194 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jcoffey-dev	5a4e05d4f7	Point links at git.coffeylabs.org after the move from GitHub ... GitHub took the organization's repos and GHCR offline on 2026-09-20. Repo, release, raw-file and clone links now go to Gitea at git.coffeylabs.org, container images to registry.coffeylabs.org, and GitLab-style /-/blob paths to Gitea's /src/branch form. Go module paths are identifiers and stay as they are; links to GitHub issues and pull requests are left as history.	2026-09-22 09:08:40 -07:00
jcoffey-dev	c4bd71b6f3	Merge pull request 'ci: run socket-free jobs on the light label' (#3) from ci/light-runner into main	2026-09-22 13:58:08 +00:00
jcoffey-dev	4596c8eeab	ci: run socket-free jobs on the light label ... Both runners carry `light` (host1, and host2 over the wg-hosts link), so these jobs run on whichever host is free. Jobs that mount the docker socket keep `runs-on: docker`, which only host1 has.	2026-09-22 06:45:26 -07:00
jcoffey-dev	93f3cc44a2	Merge branch 'ci/gitea-actions' into 'main' ... ci: add Gitea Actions workflow See merge request coffey-labs/cairnobs!2	2026-09-22 00:51:59 -07:00
jcoffey-dev	46f64f7d42	ci: add Gitea Actions workflow ported from .gitlab-ci.yml	2026-09-21 22:51:28 -07:00
jcoffey-dev	d2ff3c73e7	Merge branch 'ci/gitlab-pipeline' into 'main' ... Run CI on the self-hosted GitLab See merge request coffey-labs/cairnobs!1	2026-09-20 21:04:28 -07:00
jcoffey-dev	e43ae83b32	Run the four checks on the self-hosted GitLab ... Ports license-compliance.yml, security-scan.yml, processing-conformance.yml and web-routes.yml after the GitHub account was suspended and Actions stopped being reachable. The matrices become parallel:matrix over the same crate and module directories, and cargo-deny-action becomes cargo-deny installed in the job, since it has no GitLab equivalent. The command lines are unchanged, including the allowed-licence and ignore lists: that is licence policy, not configuration, and it must not drift silently. One real difference: check-tenant-boundary.sh and check-web-routes.sh shell out to go. The Actions runner happened to have a toolchain on PATH so the workflow never said so; here they run on the Go image. The Actions workflows stay in the tree as the reference.	2026-09-20 20:19:38 -07:00
jcoffey	b7a2f41212	Merge pull request #52 from Coffey-Labs/docs/refresh-license-inventory ... Regenerate the license inventory for the current dependency graph	2026-09-15 15:03:06 -07:00
jcoffey	ee0bdcfcd0	Merge pull request #51 from Coffey-Labs/fix/rustls-advisory ... Update rustls to 0.23.45 for RUSTSEC-2026-0285	2026-09-15 15:02:51 -07:00
jcoffey-dev	764b09cb14	Regenerate the license inventory for the current dependency graph ... Dependabot merges update lockfiles but never the inventory, so it had drifted: gridstack was recorded at 11.5.1 and vite at 8.2.1, the agent still listed tonic 0.12 and toml 0.8, and alerting -- named in the audit's methodology -- had no rows at all. Regenerated with the audit's own tools against this tree: cargo deny list for agent and search, go-licenses csv per Go module, license-checker for web. 52 versions bumped, 71 rows added, 55 gone, 786 -> 802 rows. Everything added is permissive (MIT, Apache-2.0, BSD-3-Clause, Zlib or an OR of those), so nothing is newly flagged; flagged rows go 36 -> 35 because ryu (Apache-2.0 OR BSL-1.0) left search's graph with reqwest 0.13. No bumped crate changed its license. Built on the rustls update, so agent records rustls 0.23.45 and no longer lists rustls-pemfile. As last time, rows whose name and version are unchanged are left byte-for-byte alone -- 679 of them -- so the diff is only the real change. That also keeps every hand-written row: the segmentio/asm MIT-0 confirmations, the fonts, the favicon, and the three Docker images. First-party github.com/cairnobs/cairnobs packages are left out, as before. New rows follow the conventions the existing ones use, which the regeneration reproduced exactly for every unchanged Rust and npm row. Signed-off-by: John Coffey <[email protected]>	2026-09-15 14:59:44 -07:00
