cloud/ocis
1
0
Fork 0
mirror of https://github.com/owncloud/ocis.git synced 2026-10-23 23:29:02 +03:00
Code Activity
23,044 Commits 164 Branches 209 Tags
test-cli-postprocessing-resume
Commit Graph

702 Commits

Author SHA1 Message Date
dependabot[bot]
c8224fd434 build(deps): bump the minor-and-patch group across 1 directory with 7 updates (#13126) 
Bumps the minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-chi/httprate](https://github.com/go-chi/httprate) | `0.16.0` | `0.16.1` |
| [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) | `3.4.14` | `3.4.15` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.15.0` | `2.15.1` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.19.1` | `1.20.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.71.0` | `0.72.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` |



Updates `github.com/go-chi/httprate` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/go-chi/httprate/releases)
- [Commits](https://github.com/go-chi/httprate/compare/v0.16.0...v0.16.1)

Updates `github.com/go-ldap/ldap/v3` from 3.4.14 to 3.4.15
- [Release notes](https://github.com/go-ldap/ldap/releases)
- [Commits](https://github.com/go-ldap/ldap/compare/v3.4.14...v3.4.15)

Updates `github.com/nats-io/nats-server/v2` from 2.15.0 to 2.15.1
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.15.0...v2.15.1)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0)

Updates `github.com/tidwall/gjson` from 1.19.1 to 1.20.0
- [Commits](https://github.com/tidwall/gjson/compare/v1.19.1...v1.20.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.71.0 to 0.72.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.71.0...zpages/v0.72.0)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](https://github.com/golang/sync/compare/v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: github.com/go-chi/httprate
  dependency-version: 0.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/go-ldap/ldap/v3
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-12 16:13:34 +02:00
Firas Frikha
69433426be chore(deps): [OCISDEV-901] bump reva to the legacy upload removal (#13112) 
Signed-off-by: Firas Frikha <firas.frikha@kiteworks.com>
 2026-10-12 11:51:14 +02:00
Prajwol Amatya
c0c15f8cab chore: bump golang.org/x/net version (#13120) 2026-10-12 09:31:15 +02:00
LarsJurgensen
cc8c1c883f ci: [k6-test] [OCISDEV-900] Extract upload coordinator out of decomposedfs (#12913) 
* chore(OCISDEV-900): bump reva to pr7-switchover, add upload_directory and mount_id to revaconfig

* chore(OCISDEV-900): bump reva to the switchover rebased on the upload write fix

* chore(OCISDEV-900): bump reva to main with the upload coordinator switchover

---------

Co-authored-by: Firas Frikha <firas.frikha@kiteworks.com>
 2026-10-07 18:28:34 +02:00
Michal Klos
90d58ae47d feat: [OCISDEV-1437] show suggested expiry date of 30 days (#12988) 2026-10-07 16:03:09 +02:00
Michal Klos
b9077d96d8 chore(deps): consolidate dependency and security bumps (#13081) 
* chore(deps): consolidate dependency and security bumps

Dependabot PRs applied:
- #12878 qs 6.15.2 -> 6.16.0 (web/web-runtime)
- #13013 alpine 3.24.1 -> 3.24.2
- #13061 actions/checkout -> v7.0.1 (missed instance in k8s.yml)
- #13062 actions/setup-node -> v7.0.0 (missed instance in k8s.yml)
- #13075 simple-git 3.36.0 -> 4.0.1 (security)
- #13076 katex 0.16.45 -> 0.18.2+ (security)
- #13077 dompurify 3.4.13 -> 3.4.16 (security)
- #13079 go deps minor-and-patch group, 18 updates (opa 1.19.0 -> 1.21.1, otel 1.46 -> 1.47, bleve, govips, grpc-gateway, lico, tablewriter, logrus, gjson, x/exp, x/image, genproto, etc.)

Skipped (already satisfied on master): #12513, #12624, #12625, #12633

Manual security bumps via pnpm.overrides (no dependabot PR existed):
- axios -> 1.20.0
- smol-toml -> 1.9.0
- postcss -> 8.5.23
- postcss-selector-parser -> 7.1.6
- colord -> 2.9.4
- unhead -> 2.1.13
- markdown-it -> 14.3.1
- esbuild -> 0.28.1
- brace-expansion 5.0.11 -> 5.0.12

Not fixable: sprintf-js and elliptic have no patched version released upstream yet; left as-is.

go build and pnpm install verified clean.

