Releases: divergedev/diverge
Releases · divergedev/diverge
Release list
v0.11.0
Changelog
Features
- 0904c5e docs(features): add feature flags guide and update configuration reference (#272)
- 777e538 feat(api): migrate CRD API group and labels to divergedev.com (#257)
- 7cd6466 feat(atlas): production-grade local bundling, lifecycle gating, and cli support (#278)
- 7875006 feat(cli): add multi-user conflict detection and session leasing for diverge dev (Pro) (#273)
- d63a722 feat(cli): enhance server discovery with part-of labels, RBAC fallback, and ServerDiscoverer interface (#260)
- 096eb56 feat(cli): introduce TokenSource with dynamic reload, OpenBao support, and KubeTokenSource (#266)
- b7c9662 feat(config): validate banner position and color, clean up api aliases (#262)
- 74a657b feat(crd): add local provider to EnvironmentSource and stabilize loadtest test (#286)
- 4d7cb4d feat(dashboard): add dedicated Feature Flags tab in EnvironmentDetail view (#269) (#271)
- 400284b feat(database): support standalone atlas migration jobs (#263)
- 5cf4efe feat(features): add Flipt feature provider with dual-tier secret resolution and Flagsmith/Unleash stubs (#270)
- 0262ab3 feat(features): full Flagsmith enterprise provider with identity & trait targeting (#267) (#276)
- 5031145 feat(features): implement OpenFeature hook and FeatureProvider interfaces (#264)
- c5eacda feat(routing): enable multi-provider composition, IPv6 CIDRs, and ingress gateway access (#261)
- 5e0d110 feat(server): introduce CookiePolicyResolver and expose secureCookies in Helm chart and docs (#259)
- 3946bc4 feat(topology): surface changedServices diff badges and add Gateway API conformance tests (#277)
- c95cf1f feat: Preview Verification Suite, Cluster Doctor & Unified VS Code/OpenCode Extension (#274)
- e22c663 feat: close test gaps, add cross-language SDKs, implement Unleash provider, and add docs (#279)
- af2a8eb fix(features): resolve workload injection, teardown race, and targeting rules (#265)
Bug fixes
- ca1d50a fix(cli): dev survives a PreviewGroup the installed CRD refuses (#285)
- 6f74cf5 fix(server): a signed-out browser is sent to sign in, not handed a 401 (#284)
- b90f784 fix(server): the tunnel Service is resolvable and routable on kube-dns clusters (#283)
- 77fb647 fix(server): the tunnel stream is not bounded by ReadTimeout (#282)
- 655ac16 fix(transport): the tunnel speaks HTTP/2 to a plaintext server (#281)
- 6d0119c fix(verification): address CodeRabbit review for SSRF, doctor diagnoser, dev sessions JSON, and vscode lifecycle (#275)
Others
v0.10.0
v0.10.0 Release Notes
Highlights
🗄️ Database Isolation via SetupSQL K8s Jobs
Schema initialization SQL is no longer executed in-process by the controller. Diverge now provisions a dedicated, ephemeral Kubernetes Job running psql:
- Database admin credentials are mounted securely via Secret reference (
DATABASE_URL). - Initialization SQL is mounted via a dedicated ConfigMap.
- Default image pinned by digest to
postgres:17-alpine@sha256:7456ef82e5f5bc43d997f4781bbd7c0d6389bff397564649a356e206ba473aeeand configurable via Helm (database.setupJob.image).
🎨 Visual Preview Banner Configuration
Users can now configure or disable the preview environment banner directly in diverge.yaml:
defaults:
routing:
banner:
enabled: true # set to false to hide
text: "Staging Preview"
position: bottom # top | bottom
color: "#00FF00"Settings support deep-copy inheritance and selective overrides per environment type or PR label.
🔐 Authenticated CLI Tunnels
diverge dev reverse tunnel RPCs are now authenticated against TokenReview:
- New
--tokenflag andDIVERGE_TOKENenvironment variable. - Automatic fallback to bearer tokens from the active
kubeconfig. - RoundTripper immutability and credential whitespace trimming.