jcoffey-dev	cdb58604f0	Update rustls to 0.23.45 for RUSTSEC-2026-0285 ... rustls 0.23.43 accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record, where RFC 8446 requires the connection to be terminated. The transcript is still authenticated, so a handshake cannot be altered, but a peer could send in plaintext what should be encrypted. It reaches the agent through tonic -> tokio-rustls, on its mTLS gRPC link to ingest. Fixed in 0.23.45, inside the existing range, so only the lockfile moves. The advisory was published after main last passed, so the agent's cargo-deny advisories job failed on every open PR, including ones that never touched Rust. Also drops the RUSTSEC-2025-0134 ignore from agent/deny.toml. Its own reason said to delete it once tonic stopped pulling in rustls-pemfile; tonic 0.14 no longer does, and cargo-deny warned the advisory was not encountered. Signed-off-by: John Coffey <[email protected]>	2026-09-15 14:50:40 -07:00
jcoffey	44398ea30d	Merge pull request #50 from Coffey-Labs/dependabot/go_modules/alerting/go-minor-and-patch-62ce3b091a ... Bump the go-minor-and-patch group across 4 directories with 2 updates	2026-09-15 14:49:27 -07:00
jcoffey	8be2614364	Merge pull request #49 from Coffey-Labs/dependabot/cargo/agent/cargo-minor-and-patch-ddcd92783a ... Bump the cargo-minor-and-patch group across 2 directories with 3 updates	2026-09-15 14:49:20 -07:00
jcoffey	2a210206f2	Merge pull request #48 from Coffey-Labs/dependabot/npm_and_yarn/web/npm-minor-and-patch-63b3902748 ... Bump the npm-minor-and-patch group in /web with 2 updates	2026-09-15 14:49:14 -07:00
dependabot[bot]	6a05e9ce5c	Bump the go-minor-and-patch group across 4 directories with 2 updates ... Bumps the go-minor-and-patch group with 1 update in the /alerting directory: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx). Bumps the go-minor-and-patch group with 2 updates in the /api directory: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) and [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go-minor-and-patch group with 1 update in the /enterprise directory: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx). Bumps the go-minor-and-patch group with 1 update in the /ingest directory: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx). Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](https://github.com/jackc/pgx/compare/v5.10.0...v5.11.0) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](https://github.com/jackc/pgx/compare/v5.10.0...v5.11.0) Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0 - [Commits](https://github.com/golang/crypto/compare/v0.56.0...v0.57.0) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](https://github.com/jackc/pgx/compare/v5.10.0...v5.11.0) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](https://github.com/jackc/pgx/compare/v5.10.0...v5.11.0) --- updated-dependencies: - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/crypto dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-15 09:12:19 +00:00
dependabot[bot]	c468bf9bee	Bump the cargo-minor-and-patch group across 2 directories with 3 updates ... Bumps the cargo-minor-and-patch group with 1 update in the /agent directory: [toml](https://github.com/toml-rs/toml). Bumps the cargo-minor-and-patch group with 2 updates in the /search directory: [tantivy](https://github.com/quickwit-oss/tantivy) and [reqwest](https://github.com/seanmonstar/reqwest). Updates `toml` from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/toml-v1.1.5...toml-v1.1.6) Updates `tantivy` from 0.26.1 to 0.26.2 - [Release notes](https://github.com/quickwit-oss/tantivy/releases) - [Changelog](https://github.com/quickwit-oss/tantivy/blob/main/CHANGELOG.md) - [Commits](https://github.com/quickwit-oss/tantivy/compare/0.26.1...0.26.2) Updates `reqwest` from 0.13.4 to 0.13.5 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](https://github.com/seanmonstar/reqwest/compare/v0.13.4...v0.13.5) --- updated-dependencies: - dependency-name: toml dependency-version: 1.1.6+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-and-patch - dependency-name: tantivy dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-and-patch - dependency-name: reqwest dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-15 09:12:12 +00:00