* chore(deps): fix residual transitive vulns found by trivy

trivy flagged duplicate/stale resolutions that survived the earlier
override pass: dompurify (3.4.12 -> 3.4.16), qs (6.14.2 -> 6.16.0),
and fast-uri (3.1.7 -> 3.1.8, CVE-2026-86472). Added/bumped pnpm.overrides
accordingly. trivy fs scan of web/pnpm-lock.yaml now clean.

* chore(deps): bump reva to bac0e1ee144ab853a81c6b02142032f102dd245a

Pins github.com/owncloud/reva/v2 to bac0e1ee144ab853a81c6b02142032f102dd245a,
pulling in its go-playground/locales and huandu/xstrings version bumps.
Appends this PR to changelog/unreleased/bump-reva.md.

go build ./... verified clean after go mod vendor resync.

* fix(ci): revert unhead override, breaks web build

* revert: keep k8s.yml actions/checkout and setup-node pinned
 2026-10-07 07:56:56 +02:00
Roman Perekhod
9143307b70 fix: [ocisdev-1433] fix public share, add The grpc clients keepalive and more (#13020) (#13068) 
* fix: the public share configuration and fixed graceful shutdown

* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE

The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.

Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.

* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.

* chore: bump reva

* fix: The keepalive added to grpc clinet

* chore: bump reva

* build(deps): bump go 1.26.8, grpc-go dependency

---------

(cherry picked from commit e86eb4d210)

For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

# Conflicts:
#	changelog/unreleased/security-bump-grpc.md
#	go.mod
#	go.sum
#	vendor/google.golang.org/grpc/server.go
#	vendor/google.golang.org/grpc/stream.go
#	vendor/google.golang.org/grpc/version.go
#	vendor/modules.txt
 2026-10-06 17:21:46 +02:00
Roman Perekhod
c4a6948a67 chore: bump deps (reva, web, golang) (#13066) 
* chore: bump reva

* chore: bump pnpm dependencies

* fix: avoid go vet false positive in userlog conversion.go

The go.mod bump to go 1.26.8 made go vet flag loadTemplates' calls to
t.Get(nt.Subject/nt.Message) as non-constant format strings, breaking
the build for services/userlog/pkg/service. These are translation
lookup keys, not printf format strings, so route the call through a
local func value to defeat vet's static trace.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* chore: bump grpc

Fixes GO-2026-6443, a server panic when handling requests missing
authority or Host headers, flagged by govulncheck in CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-05 11:59:28 +00:00
Michal Klos
533b0d011b feat: [OCISDEV-1392] retry failed blob commit after postprocessing (#12970) 2026-09-18 15:09:02 +02:00
Matteo
0642bb1514 fix(deps): bump reva to fix restoring already-restored trash item returns 500 (#12969) 
fix(deps): bump reva to pull in ErrNotExist->NotFound fix for RestoreRecycleItem

Restoring an already-restored/purged trash item returned 500 CODE_INTERNAL
instead of 404. Fixed upstream in owncloud/reva#740; bump the vendored reva
to 98fec04d9 to pick it up.
 2026-09-18 07:05:53 +02:00
Firas Frikha
6d8bd29cef fix: [OCISDEV-1200] do not share vault resources with users who cannot access them (#12905) 
* fix: [OCISDEV-1200] do not leak vault file names via share notifications

* test: [OCISDEV-1200] fix apiVault scenarios for users without vault mode
 2026-09-14 15:49:35 +02:00
dependabot[bot]
b29dc89349 build(deps): bump the minor-and-patch group with 9 updates (#12805) 
Bumps the minor-and-patch group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.4` | `2.14.5` |
| [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) | `1.52.0` | `1.53.1` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.32.0` | `2.32.1` |
| [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.4` | `1.10.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` | `0.55.0` |
| [golang.org/x/image](https://github.com/golang/image) | `0.44.0` | `0.45.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.57.0` | `0.58.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.40.0` | `0.41.0` |
| google.golang.org/protobuf | `1.36.11` | `1.36.12` |


Updates `github.com/nats-io/nats-server/v2` from 2.14.4 to 2.14.5
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.14.4...v2.14.5)

Updates `github.com/nats-io/nats.go` from 1.52.0 to 1.53.1
- [Release notes](https://github.com/nats-io/nats.go/releases)
- [Commits](https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.1)

