(), leaking the connection; update the ImagePull handling in the block that calls dockerClient.ImagePull (the reader variable returned) to defer or explicitly call reader.Close() after io.Copy completes (and still handle/require.NoError on both the io.Copy and the Close call), and apply the same fix to the analogous code in pkg/testfixtures/storage/mysql.go.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@pkg/testfixtures/storage/mysql.go`:
- Around line 78-82: The ImagePull response (reader) is an io.ReadCloser and
must be closed to avoid leaking the HTTP connection; after consuming it with
io.Copy (where reader is assigned by dockerClient.ImagePull and
io.Copy(io.Discard, reader) is called), call reader.Close() and handle/require
its returned error (e.g., require.NoError(t, err)) so the stream is always
closed and any close error is surfaced.
In `@pkg/testfixtures/storage/postgres.go`:
- Around line 85-89: The ImagePull response (reader) is an io.ReadCloser and
although you drain it with io.Copy, you never call Close(), leaking the
connection; update the ImagePull handling in the block that calls
dockerClient.ImagePull (the reader variable returned) to defer or explicitly
call reader.Close() after io.Copy completes (and still handle/require.NoError on
both the io.Copy and the Close call), and apply the same fix to the analogous
code in pkg/testfixtures/storage/mysql.go.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: d1222a57-51b8-4054-934d-f5fb6e082ac6
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
CHANGELOG.mdcmd/openfga/main_test.gogo.modpkg/testfixtures/storage/mysql.gopkg/testfixtures/storage/postgres.go
Contributor
|
The minimum Go version specified by moby is However the minimum Go version specified by OpenFGA is You will need to change the OpenFGA |
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/testfixtures/storage/postgres.go (1)
331-344:⚠️ Potential issue | 🟠 MajorBind the replica to the container this fixture actually created.
Line 331 scans the whole daemon and returns the first
postgres-*match, so if more than one Postgres fixture is alive it can attach the replica to another test's primary. Persistcont.IDonpostgresTestContainerduringRunPostgresTestContainerand use that here instead of global name matching.Based on learnings,
pkg/storage/postgres/postgres.goalready has to support multiple tests withcfg.ExportMetrics = truein the same process.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/testfixtures/storage/postgres.go` around lines 331 - 344, The code currently scans all containers and picks the first postgres-* match; modify the logic to use the specific container ID recorded when creating the fixture: during RunPostgresTestContainer persist the created container ID onto the postgresTestContainer struct (e.g., set postgresTestContainer.ContainerID or similar field) and then, in this lookup function replace the name-based scanning with a direct lookup/filter by that saved ContainerID (or return that ID immediately) instead of returning the first matching cont.ID; update any callers to rely on postgresTestContainer.ContainerID so replicas bind to the exact primary created by RunPostgresTestContainer.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@pkg/testfixtures/storage/postgres.go`:
- Around line 331-344: The code currently scans all containers and picks the
first postgres-* match; modify the logic to use the specific container ID
recorded when creating the fixture: during RunPostgresTestContainer persist the
created container ID onto the postgresTestContainer struct (e.g., set
postgresTestContainer.ContainerID or similar field) and then, in this lookup
function replace the name-based scanning with a direct lookup/filter by that
saved ContainerID (or return that ID immediately) instead of returning the first
matching cont.ID; update any callers to rely on
postgresTestContainer.ContainerID so replicas bind to the exact primary created
by RunPostgresTestContainer.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f69a2272-34bc-43fe-a24f-489fe58a10e9
📒 Files selected for processing (3)
go.modpkg/testfixtures/storage/mysql.gopkg/testfixtures/storage/postgres.go
🚧 Files skipped from review as they are similar to previous changes (1)
- pkg/testfixtures/storage/mysql.go
Contributor
Author
@senojj After investigating, it seems that starting from Go Sources: Even after setting the Go directive to |
Contributor
|
@rafanaskin I'll have the team look into the Snyk failure. It may be the same error as before, or something different now. |
rafanaskin
force-pushed
the
vuln-docker
branch
2 times, most recently
from
April 7, 2026 20:55
a4f8c53 to
f6ad430
Compare
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
pkg/testfixtures/storage/mysql.go (1)
67-74:⚠️ Potential issue | 🟠 MajorUse exact tag matching for the local image check.