dependabot[bot]	37519c385a	Bump the npm-minor-and-patch group in /web with 2 updates ... Bumps the npm-minor-and-patch group in /web with 2 updates: [gridstack](https://github.com/gridstack/gridstack.js) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `gridstack` from 13.2.0 to 13.3.0 - [Release notes](https://github.com/gridstack/gridstack.js/releases) - [Changelog](https://github.com/gridstack/gridstack.js/blob/master/doc/CHANGES.md) - [Commits](https://github.com/gridstack/gridstack.js/compare/v13.2.0...v13.3.0) Updates `vite` from 8.2.2 to 8.3.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) --- updated-dependencies: - dependency-name: gridstack dependency-version: 13.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: vite dependency-version: 8.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-15 09:11:54 +00:00
jcoffey	9ad25ae88f	Merge pull request #47 from Coffey-Labs/demo-sync-script ... Script the demo sync, so its exclusions are not retyped each time	2026-09-10 10:58:20 -07:00
jcoffey-dev	309d0879ba	Script the demo sync, so its exclusions are not retyped each time ... The demo host holds a copy of this tree rather than a checkout, so updating it means pushing, and the push has to leave the host's own files alone. Done by hand on 2026-09-10 that went wrong: the exclude list named .env and both compose files, and missed `hack/dev-certs/out/` -- gitignored, generated per machine. ingest mounts that directory, so after the rebuild it served a certificate signed by the developer's CA while the host's agent simulator still trusted the host's own, and all 54 agents failed to check in with `x509: certificate signed by unknown authority` until the simulator was restarted. So this syncs `git ls-files` rather than everything-minus-a-list. Anything gitignored is then unsendable by construction, which is the whole category the hand-written list kept missing. Two tracked files are still held back, and they need naming because the rule above does not cover them: docker-compose.yml the host binds every published port to 127.0.0.1 by editing this in place; `ports:` cannot be overridden from an override file, since Compose concatenates list keys instead of replacing them. .env the host's carries ALERTING_SERVICE_TOKEN, which the repo's does not. It also restarts the simulator. That runs on the host outside Compose, reads its mTLS material once at startup, and is exactly what nothing else would have restarted. Dry run by default; --yes to apply, and it refuses a dirty tree then.	2026-09-10 10:54:56 -07:00
jcoffey	0e1505ce00	Merge pull request #46 from Coffey-Labs/dependabot/cargo/search/reqwest-0.13.4 ... Bump reqwest from 0.12.28 to 0.13.4 in /search	2026-09-10 10:23:28 -07:00
dependabot[bot]	3cb57ade87	Bump reqwest from 0.12.28 to 0.13.4 in /search ... Bumps [reqwest](https://github.com/seanmonstar/reqwest) from 0.12.28 to 0.13.4. - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](https://github.com/seanmonstar/reqwest/compare/v0.12.28...v0.13.4) --- updated-dependencies: - dependency-name: reqwest dependency-version: 0.13.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 17:18:46 +00:00
jcoffey	50300fec96	Merge pull request #45 from Coffey-Labs/ignore-ts7-web ... Stop proposing TypeScript 7 for web until SvelteKit can take it	2026-09-10 10:17:09 -07:00
jcoffey-dev	f65dd25672	Stop proposing TypeScript 7 for web until SvelteKit can take it ... #38 cannot be made green from this side. No @sveltejs/kit release accepts TypeScript 7: 2.70.3, the current latest, peers `^5.3.3 || ^6.0.0`, and even the 3.0.0-next.27 prerelease peers `^6.0.0`. svelte-check caps at 6 as well. `npm ci` stops on ERESOLVE before a line is compiled, so there is nothing to fix here -- the block is upstream. Left open, Dependabot reopens it every week for as long as that stays true. So the major is ignored for typescript in /web only, with the condition for removing it written next to it. Minor and patch updates still come through, and every other package is untouched.	2026-09-10 10:14:37 -07:00
