v0.3.1

Important: This release fixes several medium server-side security issues (GHSA-9c2x-rm59-4335). Users running minder should upgrade to the ghcr.io/mindersec/minder/helm/minder:0.20260810.5249_ref.f0b736a Helm chart or later. The security issues were:

• An information leak in GetRuleById if users could guess or find another project's rule id (a UUID)
• A privilege escalation where editors on a project could delete providers in the project
• Some non-public NAT IP ranges were not blocked during Rego policy evaluation

Client-side changes

Several small changes to support the mindersec/minder-action/test action and mindev test:

• feat(ruletest): Expose rule evaluation output to Starlark tests by @krrish175-byte in #6666
• feat(ruletest): expose eval output to Starlark tests and fix CWD-sensitive path resolution by @krrish175-byte in #6682
• fix(ruletest): initialize params map to prevent panic on template rendering by @krrish175-byte in #6688

Server-side changes

• Fix a few control oversights by @evankanderson in #6689

Development changes

• Prevent Compose from creating config directory by @maxi-maxima in #6681

Minor / dependency changes

• Update dependabot for codeql-action by @evankanderson in #6649
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.28 to 1.6.29 by @dependabot[bot] in #6665
• build(deps): bump coverallsapp/github-action from 2.3.7 to 2.3.8 by @dependabot[bot] in #6664
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #6662
• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #6663
• build(deps): bump github.com/erikgeiser/promptkit from 0.11.0 to 0.12.0 by @dependabot[bot] in #6660
• build(deps): bump github.com/openfga/openfga from 1.18.0 to 1.18.1 by @dependabot[bot] in #6658
• build(deps): bump styled-components from 6.4.3 to 6.4.4 in /docs by @dependabot[bot] in #6655
• build(deps): bump the codeql group with 2 updates by @dependabot[bot] in #6661
• build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #6656
• Upgrade lestrrat-go/jwx to v3 by @evankanderson in #6668
• Fix lint errors which crept into the codebase by @evankanderson in #6670
• build(deps): bump brace-expansion in /docs by @dependabot[bot] in #6671
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6680
• build(deps): bump github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1 by @dependabot[bot] in #6678
• build(deps-dev): bump globals from 17.7.0 to 17.8.0 in /docs by @dependabot[bot] in #6674
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.42.1 to 1.43.3 by @dependabot[bot] in #6676
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #6677
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6679
• build(deps-dev): bump markdownlint-cli2 from 0.23.1 to 0.23.2 in /docs by @dependabot[bot] in #6673
• build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /docs by @dependabot[bot] in #6683
• build(deps): bump github.com/cloudevents/sdk-go/observability/opentelemetry/v2 from 2.16.1 to 2.16.2 by @dependabot[bot] in #6675
• build(deps): bump mermaid from 11.15.0 to 11.16.1 in /docs by @dependabot[bot] in #6685
• build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 by @dependabot[bot] in #6687
• build(deps): bump dompurify from 3.4.11 to 3.4.13 in /docs by @dependabot[bot] in #6686

New Contributors

• @maxi-maxima made their first contribution in #6681

Full Changelog: v0.3.0...v0.3.1