Merge branch 'master' into enh/show_kubernetes_warnings

.ci/pipeline_definitions

@@ -46,7 +46,7 @@ dashboard:
         pull-request: ~
       steps:
         check:
-          image: 'node:20-alpine3.20'
+          image: 'node:22-alpine3.20'
     release:
       traits:
         version:

.github/renovate.json5

@@ -12,7 +12,7 @@
   ],
   ignorePaths: [
     "**/node_modules/**",
-    "**/.yarn/**",
+    "**/.yarn/**"
   ],
   customManagers: [
     {
@@ -21,9 +21,18 @@
       fileMatch: ["^\.ci\/pipeline_definitions$"],
       matchStrings: ["image: ['\"]?(?<depName>.*?):(?<currentValue>.*?)['\"]?\\s"],
       datasourceTemplate: "docker"
-    },
+    }
   ],
   packageRules: [
+    {
+      matchDepTypes: ["devDependencies"],
+      groupName: "Monthly Dev Dependencies",
+      schedule: ["on the first day of the month"]
+    },
+    {
+      matchUpdateTypes: ["patch"],
+      automerge: true
+    },
     {
       // Ignore major updates for these dependencies until we support ES modules
       matchDatasources: ["npm"],

.yarnrc.yml

@@ -58,4 +58,4 @@ supportedArchitectures:
     - linux
     - darwin
 
-yarnPath: .yarn/releases/yarn-4.3.1.cjs
+yarnPath: .yarn/releases/yarn-4.5.0.cjs

Dockerfile

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ############# builder #############
-FROM node:20-alpine3.20 AS builder
+FROM node:22-alpine3.20 AS builder
 
 WORKDIR /volume
 

VERSION

@@ -1 +1 @@
-1.77.0-dev
+1.78.0-dev

backend/lib/app.js

@@ -23,6 +23,12 @@ const { healthCheck } = require('./healthz')
 const { port, metricsPort } = config
 const periodSeconds = config.readinessProbe?.periodSeconds || 10
 
+// protect against Prototype Pollution vulnerabilities
+for (const ctor of [Object, Function, Array, String, Number, Boolean]) {
+  Object.freeze(ctor)
+  Object.freeze(ctor.prototype)
+}
+
 // resolve pathnames
 const PUBLIC_DIRNAME = resolve(join(__dirname, '..', 'public'))
 const INDEX_FILENAME = join(PUBLIC_DIRNAME, 'index.html')

backend/lib/cache/tickets.js

@@ -9,8 +9,8 @@ const _ = require('lodash')
 const logger = require('../logger')
 
 function init () {
-  const issues = {}
-  const commentsForIssues = {} // we could also think of getting rid of the comments cache
+  const issues = new Map()
+  const commentsForIssues = new Map() // we could also think of getting rid of the comments cache
   const emitter = new EventEmitter()
 
   function on (eventName, listener) {
@@ -38,15 +38,16 @@ function init () {
   }
 
   function getIssues () {
-    return _.values(issues)
+    return Array.from(issues.values())
   }
 
   function getCommentsForIssue ({ issueNumber }) {
-    return _.values(getCommentsForIssueCache({ issueNumber }))
+    const comments = getCommentsForIssueCache({ issueNumber })
+    return Array.from(comments.values())
   }
 
   function getIssue (number) {
-    return issues[number]
+    return issues.get(number)
   }
 
   function getIssueNumbers () {
@@ -62,23 +63,25 @@ function init () {
   }
 
   function getCommentsForIssueCache ({ issueNumber }) {
-    if (!commentsForIssues[issueNumber]) {
-      commentsForIssues[issueNumber] = {}
+    if (!commentsForIssues.has(issueNumber)) {
+      commentsForIssues.set(issueNumber, new Map())
     }
-    return commentsForIssues[issueNumber]
+    return commentsForIssues.get(issueNumber)
   }
 
   function addOrUpdateIssues ({ issues }) {
-    _.forEach(issues, issue => addOrUpdateIssue({ issue }))
+    for (const issue of issues) {
+      addOrUpdateIssue({ issue })
+    }
   }
 
   function addOrUpdateIssue ({ issue }) {
-    updateIfNewer('issue', issues, issue, 'number')
+    updateIfNewer('issue', issues, issue)
   }
 
   function addOrUpdateComment ({ issueNumber, comment }) {
     const comments = getCommentsForIssueCache({ issueNumber })
-    updateIfNewer('comment', comments, comment, 'id')
+    updateIfNewer('comment', comments, comment)
   }
 
   function removeIssue ({ issue }) {
@@ -87,37 +90,41 @@ function init () {
 
     const comments = getCommentsForIssueCache({ issueNumber })
 