Updates `github.com/onsi/ginkgo/v2` from 2.32.0 to 2.32.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.32.0...v2.32.1)

Updates `github.com/sirupsen/logrus` from 1.9.4 to 1.10.0
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sirupsen/logrus/compare/v1.9.4...v1.10.0)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0)

Updates `golang.org/x/image` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/image/compare/v0.44.0...v0.45.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](https://github.com/golang/net/compare/v0.57.0...v0.58.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.40.0...v0.41.0)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats.go
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 10:03:50 +02:00
Gaurav Soni
ef41e736d1 fix: [OCISDEV-388] renaming a resource to its current name is a no-op (#12784) 
A MOVE whose source and destination resolve to the same resource is now
answered with 204 No Content server side instead of a confusing 403 or
404, and instead of 409 Conflict on the id based dav route, so every
client behaves the same way. The no-op still requires the move
permission.

The server-side guard lives in reva (owncloud/reva#708 and the follow-up
owncloud/reva#713, which moves the guard above the recursion checks so it
is also reached when the request addresses the resource by its id).
Pulled in here by bumping reva to v2.0.0-20260813121157-d386075a0421.
vendor/ was regenerated with `go mod vendor`; no hand edits.

On the test side the @issue-1976 tags are dropped from the five MOVE
feature files and the corresponding entries are removed from both
expected-failures lists. Scenario Outlines that mix roles with and
without the move permission parameterize the expected status in an extra
http-status-code Examples column rather than being split into duplicate
scenarios. The gherlint newline_before_scenario rule is configured as
["error", 2, true], counting tag lines toward the total, so the eight
scenarios that lost their tag get back the blank line it occupied.

Drop the "viewer" row from the same-name Examples table in
moveByFileId.feature: "viewer" is not a valid space role for a
permissionsRole invitation, so the step errored with
Role 'viewer' not found, and the "Space Viewer" row already covers
the 403.
 2026-08-14 10:50:35 +02:00
Michal Klos
d9bae04aee feat: [OCISDEV-1115] harden nats communication (#12777) 
* feat: [OCISDEV-1115] harden nats communication

* feat: bump reva for tls-enabled stores
 2026-08-13 09:56:24 +00:00
Michal Klos
90148451c8 chore: bump go and web packages (#12765) 
* chore: bump go packages

* chore: bump web packages
 2026-08-10 11:43:14 +02:00
kobergj
003e8cddb8 fix(storage-users): add --orphaned upload session filter (#12739) 
Bump reva to pick up the fix for upload sessions whose node metadata can no
longer be read. Such sessions can never finish postprocessing, stay in
processing state indefinitely and keep consuming the quota of their space.
Cleaning them previously removed the uploaded bytes without releasing the quota.

Wire up the new Orphaned session filter so operators can list the affected
sessions and remove them with --clean:

    ocis storage-users uploads sessions --orphaned
    ocis storage-users uploads sessions --orphaned --clean

Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
 2026-08-06 15:00:09 +02:00
Matteo
092be75ca0 Fix/ocisdev 1165/resource with same name gets prefix on share (#12730) 
* feat: bump reva

Bumps reva to 441d6e77b33d, pulling in the vault/non-vault share
mountpoint collision fix, decomposedfs DisableVersioning aspect
handling, ChunkHandler.Assemble/scan fields, and LDAP retry policy
config. Also picks up the transitive nats-server, grpc, go-sqlite3
and antithesis-sdk-go bumps from reva's go.mod.

* docs: add changelog for vault share mountpoint collision fix

Documents the reva fix (owncloud/reva#691) that stops resources shared
under the same name from vault and non-vault mountpoints from getting
a spurious (1) suffix.
 2026-08-06 07:19:09 +02:00
dependabot[bot]
19c1cd2fa2 build(deps): bump the minor-and-patch group across 1 directory with 3 updates (#12728) 
Bumps the minor-and-patch group with 3 updates in the / directory: [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype), [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) and [github.com/rogpeppe/go-internal](https://github.com/rogpeppe/go-internal).