jcoffey	2e441d9d17	Merge pull request #44 from Coffey-Labs/tonic-0.14 ... Take tonic to 0.14, with the prost split it requires	2026-09-10 10:13:35 -07:00
jcoffey-dev	ff6a4d5f09	Take tonic to 0.14, with the prost split it requires ... #31 and #36 bump tonic-build alone to 0.14 and break the build outright: 0.14 moved prost codegen out to tonic-prost-build, so `tonic_build::configure()` no longer exists. Both repositories also pin `tonic = "0.12"` as the runtime beside it, and codegen from 0.14 against a 0.12 runtime would be incoherent even if it compiled. So the whole set moves together, in agent and in search: tonic 0.12 -> 0.14 tonic-build 0.12 -> tonic-prost-build 0.14 (build-dependency) prost 0.13 -> 0.14 tonic-prost new runtime dependency Two consequences worth naming. The generated code now reaches for `tonic_prost::ProstCodec`, so tonic-prost has to be a real dependency rather than something the build script pulls in. And prost had to move with it: tonic-prost 0.14 wants prost 0.14, so leaving ours at 0.13 left the generated types deriving a `Message` trait from a different prost than the one the codec demanded. tonic's `tls` feature is gone, replaced by one feature per crypto provider. `tls-ring` is the like-for-like choice: it is the rustls-plus- ring pairing `tls` used to mean, and the agent hands its own CA and identity to ClientTlsConfig for mTLS, so it needs no root store. The call sites did not change at all -- transport::{Certificate, Channel, ClientTlsConfig, Identity} and include_proto! are all still where they were. Verified by building both, since no CI job compiles Rust: agent and search check clean, 34 agent tests and 24 search tests pass.	2026-09-10 10:08:19 -07:00
jcoffey	ac02aa1564	Merge pull request #43 from Coffey-Labs/dependabot/go_modules/alerting/go-minor-and-patch-8d168f7a04 ... Bump the go-minor-and-patch group across 5 directories with 9 updates	2026-09-10 10:06:14 -07:00
jcoffey	bbc5e7a53f	Merge pull request #29 from Coffey-Labs/dependabot/github_actions/actions-cf414a5a77 ... Bump the actions group across 1 directory with 3 updates	2026-09-10 10:04:09 -07:00
jcoffey	03ca6ede84	Merge pull request #42 from Coffey-Labs/gridstack-13 ... Take gridstack to 13, and handle the grid it may not return	2026-09-10 10:01:36 -07:00
dependabot[bot]	82cfe1fa0a	Bump the go-minor-and-patch group across 5 directories with 9 updates ... Bumps the go-minor-and-patch group with 1 update in the /alerting directory: [golang.org/x/sync](https://github.com/golang/sync). Bumps the go-minor-and-patch group with 1 update in the /api directory: [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go-minor-and-patch group with 3 updates in the /deploy/operator directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery), [k8s.io/client-go](https://github.com/kubernetes/client-go) and [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime). Bumps the go-minor-and-patch group with 6 updates in the /enterprise directory: | Package | From | To | | --- | --- | --- | | [golang.org/x/sync](https://github.com/golang/sync) | `0.22.0` | `0.23.0` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.31.0` | `0.37.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.31.0` | `0.37.0` | | [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) | `3.20.0` | `3.21.0` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.4` | `4.1.5` | | [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.36.0` | `0.37.0` | Bumps the go-minor-and-patch group with 1 update in the /ingest directory: [golang.org/x/sync](https://github.com/golang/sync). Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `golang.org/x/crypto` from 0.55.0 to 0.56.0 - [Commits](https://github.com/golang/crypto/compare/v0.55.0...v0.56.0) Updates `k8s.io/apimachinery` from 0.31.0 to 0.37.0 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.31.0...v0.37.0) Updates `k8s.io/client-go` from 0.31.0 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.31.0...v0.37.0) Updates `sigs.k8s.io/controller-runtime` from 0.19.3 to 0.25.0 - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.19.3...v0.25.0) Updates `k8s.io/api` from 0.31.0 to 0.37.0 - [Commits](https://github.com/kubernetes/api/compare/v0.31.0...v0.37.0) Updates `k8s.io/apimachinery` from 0.31.0 to 0.37.0 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.31.0...v0.37.0) Updates `k8s.io/client-go` from 0.31.0 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.31.0...v0.37.