strings.Contains(tag, mySQLImage)can return true for a different local reference, while the fixture later creates the container withImage: mySQLImage. That makes the preflight check and the actual image reference inconsistent.💡 Suggested fix
- if strings.Contains(tag, mySQLImage) { + if tag == mySQLImage { foundMysqlImage = true break AllImages }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/testfixtures/storage/mysql.go` around lines 67 - 74, Replace the substring check with an exact tag match: in the loop over imageListResult.Items and image.RepoTags, stop using strings.Contains(tag, mySQLImage) and instead compare the tag exactly to mySQLImage (e.g., tag == mySQLImage) so the preflight check uses the same image reference as when creating the container; keep the same break AllImages and foundMysqlImage logic but change the conditional to an equality comparison on the tag value.pkg/testfixtures/storage/postgres.go (2)
74-81:⚠️ Potential issue | 🟠 MajorUse exact tag matching for the local image check.
strings.Contains(tag, postgresImage)can return true for a different local reference, while the fixture later creates the container withImage: postgresImage. That makes the preflight check and the actual image reference inconsistent.💡 Suggested fix
- if strings.Contains(tag, postgresImage) { + if tag == postgresImage { foundPostgresImage = true break AllImages }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/testfixtures/storage/postgres.go` around lines 74 - 81, The preflight loop uses strings.Contains(tag, postgresImage) which can match unintended references; change the check in the nested loop that iterates imageListResult.Items and image.RepoTags to perform exact matching against postgresImage (e.g., tag == postgresImage or compare normalized reference) so foundPostgresImage is only set when a RepoTag exactly equals postgresImage (then break AllImages as before).
330-344:⚠️ Potential issue | 🟠 MajorTrack the primary container ID instead of rediscovering it by name.
This lookup ignores which container instance created the fixture and just returns the first matching
postgres-*container. If multiple fixtures are running at once, the replica can bind to the wrong primary.💡 Suggested approach
type postgresTestContainer struct { addr string version int64 username string password string + containerID string replica *postgresReplicaContainer } @@ pgTestContainer := &postgresTestContainer{ - addr: "localhost:" + m[0].HostPort, - username: "postgres", - password: "secret", + addr: "localhost:" + m[0].HostPort, + username: "postgres", + password: "secret", + containerID: cont.ID, } @@ - masterContainerID, err := p.getMasterContainerID(dockerClient) + masterContainerID, err := p.getMasterContainerID() @@ -func (p *postgresTestContainer) getMasterContainerID(dockerClient *client.Client) (string, error) { - containerListResult, err := dockerClient.ContainerList(context.Background(), client.ContainerListOptions{}) - if err != nil { - return "", err - } - - for _, cont := range containerListResult.Items { - for _, name := range cont.Names { - if strings.Contains(name, "postgres-") && !strings.Contains(name, "replica") && !strings.Contains(name, "basebackup") { - return cont.ID, nil - } - } - } - - return "", fmt.Errorf("master container not found") +func (p *postgresTestContainer) getMasterContainerID() (string, error) { + if p.containerID == "" { + return "", fmt.Errorf("master container not found") + } + + return p.containerID, nil }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/testfixtures/storage/postgres.go` around lines 330 - 344, The current getMasterContainerID function re-discovers a container by name and can return the wrong instance when multiple fixtures run; modify the code to track the primary container ID at creation and return that tracked ID instead. Add a field on postgresTestContainer (e.g., masterContainerID or primaryContainerID), set it when the primary/postgres container is created (in the container creation/startup code path), then change getMasterContainerID to return the stored ID and optionally validate it via dockerClient.ContainerInspect (and only fall back to the name-based search if the stored ID is empty or not found). Update any callers that expect getMasterContainerID to use the stored ID so replica setup binds to the correct primary.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@pkg/testfixtures/storage/mysql.go`:
- Around line 67-74: Replace the substring check with an exact tag match: in the
loop over imageListResult.Items and image.RepoTags, stop using
strings.Contains(tag, mySQLImage) and instead compare the tag exactly to
mySQLImage (e.g., tag == mySQLImage) so the preflight check uses the same image
reference as when creating the container; keep the same break AllImages and
foundMysqlImage logic but change the conditional to an equality comparison on
the tag value.
