Skip to content

chore(deps-dev): bump infrahub-testcontainers from 1.9.6 to 1.9.7#1068

Merged
ajtmccarty merged 1 commit into
stablefrom
dependabot/uv/stable/infrahub-testcontainers-1.9.7
Jun 8, 2026
Merged

chore(deps-dev): bump infrahub-testcontainers from 1.9.6 to 1.9.7#1068
ajtmccarty merged 1 commit into
stablefrom
dependabot/uv/stable/infrahub-testcontainers-1.9.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps infrahub-testcontainers from 1.9.6 to 1.9.7.

Release notes

Sourced from infrahub-testcontainers's releases.

Infrahub - v1.9.7

What's Changed

New Contributors

Full Changelog: opsmill/infrahub@infrahub-v1.9.6...infrahub-v1.9.7

Changelog

Sourced from infrahub-testcontainers's changelog.

Infrahub - v1.9.7 - 2026-06-03

Breaking Changes

  • Schema attribute and relationship names containing __ are now rejected at load time, since __ is reserved as the schema path separator. Any existing schema using such names will fail to load after upgrading — rename the affected attributes or relationships in your schema files (and remove or rename the corresponding data) before upgrading. (#9209)

Security

  • Added the INFRAHUB_SECURITY_SSO_ACCOUNT_NAME_FALLBACK setting (enabled by default) to control whether an SSO login without a linked identity may adopt a pre-existing account that matches by display name. This transitional behavior supports upgrades; disabling it once all SSO users have completed their first login is recommended as a hardening step. The fallback is deprecated and will be removed in a future release.
  • Enable cryptographic verification of the OIDC id_token (signature, audience and issuer) by default when reading group claims. This can be disabled through INFRAHUB_OIDC_<PROVIDER>_ID_TOKEN_VERIFY_SIGNATURE.
  • Local password changes are now refused for accounts that authenticate through an external directory (LDAP, OIDC, OAuth2). The self-service form is hidden in the UI and the GraphQL mutation rejects the request, preventing a user from bypassing directory-side revocation by setting a local password.