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `k8s.io/apimachinery` from 0.31.0 to 0.37.0 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.31.0...v0.37.0) Updates `k8s.io/client-go` from 0.31.0 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.31.0...v0.37.0) Updates `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0 - [Release notes](https://github.com/coreos/go-oidc/releases) - [Commits](https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0) Updates `github.com/go-jose/go-jose/v4` from 4.1.4 to 4.1.5 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](https://github.com/go-jose/go-jose/compare/v4.1.4...v4.1.5) Updates `golang.org/x/oauth2` from 0.36.0 to 0.37.0 - [Commits](https://github.com/golang/oauth2/compare/v0.36.0...v0.37.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `k8s.io/api` from 0.31.0 to 0.37.0 - [Commits](https://github.com/kubernetes/api/compare/v0.31.0...v0.37.0) Updates `k8s.io/apimachinery` from 0.31.0 to 0.37.0 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.31.0...v0.37.0) Updates `k8s.io/client-go` from 0.31.0 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.31.0...v0.37.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/crypto dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: sigs.k8s.io/controller-runtime dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/api dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/coreos/go-oidc/v3 dependency-version: 3.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-and-patch - dependency-name: golang.org/x/oauth2 dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/api dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 17:00:23 +00:00
dependabot[bot]	11c2e89d25	Bump the actions group across 1 directory with 3 updates ... Bumps the actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go) and [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) Updates `actions/setup-go` from 5 to 7 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5...v7) Updates `actions/setup-node` from 4 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 16:59:19 +00:00
jcoffey-dev	efc8886bd8	Take gridstack to 13, and handle the grid it may not return ... gridstack 13 changed `GridStack.init` to return `GridStack | null` where 11 always handed one back. The dashboard held the result in a `GridStack | undefined` and called `.on('change')` on it straight after, so svelte-check stopped on two errors: null is not undefined, and the value is possibly neither. Coalesced to undefined so the declared type stays as it was, then guarded before the listener is attached. `gridEl` is already checked at the top of the function, so a null here should not occur -- but the type allows it, and a dashboard that quietly stops persisting drags beats one that throws inside an effect. Nothing else in the repository touches gridstack: one import of `GridStack` and its stylesheet, in this file. Worth noting `vite build` passes either way. Only `npm run check` sees this, and no CI job runs it -- the two majors would have gone in looking clean.	2026-09-10 09:59:14 -07:00
dependabot[bot]	be6614182f	Bump gridstack from 11.5.1 to 13.2.0 in /web ... Bumps [gridstack](https://github.com/gridstack/gridstack.js) from 11.5.1 to 13.2.0. - [Release notes](https://github.com/gridstack/gridstack.js/releases) - [Changelog](https://github.com/gridstack/gridstack.js/blob/master/doc/CHANGES.md) - [Commits](https://github.com/gridstack/gridstack.js/commits/v13.2.0) --- updated-dependencies: - dependency-name: gridstack dependency-version: 13.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 09:58:35 -07:00
jcoffey	e071216378	Merge pull request #34 from Coffey-Labs/dependabot/cargo/agent/quick-xml-0.42.0 ... Bump quick-xml from 0.41.0 to 0.42.0 in /agent	2026-09-10 09:58:12 -07:00