In `@pkg/testfixtures/storage/postgres.go`:
- Around line 74-81: The preflight loop uses strings.Contains(tag,
postgresImage) which can match unintended references; change the check in the
nested loop that iterates imageListResult.Items and image.RepoTags to perform
exact matching against postgresImage (e.g., tag == postgresImage or compare
normalized reference) so foundPostgresImage is only set when a RepoTag exactly
equals postgresImage (then break AllImages as before).
- Around line 330-344: The current getMasterContainerID function re-discovers a
container by name and can return the wrong instance when multiple fixtures run;
modify the code to track the primary container ID at creation and return that
tracked ID instead. Add a field on postgresTestContainer (e.g.,
masterContainerID or primaryContainerID), set it when the primary/postgres
container is created (in the container creation/startup code path), then change
getMasterContainerID to return the stored ID and optionally validate it via
dockerClient.ContainerInspect (and only fall back to the name-based search if
the stored ID is empty or not found). Update any callers that expect
getMasterContainerID to use the stored ID so replica setup binds to the correct
primary.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0d7bc6fe-8d83-42dd-b180-3a9b40be1b10
📒 Files selected for processing (3)
go.modpkg/testfixtures/storage/mysql.gopkg/testfixtures/storage/postgres.go
✅ Files skipped from review due to trivial changes (1)
- go.mod
Contributor
|
@rafanaskin I made the same changes on a local branch of mine and the only difference seems to be the version of moby that is being pulled in. Yours: Mine: Can you try deleting your I also manually updated the moby dependencies to the latest version and ran the Snyk CLI against the project locally. No issues. At this point, I don't think the issue lies with your code. However, for some reason, Snyk is only failing on your branch. We will continue to look into this. |
Contributor
Author
Contributor
Author
@senojj, сould you create the same PR from your side? Maybe Snyk will be satisfied with it. |
Contributor
|
@rafanaskin I'd like for you to get credit where credit is due. Perhaps try moving these changes to a different branch and issuing a new PR? |
4 tasks
Contributor
Author
Contributor
|
@rafanaskin ok, I'm going to try something on my side. |
Contributor
|
@rafanaskin we are just going to bypass the Snyk check for this PR. When you get a chance, please resolve the conflicts with the base branch and we will get this PR merged in, barring any test failures. |
rafanaskin
force-pushed
the
vuln-docker
branch
2 times, most recently
from
April 9, 2026 21:49
abc33a4 to
1f4b820
Compare
Contributor
Author
|
@senojj, it's done. Thanks! |
Contributor
|
@coderabbitai full review |
Contributor
✅ Actions performedFull review triggered. |
1 similar comment
Contributor
✅ Actions performedFull review triggered. |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cmd/openfga/main_test.go`:
- Around line 98-108: The cleanup currently inspects the container
(dockerClient.ContainerInspect using cont.ID) before stopping it and can race
with containers created with AutoRemove=true or read the exit code before
ContainerStop completes; change the sequence to first attempt to stop the
container (dockerClient.ContainerStop with cont.ID) while tolerating not-found
errors, then obtain the final exit status by waiting for termination (use
ContainerWait or re-run ContainerInspect after the stop) and only assert on the
exit code if the container still exists; if ContainerInspect returns not-found
(due to AutoRemove) skip the exit-code assertion to avoid flaky failures.
In `@go.mod`:
- Around line 29-30: The go.mod lists insecure Moby module versions; update the
dependency versions to include fixes for GO-2026-4883 and GO-2026-4887 by
bumping github.com/moby/moby/api and github.com/moby/moby/client to a release
that includes Moby v29.3.1+ or switch to the semver v2 module path
(github.com/moby/moby/v2) at >= v2.0.0-beta.8; modify the entries for the
symbols "github.com/moby/moby/api" and "github.com/moby/moby/client" accordingly
so the project uses a patched Moby release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2aed866c-319c-4890-a3fa-6ade9a86872e
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
CHANGELOG.mdcmd/openfga/main_test.gogo.modpkg/testfixtures/storage/mysql.gopkg/testfixtures/storage/postgres.go
Contributor
|
@rafanaskin Got Snyk passing :) Looks like Snyk flaked. |
Contributor
Author
That's wonderful. |
rafanaskin
force-pushed
the
vuln-docker
branch
2 times, most recently
from
April 10, 2026 13:09
c7828e9 to
e42ae22
Compare
Replaced the Docker package with Moby submodules to fix vulnerabilities `GO-2026-4883` and `GO-2026-4887`.