🗺️ Dynamic Service Topology Diffs
The web dashboard topology view now visually highlights changed services in delta preview environments dynamically based on Git change detection (env.spec.deploy.changedServices).
Security & Reliability Fixes
- Session Cookie Security Behind Proxies (#245): Added
--secure-cookies(auto,true,false) flag. Auto mode enablesSecuresession cookies when TLS is terminated by an upstream ingress or API gateway. - SubjectAccessReview API Group (#243): Corrected authorization checks from
diverge.devtodiverge.io, enabling standard Kubernetes RBAC bindings. - Helm Server Discovery (#246): CLI discovery now automatically recognizes modern chart selectors (
app.kubernetes.io/name=diverge,app.kubernetes.io/component=server) with Pod selector consistency. - Istio RBAC & Ambient Documentation (#247): Corrected controller ClusterRole to grant permissions on
security.istio.io(authorizationpolicies), matching actual router behavior. - Chart Server Image Fallback (#244): Server deployment falls back to
image.tagwhenserver.image.tagis unspecified. - Dependency Vulnerability Remediation: Bumped
google.golang.org/grpctov1.83.1across root and temporal SDK submodules to resolve CVE-2026-84304.
Performance & Testing
- 183x Faster Server Tests: Resolved
httptest.ServerHTTP/2 connection drain in tunnel fixtures, reducinginternal/serverpackage test duration from 158s to 0.86s. - Property-Based Testing (Rapid): Added Rapid PBT suites for secure cookie resolution and tunnel token credential precedence.
- Frontend Test Isolation: Scoped
QueryClientinstantiation within test providers, eliminating cross-test mutation leaks.
Commits
- 073d083 chore(chart): bump version to 0.10.0 for release (#250)
- 379f532 fix(cli): authenticate tunnel connections to the server (#248)
- f7a878a fix(server): set Secure on session cookies behind a TLS-terminating proxy (#245)
- 93a2746 fix(cli): discover a chart-installed server (#246)
- c779403 fix(routing): describe the istio provider as what it does, and fix its RBAC (#247)
- 0906f3d fix(server): authorize against the diverge.io API group (#243)
- a783bc0 feat: execute SetupSQL via K8s Job for database isolation (#242)
- 9e31de2 feat: expose banner config in diverge.yaml (#249)
- f743fa9 fix(chart): fall back to image.tag for the server image (#244)
- b6ec808 feat: surface changedServices in topology view and fix QueryClient test isolation (#241)
v0.9.0
🚀 Diverge v0.9.0
⚠️ Breaking Changes
- Pod Security Standards enforced on preview namespaces — All preview namespaces now have
pod-security.kubernetes.io/enforce: restrictedlabels. Pods that violate therestrictedpolicy (privileged containers, hostPath mounts, hostNetwork, etc.) will be rejected. If your preview workloads require elevated privileges, you will need to adjust your pod security configuration.