jcoffey	7c9aeb7406	Merge pull request #41 from Coffey-Labs/go-1.26-pins ... Move the Go toolchain pins to 1.26, in CI and in every image	2026-09-10 09:58:08 -07:00
jcoffey-dev	c60028aad1	Move the Go toolchain pins to 1.26, in CI and in every image ... Two Dependabot PRs are stuck behind the same number. #35 raises the go directive to 1.26.0 in six modules, because golang.org/x/crypto v0.56.0 requires it -- x/crypto tracks the two most recent Go releases and 0.56 dropped 1.25. A module that says 1.26 cannot be built by the 1.25 this repository pins in two places, so that PR fails every Go job. #29 raises actions/setup-go to v7, which sets GOTOOLCHAIN=local. With that set, `go install golang.org/x/vuln/cmd/govulncheck@latest` cannot quietly fetch a newer toolchain, and stops with golang.org/x/[email protected] requires go >= 1.26.0 (running go 1.25.14) Under setup-go v5 the same install succeeded by downloading 1.26 behind our backs, which is its own reason to be on 1.26 deliberately instead. So: security-scan's go-version and all eight Dockerfiles move together, 1.25 -> 1.26. Nothing else needs to. A newer toolchain builds an older directive happily, so this stands on its own before #35 lands, and the go.mod files stay where they are here. Checked by building rather than by reading: the api and ingest images both build on golang:1.26-alpine, and api, ingest and enterprise still `go build ./...` clean against their existing 1.25 directives.	2026-09-10 09:54:45 -07:00
dependabot[bot]	585305126b	Bump quick-xml from 0.41.0 to 0.42.0 in /agent ... Bumps [quick-xml](https://github.com/tafia/quick-xml) from 0.41.0 to 0.42.0. - [Release notes](https://github.com/tafia/quick-xml/releases) - [Changelog](https://github.com/tafia/quick-xml/blob/master/Changelog.md) - [Commits](https://github.com/tafia/quick-xml/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: quick-xml dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 16:50:34 +00:00
jcoffey	907bf52541	Merge pull request #37 from Coffey-Labs/dependabot/npm_and_yarn/web/npm-minor-and-patch-3c6815572c ... Bump the npm-minor-and-patch group in /web with 6 updates	2026-09-10 09:48:59 -07:00
jcoffey	0b37199615	Merge pull request #33 from Coffey-Labs/dependabot/cargo/agent/windows-service-0.8.1 ... Bump windows-service from 0.7.0 to 0.8.1 in /agent	2026-09-10 09:48:54 -07:00
jcoffey	75303930a9	Merge pull request #32 from Coffey-Labs/dependabot/cargo/agent/toml-1.1.5spec-1.1.0 ... Bump toml from 0.8.23 to 1.1.5+spec-1.1.0 in /agent	2026-09-10 09:48:51 -07:00
jcoffey	0670ff55b8	Merge pull request #30 from Coffey-Labs/dependabot/cargo/agent/windows-0.62.2 ... Bump windows from 0.58.0 to 0.62.2 in /agent	2026-09-10 09:48:47 -07:00
jcoffey	be1840a94f	Merge pull request #40 from Coffey-Labs/funding-username-jcoffey-dev ... Point the Sponsor button at the current GitHub username	2026-09-10 09:19:32 -07:00
jcoffey-dev	df6f9d049f	Point the Sponsor button at the current GitHub username ... The account behind it was renamed from LINUXexpert-org to jcoffey-dev, and GitHub does not redirect the old name: github.com/sponsors/ LINUXexpert-org answers 404 while the new one answers 200. So the Sponsor button on this repository has been leading nowhere. Worth fixing rather than leaving to redirect, because a released username can be registered by anyone -- a stale link stops being a dead end and starts being someone else's page.	2026-09-10 09:17:02 -07:00
dependabot[bot]	c0f0d51887	Bump the npm-minor-and-patch group in /web with 6 updates ... Bumps the npm-minor-and-patch group in /web with 6 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.4` | `6.11.0` | | [@codemirror/state](https://github.com/codemirror/state) | `6.7.1` | `6.7.4` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.8` | `6.43.11` | | [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.70.2` | `2.70.3` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.9` | `5.57.