senojj
approved these changes
Apr 10, 2026
This was referenced Apr 20, 2026
Merged
fredrikaverpil
added a commit
to fredrikaverpil/openfga
that referenced
this pull request
Jul 12, 2026
Add support for exporting logs via OTLP, allowing integration with any OpenTelemetry-compatible backend (Grafana Loki, Datadog, GCP Cloud Logging, etc.). When log.otlp.enabled is set, logs are exported via OTLP in addition to stdout. The otelzap bridge attaches span context (trace ID, span ID) to each log record, enabling log-trace correlation in backends that support it. Configuration mirrors the trace configuration shape: the standard OTel env vars (OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT) only answer where logs are sent, while the explicit OpenFGA flag (log.otlp.enabled / --log-otlp-enabled / OPENFGA_LOG_OTLP_ENABLED) answers whether to export at all — so a cluster that injects the generic endpoint variable for tracing does not silently start exporting logs on upgrade. zap's production sampling is applied outside the tee, so the keep/drop decision is made once, before fan-out: stdout and OTLP receive the same deterministically sampled stream and collector egress stays bounded during log storms. Changes: - Add otelzap bridge core backed by an OTLP log provider (internal/telemetry/logging.go) - Add WithOTELCore logger option that tees log entries to the bridge. The bridge core is capped to the configured log level, the stdout core strips the bridge-only context field via contextFilterCore, and the sampler wraps the tee (pkg/logger/logger.go) - Attach the context field in the *WithContext logging methods only when an OTEL core is configured, and use those methods in the gRPC logging interceptor so the bridge can extract span context (pkg/middleware/logging/logging.go) - Add config: log.otlp.enabled, log.otlp.endpoint, log.otlp.tls.enabled with OPENFGA_LOG_OTLP_* env vars and OTEL_EXPORTER_OTLP_* endpoint fallbacks (pkg/server/config/config.go, cmd/run/, .config-schema.json) feat: add potential v2 breaking change logs for Expand and ListUsers (openfga#3182) release: update changelog for release 1.18.1 (openfga#3188) release: Update changelog to prep for 1.18.1 release (openfga#3186) test: fix flaky TestV2CheckWithIteratorCache_HigherConsistencyBypassesCache (openfga#3061) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * test reproducing ListUsers report * implement fix * additional test with 3 operands fix: match IPv4-mapped IPv6 addresses in the in_cidr condition (openfga#3181) Signed-off-by: kanywst <niwatakuma@icloud.com> fix: use deterministic proto marshaling for stored authorization models (openfga#3171) chore: create draft release and publish after provenance succeeds for immutable tags/releases (openfga#3178) docs: fix changelog entry (openfga#3177) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: add v2Check logs for resolution breaking change (openfga#3149) feat: BatchCheck uses v2Check when ExperimentalWeightedGraphCheck is enabled (openfga#3154) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: update changelog to add CVE identifiers for recent fixes (openfga#3176) chore: update todo comment string in migration guide (openfga#3175) release: update changelog for release `v1.18.0` (openfga#3174) Co-authored-by: adriantam <adrian.tam@okta.com> Merge commit from fork * fix(authn): require issuer and audience when OIDC authn is enabled Enforce configuration authn.oidc.audience and authn.oidc.issuer when `authn.method` is set to `oidc`. * fixed based on code review feedback * fix: adding comments + test case on empty space for audience * update based on code review feedback * Update CHANGELOG.md Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> * update changelog * Update CHANGELOG.md --------- Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * fix(mysql): collate identifier columns as utf8mb4_bin * fix: add operator note to changelog * fix: move tests to shared storage * fix: separate migrations for each table * fix: add runbook for migrations * fix: set lock_wait_timeout * fix: add docker instructions * fix: add docker instructions * fix: combine the migrations back into one, fix documentation for this * fix: include details about table copy and * Update CHANGELOG.md Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use constant-time comparison for preshared key authentication (openfga#3168) chore(deps): bump the dependencies group with 2 updates (openfga#3166) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group with 2 updates (openfga#3167) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.17.1` (openfga#3165) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: bump grpc-health-probe to v0.4.52 (openfga#3164) Co-authored-by: Saad Hussain <saad.hussain@okta.com> docs: update caching docs (openfga#3163) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: continuation