-    _.unset(issues, issueNumber)
-    _.unset(commentsForIssues, issueNumber)
+    issues.delete(issueNumber)
+    commentsForIssues.delete(issueNumber)
 
     emitIssueDeleted(issue)
-    _.forEach(comments, emitCommmentDeleted)
+    for (const comment of comments.values()) {
+      emitCommmentDeleted(comment)
+    }
   }
 
   function removeComment ({ issueNumber, comment }) {
     const identifier = comment.metadata.id
     logger.trace('removing comment', identifier, 'of issue', issueNumber)
     const commentsForIssuesCache = getCommentsForIssueCache({ issueNumber })
-    _.unset(commentsForIssuesCache, identifier)
+    commentsForIssuesCache.delete(identifier)
     emitCommmentDeleted(comment)
   }
 
-  function updateIfNewer (kind, cachedList, item, itemIdentifier) {
-    const identifier = item.metadata[itemIdentifier]
-    const cachedItem = cachedList[identifier]
+  function updateIfNewer (kind, cachedMap, item) {
+    const identifier = kind === 'issue'
+      ? item.metadata.number
+      : item.metadata.id
+    const cachedItem = cachedMap.get(identifier)
     if (cachedItem) {
       if (isCachedItemOlder(cachedItem, item)) {
         if (!_.isEqual(cachedItem, item)) {
           logger.trace('updating', kind, identifier)
-          cachedList[identifier] = item
+          cachedMap.set(identifier, item)
           emitModified(kind, item)
         }
       } else {
         logger.warn(`skipped updating ${kind} with id ${identifier} as it was older`)
       }
     } else {
       logger.trace('adding new', kind, identifier)
-      cachedList[identifier] = item
+      cachedMap.set(identifier, item)
       emitAdded(kind, item)
     }
     return item

backend/lib/config/gardener.js

@@ -131,30 +131,22 @@ function parseConfigValue (value, type) {
   }
 }
 
-function getValueFromFile (filePath, type) {
-  try {
-    const value = fs.readFileSync(filePath, 'utf8')
-    return parseConfigValue(value, type)
-  } catch (error) {
-    return undefined
-  }
-}
-
-function getValueFromEnvironmentOrFile (env, environmentVariableName, filePath, type) {
-  const value = parseConfigValue(env[environmentVariableName], type)
-  if (value !== undefined) {
-    return value
-  }
-
-  if (filePath) {
-    return getValueFromFile(filePath, type)
-  }
-}
-
 module.exports = {
   assignConfigFromEnvironmentAndFileSystem (config, env) {
-    for (const { environmentVariableName, configPath, filePath, type = 'String' } of configMappings) {
-      const value = getValueFromEnvironmentOrFile(env, environmentVariableName, filePath, type)
+    for (const configMapping of configMappings) {
+      const {
+        environmentVariableName,
+        configPath,
+        filePath,
+        type = 'String'
+      } = configMapping
+      let rawValue = env[environmentVariableName] // eslint-disable-line security/detect-object-injection
+      if (!rawValue && filePath) {
+        try {
+          rawValue = fs.readFileSync(filePath, 'utf8') // eslint-disable-line security/detect-non-literal-fs-filename
+        } catch (err) { /* ignore error */ }
+      }
+      const value = parseConfigValue(rawValue, type)
 
       if (value !== undefined) {
         _.set(config, configPath, value)
@@ -224,6 +216,7 @@ module.exports = {
     return config
   },
   readConfig (path) {
-    return yaml.load(fs.readFileSync(path, 'utf8'))
+    const data = fs.readFileSync(path, 'utf8') // eslint-disable-line security/detect-non-literal-fs-filename
+    return yaml.load(data)
   }
 }