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` | Updates `@codemirror/commands` from 6.10.4 to 6.11.0 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@codemirror/state` from 6.7.1 to 6.7.4 - [Changelog](https://github.com/codemirror/state/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/state/commits) Updates `@codemirror/view` from 6.43.8 to 6.43.11 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@sveltejs/kit` from 2.70.2 to 2.70.3 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) Updates `svelte` from 5.56.9 to 5.57.0 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `vite` from 8.2.1 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@codemirror/state" dependency-version: 6.7.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: "@codemirror/view" dependency-version: 6.43.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: "@sveltejs/kit" dependency-version: 2.70.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: svelte dependency-version: 5.57.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 16:07:03 +00:00
dependabot[bot]	eb48ee0aa5	Bump windows-service from 0.7.0 to 0.8.1 in /agent ... Bumps [windows-service](https://github.com/mullvad/windows-service-rs) from 0.7.0 to 0.8.1. - [Release notes](https://github.com/mullvad/windows-service-rs/releases) - [Changelog](https://github.com/mullvad/windows-service-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/mullvad/windows-service-rs/compare/v0.7.0...v0.8.1) --- updated-dependencies: - dependency-name: windows-service dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 16:06:35 +00:00
dependabot[bot]	3db8850598	Bump toml from 0.8.23 to 1.1.5+spec-1.1.0 in /agent ... Bumps [toml](https://github.com/toml-rs/toml) from 0.8.23 to 1.1.5+spec-1.1.0. - [Commits](https://github.com/toml-rs/toml/compare/toml-v0.8.23...toml-v1.1.5) --- updated-dependencies: - dependency-name: toml dependency-version: 1.1.5+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 16:06:31 +00:00
dependabot[bot]	df90b85ec4	Bump windows from 0.58.0 to 0.62.2 in /agent ... Bumps [windows](https://github.com/microsoft/windows-rs) from 0.58.0 to 0.62.2. - [Release notes](https://github.com/microsoft/windows-rs/releases) - [Commits](https://github.com/microsoft/windows-rs/commits) --- updated-dependencies: - dependency-name: windows dependency-version: 0.62.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>	2026-09-10 16:06:20 +00:00
Coffey Labs	bb42a07392	Merge pull request #28 from Coffey-Labs/grpc-1.83.2 ... Take grpc to 1.83.2 across the nine modules that carry it	2026-09-10 09:04:46 -07:00
jcoffey-dev	b7f99b49f2	Take grpc to 1.83.2 across the nine modules that carry it ... GHSA-2v4p-qf9q-27wj is a panic in gRPC-Go's xDS routing interceptor: a request arriving with neither `:authority` nor `Host` indexes an empty slice, the per-RPC goroutine does not recover, and the process dies. High, and nine alerts, because nine go.mod files pin the same version -- eight directly, terraform indirectly. Nothing here was reachable. The interceptor is installed by `xds.NewGRPCServer`, which this repo never calls: the one production server is `grpc.NewServer(grpc.Creds(...))` in ingest/internal/grpcserver and the only other is a plain one in a searchclient test. That is also why security-scan has been green throughout -- govulncheck reports on reachability and found nothing on 1.83.1, while Dependabot reports on version ranges and found nine. Both were right. Taken anyway: it is a patch release, and the next advisory in this dependency may well land somewhere we do reach. `go mod tidy` carried the indirect requirements grpc 1.83.2 asks for -- x/net, x/text, x/sys and friends. No CI job builds or tests Go here, so all nine modules were built locally and api, ingest and enterprise tested with -count=1, since a cached pass would not have exercised the new version. The dependabot.yml is the other half. There was no config, so nothing opened a PR against any of this. Go majors stay out of the group, being import path changes rather than bumps.	2026-09-10 09:01:27 -07:00
Coffey Labs	6a17fa1562	Update GitHub Sponsors username in FUNDING.yml ... Signed-off-by: Coffey Labs <[email protected]>	2026-09-05 00:51:06 -07:00
Coffey Labs	91dff9cc46	Merge pull request #27 from Coffey-Labs/chore/upgrade-tantivy ... Upgrade tantivy to 0.26 and clear the lru advisory	2026-09-04 22:19:22 -07:00