token deserializer - handle `|` in type names (openfga#3152) chore(deps): bump the dependencies group across 1 directory with 13 updates (openfga#3162) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#3156) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: use query start time as iterator cache entry LastModified to prevent stale-read survival (openfga#3155) chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.50 to v0.4.51 in the dependencies group (openfga#3157) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore: Bump go toolchain to 1.26.4 (openfga#3159) fix: prevent v2Check from falling back for throttling and validation (openfga#3150) ci: make pr benchmark comparisons less fragile (openfga#3153) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> release: update changelog for release `v1.17.0` (openfga#3151) Co-authored-by: Vic-Dev <vmichellej@gmail.com> refactor: redesign cache key generation, making it more secure and consistent (openfga#3148) feat: add configurable trace sampler with ParentBased support (openfga#3072) release: update changelog for release `v1.16.1` (openfga#3147) chore: update grpc-health-probe to latest to addres std lib CVEs (openfga#3146) fix: skip v2Check weight2 pruning if iterator is unordered (openfga#3145) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: add concurrency-group to PR-related CI steps (openfga#3140) docs: move OIDC JWKS refresh entry from v1.15.1 to v1.16.0 (openfga#3142) fix: when v2Check is primary algorithm, fix fallback condition and emit metrics (openfga#3141) release: update changelog for release `v1.16.0` (openfga#3139) Merge commit from fork * fix: Standardize cache key generation everywhere * Revert "fix: Standardize cache key generation everywhere" This reverts commit ce60c6f9ae48a310a4dea2b824b5993520c8ba1c. * length-encoded approach * Revert "length-encoded approach" This reverts commit b94637c187c57a2d3f3904247267bbc8ad21a41a. * implement Hexer() and use in some cache keys * appendConditionsHash -> generateConditionsHash * mv Hexer -> BuildKey * BuildKey -> BuildCacheKey refactor to BuildCacheKey on each individual prefix component to remove collision risk * make v2 cacheKey functions the standard * make cache key prefixes consistent * generateConditionsHash -> generateConditionsString * delimit condition name string * remove extra empty check * relocate and reuse existing userTypeRestrictions function * replace hashing of conditions for brevity * fix tests * cleanup, add test file * remove unused slice capacity * make prefix treatments consistent * add nil-byte separator in object ids * hash user type restrictions for brevity * update comment string, use nil-byte separator for future-proofing * remove call to xxhash.new * adjustments for performance, consistency, and interface ergonomics. * make condition hash generation more efficient. * add clarifying comments for size caluculations * fix builder growth calculations to match original intentions * update outdated comment * don't hash potentially zero values * Revert "don't hash potentially zero values" This reverts commit 2ad6c5b796bc20a82c1414c5146c3c708330eefa. * add condition key separator unconditionally * patch test expectations for new key structure * export V2IteratorCachePrefix, use in tests --------- Co-authored-by: justin <justin.cohen@okta.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> fix: unintentional zeroing of slice values by setting slice to nil (openfga#3135) increase the check v2 trace information fidelity (openfga#3134) feat: add datastore ping and ping retry configurations (openfga#3113) fix: prevent v2Check strategies returning spurious false on context cancellation (openfga#3128) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix(authn/oidc): refresh JWKS on unknown kid to handle key rotation (openfga#3101) fix: v2Check falls back to v1 on errors (openfga#3126) fix: don't cache false results from cancelled-context goroutines in v2Check (openfga#3125) Signed-off-by: Saad Hussain <saad.hussain@okta.com> make union cache key unique by including the node input's label (openfga#3117) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> fix: shadow v2check and check use the same trace (openfga#3118) fix: bump go toolchain version to 1.26.3 (openfga#3115) chore: add more spans/attributes to v1 and v2 Check (openfga#3116) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: add matches attribute to shadowv2Check and Check spans (openfga#3114) fix: use the same `request_id` for shadow traces in v2Check (openfga#3110) release: update changelog for release `v1.15.1` (openfga#3112) feat: reuse MySQL container across tests (openfga#3042) fix: close all channels opened thus far, before return on error (openfga#3111) chore: Add more spans/attributes to v2Check (openfga#3102) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: ensure acquired limiter