Fixed

  • Prefix pools no longer allocate the same prefix multiple times when the pool resource has the same prefix length as the requested allocation size. Prefix pools can now correctly allocate a prefix that uses an entire linked resource.
  • Fix schema processing crashing with 'NodeSchema' object has no attribute 'get' when a node defines a single-element relationship-only uniqueness_constraints entry (e.g. [["parent"]]). (#4483)
  • The 'Manage Groups' dropdown and the bulk 'Add to groups' toolbar now hide groups whose group_type is internal, so only user-assignable groups appear in the selector. (#4872)
  • RelationshipAdd now allows setting a cardinality-one relationship (previously, any attempt was rejected). A second add is rejected when a peer is already present. RelationshipRemove now enforces mandatory constraints on cardinality-many relationships and rejects removals that would leave a mandatory relationship with no peers. (#5794)
  • GraphQL variables used inside the data sub-object of IPPrefixPoolGetResource and IPAddressPoolGetResource mutations now resolve correctly instead of being silently ignored (set to null). (#6850)
  • Artifact diffs no longer show spurious changes for artifacts whose schema kind was renamed or moved to a different namespace on a branch. (#7490)
  • Fixed unique constraints not being enforced on computed attributes, and the violation message now names the input attributes to change. (#7924)
  • Fix user-check failure logs being emitted one character per line in the proposed change task output — each log entry from self.log_error(...) is now rendered as a single warning line. (#8224)
  • Honor INFRAHUB_CACHE_TLS_ENABLED, INFRAHUB_CACHE_TLS_INSECURE, and INFRAHUB_CACHE_TLS_CA_FILE for the Prefect result storage block. Background flows previously hung in RUNNING against TLS-only Redis because setup_blocks() constructed the block via a code path that ignored every TLS setting. The block now uses a redis:// or rediss:// connection string that propagates all three TLS knobs through redis.Redis.from_url, bringing the block into parity with the cache adapter and distributed lock. (#9217)
  • Fixed git repository sync where multiple task workers could diverge on different commits if upstream advanced during fan-out. (#9349)
  • Fixed S3 object storage failing with AuthorizationHeaderMalformed when no static AWS credentials are configured. When both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are unset, Infrahub now falls back to the default AWS credential provider chain, so S3 storage works with IRSA, EC2 instance profiles, and ECS task roles in addition to static access keys. Configuring only one of the two now raises a clear configuration error. (#9429)
  • A failed OIDC id_token verification — invalid signature, audience, issuer, or an unresolvable signing key — now returns an authorization error (HTTP 401) instead of an unhandled server error.
  • Fixed a crash when pulling a git repository that had to create a missing local branch and record its commit value.
  • Fixed the read-only git repository add flow broadcasting the wrong repository kind, which caused peer workers to materialize the new repository as read-write instead of read-only.
Commits
  • 1bcda1e chore: update docker-compose
  • 8ed0d4d chore: release 1.9.7 (#9446)
  • 7fe5303 Merge pull request #9443 from opsmill/pmi-20260603-fix-cubic-blocking-reviewe...
  • c89aa8d Merge pull request #9358 from opsmill/pmi-20260526-gh-aw-update
  • 9b08603 fix: resolve S3 credentials via AWS default chain when static keys are unset ...
  • 86f7be6 move the changelogs to the right dir (#9436)
  • 436878f fix(ci): drop 'edited' trigger from bug reviewer agent
  • 49cb868 Merge pull request #9437 from opsmill/pog-update-agents
  • 76850e4 feat(ci): gate bug pipeline on state/ai-pipeline-ready approval label
  • 0913ed8 chore(ci): bump gh-aw to v0.77.5 and recompile workflows
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Bumps dev dependency infrahub-testcontainers from 1.9.6 to 1.9.7 to run tests against the latest Infrahub. Test-only change that pulls in security and stability fixes; no runtime impact.

  • Migration
    • Test schemas using names with __ will now fail to load; rename if present.
    • OIDC id_token verification is on by default; adjust test OIDC config or set INFRAHUB_OIDC_<PROVIDER>_ID_TOKEN_VERIFY_SIGNATURE=false in tests if needed.

Written for commit e454758. Summary will update on new commits.

Review in cubic

@dependabot
chore(deps-dev): bump infrahub-testcontainers from 1.9.6 to 1.9.7
e454758 
Bumps [infrahub-testcontainers](https://github.com/opsmill/infrahub) from 1.9.6 to 1.9.7.
- [Release notes](https://github.com/opsmill/infrahub/releases)
- [Changelog](https://github.com/opsmill/infrahub/blob/stable/CHANGELOG.md)
- [Commits](opsmill/infrahub@infrahub-v1.9.6...infrahub-v1.9.7)

---
updated-dependencies:
- dependency-name: infrahub-testcontainers
  dependency-version: 1.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the type/housekeeping Maintenance task label Jun 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 8, 2026 09:15
@dependabot dependabot Bot added the type/housekeeping Maintenance task label Jun 8, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying infrahub-sdk-python with  Cloudflare Pages  Cloudflare Pages

Latest commit: e454758
Status:🚫  Deploy failed.

View logs

@ajtmccarty ajtmccarty merged commit 4111d1a into stable Jun 8, 2026
17 of 18 checks passed
@ajtmccarty ajtmccarty deleted the dependabot/uv/stable/infrahub-testcontainers-1.9.7 branch June 8, 2026 19:11
@infrahub-github-bot-app infrahub-github-bot-app Bot mentioned this pull request Jun 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ajtmccarty ajtmccarty ajtmccarty approved these changes

Assignees

No one assigned

Labels

type/housekeeping Maintenance task

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ajtmccarty