Security #37295
Closed
Security #37295
+383,671
−67,376
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* go get github.com/hashicorp/go-plugin * ./scripts/syncdeps.sh * make protobuf
* stacks: refactor promises so they declare id when starting * stacks: add some missing perEval promises * formatting
…#36762) * stacks: remove all the unnecessary ctx function parameters * fix missing context
…lock-ref updated some of the boilerplate text
Co-authored-by: rita <8647768+ritsok@users.noreply.github.com>
…rm-block-ref updates the terraform block ref to match new design doc
…corp#36757) Co-authored-by: Liam Cervante <liam.cervante@hashicorp.com>
* Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.5.1 to 4.5.2. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md) - [Commits](golang-jwt/jwt@v4.5.1...v4.5.2) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Run `./scripts/syncdeps.sh` --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sarah French <sarah.french@hashicorp.com>
Fix protov6 crash when refreshing resource with identity
* go get github.com/hashicorp/go-azure-helpers@v0.72.0 * .go-version to 1.24.1 * Run `./scripts/syncdeps.sh` This propagates the Go version upgrade * gcs : go get google.golang.org/api@v0.155.0 * gcs: go mod tidy * Run `./scripts/syncdeps.sh` * make generate && make protobuf
Updating descriptive example.
Update lower.mdx
…hicorp#36792) * Update URLs from www.terraform.io to developer.hashicorp.com * More updates to URLs linking to documentation in documentation and user-facing warnings/errors * More updates to URLs linking to documentation, in docs, code, test fixtures * Replace www.terraform.io/community with link to Community Forum * Apply suggestions from code review Co-authored-by: Rose M Koron <32436232+rkoron007@users.noreply.github.com> --------- Co-authored-by: Rose M Koron <32436232+rkoron007@users.noreply.github.com>
…ashicorp#36800) * Bump golang.org/x/net from 0.37.0 to 0.38.0 (fixes CVE-2025-22872) Signed-off-by: Ricard Bejarano <ricard@bejarano.io> * add changelog entry * go mod tidy Signed-off-by: Ricard Bejarano <ricard@bejarano.io> * Revert "add changelog entry" This reverts commit 88219e7. * make syncdeps Signed-off-by: Ricard Bejarano <ricard@bejarano.io> --------- Signed-off-by: Ricard Bejarano <ricard@bejarano.io>
…shicorp#36806) * Fix `ImportResourceState` RPC response decoding for identity data * add tests for importy by identity * re-run action for flakey UI test
* stacks: allow multiple removed blocks to target the same component * make linter happy * stacks: emit state updates for unclaimed components
* configschema: Add identity attribute to import block * Mark import target ID as legacy * Add test with import identity * Use ID or identity when importing via configuration * Add plan import tests * Review Feedback * Make sure to copy identity for ResourceInstanceObjects * Add helper for converting cty.Objects to string * Replace getProvider calls * Improve unknown object check
* ./scripts/changelog.sh nextminor This turns main into 1.13 dev branch * update PR template
Non-comparable diagnostics were being adding multiple times, which might also panic in the equality comparison
…ibutes to null (hashicorp#36824) * write-only attributes: internal providers should set write-only attributes to null * add changelog * fix copywrite headers
…corp#37267) * Add tests defining what are valid workspace names * Update workspace name validation to mark an empty string as not valid * Add change file * Add command-level test showing the "" workspace cannot be created or selected * Update invalid name error text to include empty string as invalid.
…orp#37275) * Disallow "" as the argument to workspaces delete command * Add change file
If both elements of the set have already been matched, there is no need to compare them again.
…compat skip set elem comparison when already matched
…ct against nil receiver (hashicorp#37254) * Add protection against nil receivers to SetConfig * Refactor code to use SetConfig method instead of setting ConfigRaw directly
…, instead of relying on backend implementations (hashicorp#37256) * Add test showing that users cannot delete the default workspace Note: in the test this validation is being returned from the local backend's `DeleteWorkspace` method, not the command itself. * Make the `workspace delete` command return early if the user is trying to delete the default workspace. Update test. * Clean up redundant parts of test
…shicorp#37163) * Include list schemas in provider json schemas * Only include list schemas in experimental builds
…hashicorp#37246) * Implement `ForPlan` method on `StateStoreConfigState`, add `Planner` interface * Rename `ForPlan` method to `Plan` * Allow plan files to contain information about state stores * Add code needed for representing a state store in the Plan struct, which is used when handling plan files * Add ability to read/write either a backend or state store's data in a plan file. Add some test coverage. * Update plan's `ProviderAddrs` method to include the provider used for PSS, if present * Split interfaces * Apply feedback from code review * Refactor `SetVersion` to use appropriate constructor * Split `ProviderAddrs` method test into two * Fix method call after rename * Fix test * Remove change to `(p *Plan) ProviderAddrs()` We may re-add this when we implement PSS for use during apply commands with plan files * Remove changes to test, now that the plan doesn't report the provider used for PSS anymore.
…nary-download-tf-stacks-cli Move `stacksplugin` cache to `.terraform.d`
* WIP * Reuse plan command for query CLI * Basic CLI output * Only fail a list request on error * poc: store query results in separate field * WIP: odd mixture between JSONs * Fix list references * Separate JSON rendering The structured JSON now only logs a status on which list query is currently running. The new jsonlist package can marshal the query fields of a plan. * Remove matcher * Store results in an extra struct * Structured list result logging * Move list result output into hooks * Add help text and additional flag * Disable query runs with the cloud backend for now * Review feedback
Ayush-Singh986
requested review from
jrhouston,
alexsomesan and
a team
as code owners
|
Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement Learn more about why HashiCorp requires a CLA and what the CLA includes 9 out of 10 committers have signed the CLA.
Have you signed the CLA already but the status is still pending? Recheck it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #
Target Release
1.13.x
Rollback Plan
Changes to Security Controls
Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.
CHANGELOG entry