token is released on throttle context cancelation (openfga#3106) fix: cancel context before waiting on worker pool in ResolveUnionEdges (openfga#3105) fix: replace golang.org/x/exp/maps with stdlib maps to resolve govet inline errors (openfga#3104) fix: v2Check EdgeCacheKey collisions (openfga#3097) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: expose context errors when they can be the potential cause of an underlying datastore error (openfga#3096) chore(deps): bump the dependencies group across 1 directory with 2 updates (openfga#3093) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion (openfga#3095) chore(deps): bump the dependencies group with 4 updates (openfga#3092) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: error handler panic (openfga#3091) release: update changelog for release `v1.15.0` (openfga#3090) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#3087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: v2Check correctly uses query cache even when cache controller is disabled (openfga#3086) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3081) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (openfga#3085) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.47 to v0.4.48 in the dependencies group across 1 directory (openfga#3065) Signed-off-by: dependabot[bot] <support@github.com> feat: try to use UDS internally between HTTP server and gRPC server (openfga#2937) feat: add jitter to internal cache TTLs to prevent thundering herd effects (openfga#3033) Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> list objects pipeline edge pruning (openfga#3075) update toolchain go to 1.26.2 to address stdlib CVEs (openfga#3084) chore: add store ID and datastore query/item count to shadowV2Check log (openfga#3073) Signed-off-by: Saad Hussain <saad.hussain@okta.com> CI speed up (openfga#3062) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> Add tracing to v2 Check planner strategy selection (openfga#3077) fix: v2Check honours `check-query-cache-enabled` flag (openfga#3070) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: reuse PostgreSQL container across tests (openfga#3018) chore: fix reporter links in changelog (openfga#3069) release: update changelog for release `v1.14.2` (openfga#3068) fix: add null byte delimiter in contextual tuple cache keys and validation in v2Check (openfga#3064) release: update changelog for release `v1.14.1` (openfga#3060) chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3056) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use a baseURL for AuthZEN configuration endpoint (openfga#3057) chore: replace docker with moby (openfga#3047) Iterator Cache V2: Storage Wrapper Pattern with Lock-Free Design (openfga#3016) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> test: fix flaky condition test (openfga#3058) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 6 updates (openfga#3045) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 (openfga#3054) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> feat: add graceful shutdown timeout configuration (openfga#2976) chore: update changelog to reflect playground off-by-default behavior (openfga#3053) chore: decouple Error() and Unwrap() (openfga#3051) perf: remove `fmt` from cache key generation (openfga#3006) perf: enhancements for list objects (openfga#3043) chore: remove stale notice file (openfga#3050) docs: update 1.14.0 for CVE fix (openfga#3046) feat: Add datastore throttling & concurrency limiting to v2Check (openfga#3035) Signed-off-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.14.0` (openfga#3040) batch check cache (openfga#3025) Merge commit from fork Also prevent enabling playground when the server requires authentication feat: add stats on tuple iterator query (openfga#3030) fix: remove unnecessary non-deterministic test (openfga#3038) remove unnecessary import (openfga#3032) perf: improve the intersection algorithm, reducing latency and memory use (openfga#3031) fix: ListObjects pipeline algorithm enhancements and fix for potential deadlock (openfga#3028) chore: Also update openfga/helm-charts in release script (openfga#3010) chore: update CICD to enforce GRPC healthprobe changes (openfga#2990) fix: SQL `TupleOperation` serialization and `pgx.ErrNoRows` error handling (openfga#3014) docs: update changelog for CVE-2026-33729 (openfga#3017) chore: output the diff after running keep-a-changelog (openfga#3015) chore(deps): bump the dependencies group across 1 directory with 11 updates (openfga#2998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#2999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.13.1` (openfga#3002) Merge commit from fork * strip unicode control characters, encode context key length in cache key * add cache_key tests to ensure we escape control characters and encode context key length * run linter * docs: update changelog * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.h@outlook.