Repository navigation
Release 1.19.0 - #171
Merged
Merged
Release 1.19.0#171
Conversation
A string direction is deprecated in doctrine/orm 3.
MariaDB commits implicitly on every schema change, so the wrapping transaction was already committed and doctrine/migrations deprecates silencing that.
fix: clear Doctrine sort direction and migration transaction deprecations
feat: update EasyAdmin to 5.7
fix: update composer packages
Ignore dir results older than the server's latest, so replays cannot apply an old list. Attach sites to the listed dir they are in instead of a LIKE prefix, where _ was a wildcard, and delete sites and results outside every listed dir.
An unchanged dir result only had its timestamp updated, so sites recreated after it was first processed, e.g. by a docker replay, were never removed.
Run app:data:purge on the default schedule at 03:00 with up to 30 minutes jitter. --date now takes relative dates such as "30 days ago". The worker consumes scheduler_default.
Attribute tasks such as the purge cannot be stateful on their own, and the worker restarts every 15 minutes, so the jittered purge would skip most days. Turn DrupalReleaseSchedule into the stateful default schedule that attribute tasks join, and consume only scheduler_default.
The worker resets services after each message, which replaces a closed EntityManager, and failed messages are retried and then sent to the failed transport. Stopping on every failure only restarted the worker.
8669: Clean up removed sites and purge old detection results
The site filter test now removes the fixture sites it does not set up, the link command test counts from what the fixtures already link, the module sort test checks the order of the counts, and the linker test checks the module is not linked by name rather than not linked at all.
Made-up data shaped like production: a repo checked out at two versions with overlapping advisories, a repo without advisories, a release deployment without a repo, drupal.org and Packagist advisories with and without a CVE, one CVE under two advisory ids, and Drupal modules linked to their Composer packages. A test pins these cases and that only example data is used.
One file per area: servers, sites with the detection results behind them, git repos, packages and advisories, Docker images, projects with code owners and security contracts, OIDC and service certificates. Every entity, detection type, server type and site type is represented, with made-up values shaped like production. FixturesTest pins the scenarios, that replaying the detection results rebuilds the same installations and sites, that each server's dir result lists all its installations, and that only example data is used. Tests tied to the old fixtures now use the shop sites, the never-harvested gpu-01 server or counts relative to the fixtures.
On a site's detail page, an advisory can be marked as not affected with a reason, one at a time or all current ones at once, and a mark can be removed. A mark belongs to the git repo, so it covers every checkout of it, and sites without a repo cannot be marked. Marked advisories no longer count on the site list, in its sort or on the repo advisories page. Marks are stored by repo and advisory name, so truncating derived data and replays leave them in place.
8670: Rewrite the fixtures to cover all content
8670: Mark advisories as not affected per git repo
chore: update docker compose files from itkdev-docker templates
API Specification - Non-breaking changesNo changelog changes |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #171 +/- ##
=======================================
Coverage ? 76.77%
Complexity ? 1346
=======================================
Files ? 172
Lines ? 4121
Branches ? 0
=======================================
Hits ? 3164
Misses ? 957
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 1.19.0
nginx/nginx-unprivilegedimagesymfony/expression-languagefor CVE-2026-109449Minor: advisory assessments (a new feature), and the dir cleanup and nightly purge.
Deploy notes:
advisory_assessmenttable.scheduler_defaultinstead ofscheduler_drupal_releases.nginx/nginx-unprivileged:alpine, so pull images on deploy.bin/console app:replay:detection-results --type dockerto restore the 27 sites deleted by the 2026-10-19 dir replay.