Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 17:57
· 316 commits to main since this release
v0.6.0
78f15af
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Added a --hardened CLI flag to cds up, cds render, and cds test, which overrides config.image.variant to hardened for any module whose configSchema exposes an image.variant property (currently only modules/orchestration/dagster) before planning, so users no longer need to hand-edit their profile YAML to select the Alpine-hardened Dagster image build (#373).

Changed

  • Expanded the ruff lint scope in pyproject.toml from pyupgrade-only (UP) to also include pyflakes, bugbear, bandit, and isort (F, B, S, I), and fixed or annotated (# noqa) every finding surfaced by the wider scope across cli/, tests/, and workdirs/. This also uncovered and fixed a dormant bug in tests/test_module_isolation.py: setUpClass read a module file handle after it had already been closed, so cls.modules was always empty and test_no_cross_module_service_references silently never executed its assertions (#497, #498, #499).

Fixed

  • cli/renderer.py no longer allows a module template's pure ${config.*}/${bindings.*} substitution to splice a profile-supplied dict/list verbatim into compose-dangerous service fields (command, entrypoint, environment, volumes, cap_add, security_opt, ports, and similar). This closes a compose-injection path where an untrusted profile could smuggle arbitrary command args, environment variables, or host bind mounts through module config; such templates now fail rendering with a new E072 diagnostic.
  • cds get no longer writes fetched files or the tracking manifest through a pre-planted symlink at the destination path. _find_conflicts now treats any symlink destination (including a dangling one, which Path.exists() reports as absent) as a conflict, and the copy/manifest-write steps unlink any symlink at the destination before writing, so a symlink can no longer be used to redirect fetched content onto an arbitrary path outside the destination tree (#474).

What's Changed

  • chore(images): refresh signed-images fixture by @github-actions[bot] in #516
  • fix(cli): reject and never write through symlinked cds get destinations by @RonaldHensbergen in #509
  • feat(cli): add --hardened flag to up/render/test by @RonaldHensbergen in #504
  • fix: reject typed pure-substitution injection into compose-dangerous fields by @RonaldHensbergen in #502
  • chore(deps): update python:3.14-slim docker digest to 83ff1d2 by @renovate[bot] in #519
  • chore(images): refresh signed-images fixture by @github-actions[bot] in #520
  • chore: expand ruff linting scope to cover pyflakes, bugbear, bandit, isort by @RonaldHensbergen in #497
  • chore(release): bump version to 0.6.0 by @github-actions[bot] in #518

Full Changelog: v0.5.2...v0.6.0

What's Changed

  • chore(images): refresh signed-images fixture by @github-actions[bot] in #516
  • fix(cli): reject and never write through symlinked cds get destinations by @RonaldHensbergen in #509
  • feat(cli): add --hardened flag to up/render/test by @RonaldHensbergen in #504
  • fix: reject typed pure-substitution injection into compose-dangerous fields by @RonaldHensbergen in #502
  • chore(deps): update python:3.14-slim docker digest to 83ff1d2 by @renovate[bot] in #519
  • chore(images): refresh signed-images fixture by @github-actions[bot] in #520
  • chore: expand ruff linting scope to cover pyflakes, bugbear, bandit, isort by @RonaldHensbergen in #497
  • chore(release): bump version to 0.6.0 by @github-actions[bot] in #518

Full Changelog: v0.5.2...v0.6.0

Contributors

renovate and RonaldHensbergen
Assets 2
Loading