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> release: update changelog for release `v1.13.0` (openfga#2997) refactor: Separate caches for v1 and v2 Check (openfga#2968) Co-authored-by: Justin Cohen <justincoh@gmail.com> docs: fix typos in comments (openfga#2972) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> observability: aggregate message statistics for each list-objects sender into a single span (openfga#2993) Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: capture panics in pipeline's base resolver, and return as errors. (openfga#2994) docs: fix typos in RELEASES.md and Makefile (openfga#2980) Co-authored-by: Adrian Tam <adrian.tam@okta.com> AuthZen v1.0 Implementation (openfga#2875) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Rokibul Hasan <mdrokibulhasan@appscode.com> Signed-off-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Karl Persson <kalle.persson92@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Maria Ines Parnisari <maria.inesparnisari@okta.com> Co-authored-by: Rokibul Hasan <mdrokibulhasan18@gmail.com> Co-authored-by: José Padilla <jose.padilla@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> release: update changelog for release `v1.12.1` (openfga#2992) chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (openfga#2988) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore: enforce minor version upgrade rule (openfga#2978) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> perf: tuple validation performance tweaks (openfga#2984) fix: support URI schemes in OTLP endpoint configuration (openfga#2981) refactor: remove custom pipes and replace with channels (openfga#2977) chore(docs): added caching docs (openfga#2664) Co-authored-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.12.0` (openfga#2974) chore: update toolchain go to 1.26.1 (openfga#2975) fix: update toolchain go to 1.25.8 to address stdlib CVEs (openfga#2971) fix: correct swapped format args in DecodeParameterType error message (openfga#2961) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> perf: small tweaks to tuple validation functions (openfga#2963) Co-authored-by: Vic-Dev <vmichellej@gmail.com> test: add tests for condition parameter type any with complex context structures (openfga#2959) Signed-off-by: Artem Muterko <artem@sopho.tech> test: add functional test for ReadAssertions API endpoint (openfga#2960) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> make configurable the maximum received grpc message size (openfga#2952) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> fix: set ExperimentalPipelineListObjects in experimentals by default (openfga#2957) fix: `cache_item_count` metric overcounting (openfga#2950) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#2953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refactor: Make shadowV2Check final log clearer (openfga#2946) Move telemetry package to internal/telemetry (openfga#2938) Signed-off-by: Oleksandr Shestopal <ar.shestopal-oshegithub@gmail.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore(deps): bump the dependencies group across 1 directory with 3 updates (openfga#2956) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: Resolve race condition in check reducers (openfga#2947) Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: gateway grpc client tls cert rotation (openfga#2951) Signed-off-by: Shashank Goel <goelshashank13@gmail.com> fix: disable LO pipeline if ff has it set for a store (openfga#2945) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#2949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: various random fixes (openfga#2942) refactor: check using weighted graph (openfga#2816) Co-authored-by: Yissell Garma <yissell.garma@okta.com> release: update changelog for release `v1.11.6` (openfga#2939) feat: enable pipeline algorithm by default (openfga#2921) add tests to exercise reported bug (openfga#2934) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refine AGENTS.md to make it more concise with higher value. (openfga#2936) Co-authored-by: Justin Cohen <justincoh@gmail.com> migrate grpc dial context to NewClient (openfga#2714) Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (openfga#2935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaced the Docker package with Moby submodules to fix vulnerabilities GO-2026-4883 and GO-2026-4887.
Description
What problem is being solved?
The Docker client is affected by security vulnerabilities GO-2026-4883 and GO-2026-4887.
How is it being solved?
Replaced the Docker package with Moby submodules containing security patches.
What changes are made to solve it?
github.com/moby/moby/clientandgithub.com/moby/moby/api.github.com/docker/dockerpackage from the project.References
followup #3018
Review Checklist
mainSummary by CodeRabbit
Security
Tests
Chores