Skip to content

0.3.404

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Oct 10:36
· 7 commits to main since this release
0.3.404
050d9ca

0.3.404

Pins snowplow and snowplow-crd to 1.12.37, carrying two unreleased security fixes:

  • Secret data leaked into OpenTelemetry logs. The debug-level "resolved api" log emitted every stage body, including Secret values, into otel_logs. Now suppressed.
  • Credentials leaked in spans and logs. URLs with embedded credentials were not scrubbed before being recorded in outbound client spans (url.full) or log fields. A schemeless URL bypassed the sanitiser entirely — url.Parse treated the leading token as the scheme, leaving no User field to clear, so passwords round-tripped verbatim.

Also included in 1.12.37 (no installer action required): re-mint warmth gating fix, live-refresh no longer dropping a quiet key's last change, and invalidation-to-fresh measurement.

One file changed: chart/files/component-pins.yaml.

Assets 2
Loading