Skip to content

v0.9.0 — ライブラリがGitHubのリポジトリに毎日自動で追従し、既知の脆弱性がElastiCacheにも届く

Choose a tag to compare

View all tags
@MR-TABATA MR-TABATA released this 13 Oct 06:37
· 11 commits to main since this release
v0.9.0
0fb4791

The libraries a system uses now follow its GitHub repository on their own, every day — nothing to upload by hand — and known vulnerabilities cover ElastiCache engines too. This release adds migration 0022 (applied by migrate, as in the setup steps).

Added

  • Lockfiles now follow the application's GitHub repository, every day.
    A lockfile uploaded by hand is stale by tomorrow — the opposite of why
    SyncVey exists — so the way in is now a repository. Under an environment,
    Register and import takes a repository URL (or /tree/<branch>/<folder>
    for a monorepo, e.g. a different branch per environment) and reads the
    lockfiles at the top level — requirements.txt, package-lock.json,
    composer.lock, Gemfile.lock, go.mod — through GitHub's API. From then
    on a daily job (03:30; manage.py refresh_repos --force; off with
    REPO_REFRESH_ENABLED=false) re-imports them, so the library list and its
    vulnerabilities follow the repository without anyone touching it. The screen
    shows the last sync; a failed sync is shown as such and the last good list is
    kept. Nothing is called until a repository is registered, and only
    api.github.com is ever called: the URL is split into owner / repository /
    folder and never fetched as typed. Private repositories need a read-only
    token in SYNCVEY_GITHUB_TOKEN (read from the environment, never stored or
    logged). Importing one file by hand remains as a folded-away fallback and says
    it goes stale. Adds migration 0022.
  • Known vulnerabilities for ElastiCache Redis and Memcached. The same
    VULN_REFRESH_ENABLED=true job now looks ElastiCache engine versions up in
    NVD, with the same badge, CVE list and "AWS may have already fixed some of
    these" note as RDS. Only versions that carry a patch number (5.0.6,
    1.6.6) are checked: ElastiCache updates 7.1-style versions behind the
    scenes, so matching those would report CVEs that are already fixed.
    Valkey isn't in NVD and is skipped.

Changed

  • Importing a lockfile is now one button. The browser's own file control
    ("Choose File / No file chosen", plus a tooltip) is gone: press Import
    lockfile    , pick a file, and it is imported right away — no second click, and
    nothing left half-done after choosing. The hint under it says so.
  • The resource list and detail no longer say "EKS supports Kubernetes 1.34
    and later".     A past or nearing end-of-life version now shows just the
    fact — the version, the stages and the dates. Whether to update is left to
    you.
  • CVE descriptions from NVD are shown as the first sentence (or cut at a
    word with "…"), instead of a 300-character cut that could end mid-word.

Full changelog: v0.8.0...v0.9.0

Assets 2
Loading