✨ Features
- Concurrent async route provisioning — Async routes are now provisioned in parallel using errgroup with bounded concurrency (5 goroutines). Significant speedup for environments with multiple async routes. (#239)
- SecretResolver framework — New pluggable secret resolution chain supporting
env,file, andvaultproviders. (#237) - CLI
validate --output json— Structured JSON output for CI pipelines. Remote URL config validation via--config https://.... (#238) - OTel tracing — OpenTelemetry spans on all reconciler phases (Reconcile, Deploy, Lifecycle, Provisioner, Teardown). (#238)
- Helm OCI + SBOM + cosign — Release pipeline now publishes Helm charts to OCI registry, generates SBOMs with syft, and signs artifacts with cosign. (#238)
- Windows CLI builds —
divergeCLI now builds for Windows in addition to Linux and macOS. (#240) - Trivy vulnerability scanning in CI — Automatic container image scanning for CRITICAL and HIGH vulnerabilities. (#240)
🔒 Security
- File resolver rejects absolute paths — Prevents reading arbitrary files like
/etc/passwdfrom the controller filesystem. Also rejects Windows volume-rooted paths. (#240) - Vault redirect hardening — HTTP client capped at 10 redirects, cross-host redirect rejection, response body draining for connection reuse. (#237, #240)
- Vault KVv1/v2 detection — Now checks both
dataandmetadatakeys to prevent false positives. (#240) - Vault singleflight token refresh — Prevents thundering herd on concurrent token expiry using
singleflight.Groupwith independent context. (#240) - IPv6 metadata endpoint blocked — NetworkPolicy now blocks
fd00:ec2::254/128in addition to IPv4169.254.169.254/32. (#240) - Docker base images pinned to SHA256 digests — All Dockerfiles now use immutable image references. (#240)
- CI checkout credential isolation —
persist-credentials: falseon vulnerability scan checkout. (#240) - SHA-pinned GitHub Actions — All CI/CD action references use commit SHAs. (#238)
- RBAC scoping — Allowlist for cluster-scoped kinds, namespace-scoped Role/RoleBinding fixes. (#235, #237)
- YAML bomb protection — Size limits on manifest parsing in the deployer. (#237)
- Webhook deduplication — HMAC-verified webhooks with delivery ID dedup and TTL eviction. (#237)
🐛 Bug Fixes
- Teardown preserves finalizer on partial failure — Previously, a failed teardown step would either block namespace cleanup forever or remove the finalizer prematurely leaking external resources. Now: failed steps are retried, finalizer only removed after all steps succeed. (#240)
- Dedup evicts oldest entries — Webhook dedup cache now sorts by timestamp before eviction instead of random map iteration order. (#240)
- Idempotent CREATE ROLE — Database provisioning no longer fails on pre-existing roles. (#235)
- Concurrent env pointer safety — Errgroup goroutines now receive
env.DeepCopy()to prevent data races. (#240)
🏗️ Infrastructure
- Reconciler decomposition — 952-line monolith controller decomposed into 7 focused files. (#236)
- Complete
values.schema.json— Full property definitions for all Helm values with types, descriptions, and enum constraints. (#240) - CRD sync in release pipeline — Exact sync (
rm + cp) ensures Helm chart ships current CRDs. (#240) values.schema.jsonwebhook port constraint — Port range validated to 1-65535. (#240)
📊 Stats
| Metric | Value |
|---|---|
| PRs merged | 9 (6 this session) |
| Files changed | 120+ |
| Lines added | ~3,300 |
| Lines removed | ~500 |
| Engineering review findings fixed | 18 |
| CodeRabbit comments resolved | 9 |
Full Changelog: v0.8.2...v0.9.0
v0.8.2
v0.8.1
7f8c195
This commit was signed with the committer’s verified signature.
Changelog
Bug fixes
- aeb4da3 fix: goreleaser v2 hook format — string not map (#227)
- 68086aa fix: handle Zitadel map-based OIDC role claims in group extraction (#226)
- 0f40eaa fix: release workflow — add node, buf, and proto codegen for dashboard build (#228)
Others
- 7f8c195 refactor: replace hand-rolled sortStrings with slices.Sort
v0.6.2
a5b210d
This commit was signed with the committer’s verified signature.
v0.6.1
v0.6.0
Changelog
Features
Others
- b9dc7cf server: Add CORS middleware for browser/SPA clients (#169)
- 510102d server: Add envtest security integration test suite (#167)
- 0a810f2 server: Implement List pagination with page_size/page_token (#170)
- 0569be3 server: Pass UID and Extra claims through TokenReview to SubjectAccessReview (#166)
- aca7810 server: Phase 1 security hardening (#156)
- 04730b5 server: Scope server RBAC to target namespaces for pods/log access (#165)
- 5dc52f2 server: wire AuditLogger into auth middleware and authz for structured security events (#164)