Updates `github.com/gabriel-vasile/mimetype` from 1.4.13 to 1.4.15
- [Release notes](https://github.com/gabriel-vasile/mimetype/releases)
- [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.13...v1.4.15)

Updates `github.com/open-policy-agent/opa` from 1.18.2 to 1.19.0
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v1.18.2...v1.19.0)

Updates `github.com/rogpeppe/go-internal` from 1.15.0 to 1.16.0
- [Release notes](https://github.com/rogpeppe/go-internal/releases)
- [Commits](https://github.com/rogpeppe/go-internal/compare/v1.15.0...v1.16.0)

---
updated-dependencies:
- dependency-name: github.com/gabriel-vasile/mimetype
  dependency-version: 1.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/rogpeppe/go-internal
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-05 20:31:43 +02:00
Lukas Hirt
fc34bd9824 feat(ldap): [OCISDEV-1031] add opt-in LDAP connection pool (#12689) 
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.

Signed-off-by: Lukas Hirt <info@hirt.cz>

test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI

Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.

Signed-off-by: Lukas Hirt <info@hirt.cz>

fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults

Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.

Signed-off-by: Lukas Hirt <info@hirt.cz>

chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes

Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.

Signed-off-by: Lukas Hirt <info@hirt.cz>

docs: point changelog fragment at forward-port PR #12689
 2026-08-05 17:57:48 +02:00
Matteo
4ba02000fa fix: bump reva to allow space managers to remove others' shares (#12705) 
* fix: bump reva to allow space managers to remove others' shares

Space managers with the RemoveGrant permission on a resource could not
remove user shares created by other users; the share manager only allowed
the share's creator to remove it. This bumps reva to the commit that fixes
Unshare to also honor the RemoveGrant permission.

* fix(l10n): route gotext.Locale calls through func fields to satisfy go vet

Bumping reva pulled in reva's go 1.26 requirement, and go 1.26's stricter
printf vet analyzer now sees through the OcisLocale interface to flag
gotext.Locale.Get as a printf-wrapper, breaking go test across 5 packages.
Forwarding through func fields hides that static trail from vet.
 2026-08-04 13:42:08 +02:00
Michal Klos
86fa96362a feat: [OCISDEV-855] receivedsharecache: retry on transient storage errors in CAS loop (#12621) 2026-07-24 19:43:46 +02:00
dependabot[bot]
d65f3fc215 build(deps): bump the minor-and-patch group across 1 directory with 12 updates (#12607) 
Bumps the minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/beevik/etree](https://github.com/beevik/etree) | `1.6.0` | `1.7.0` |
| [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) | `3.19.0` | `3.20.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.0` | `5.3.1` |
| [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) | `3.4.13` | `3.4.14` |
| [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) | `1.8.22` | `1.8.23` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.82.0` | `1.82.1` |



Updates `github.com/beevik/etree` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/beevik/etree/releases)
- [Changelog](https://github.com/beevik/etree/blob/main/RELEASE_NOTES.md)
- [Commits](https://github.com/beevik/etree/compare/v1.6.0...v1.7.0)

Updates `github.com/coreos/go-oidc/v3` from 3.19.0 to 3.20.0
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0)

Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.1
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1)

Updates `github.com/go-ldap/ldap/v3` from 3.4.13 to 3.4.14
- [Release notes](https://github.com/go-ldap/ldap/releases)
- [Commits](https://github.com/go-ldap/ldap/compare/v3.4.13...v3.4.14)

Updates `github.com/kovidgoyal/imaging` from 1.8.22 to 1.8.23
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.22...v1.8.23)

Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0)

Updates `golang.org/x/image` from 0.43.0 to 0.44.0
- [Commits](https://github.com/golang/image/compare/v0.43.0...v0.44.0)

Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0)

Updates `golang.org/x/text` from 0.38.0 to 0.40.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0)

Updates `google.golang.org/grpc` from 1.82.0 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1)

---
updated-dependencies:
- dependency-name: github.com/beevik/etree
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/go-ldap/ldap/v3
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.8.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 08:19:45 +00:00
Roman Perekhod
aa9aa9b454 fix: [OCISDEV-810] fix the space role and custom role checks (#12540) 
* fix: [OCISDEV-810] fix the space role and custom role checks

* test: [OCISDEV-810] expect 400 when updating a share to a disabled role

The update (PATCH) permission handlers now enforce the admin role
allowlist, consistent with invite. Updating a share to a disabled role
(Secure Viewer, Denied, Space Editor Without Versions) therefore returns
400 instead of the previous silent 200. Update the @issue-10768 scenarios
to assert the new, correct behavior.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-10 15:13:52 +02:00
Matteo
380273bb84 Feat/ocisdev 949/disable direct sharing (#12542) 
* build(deps): [OCISDEV-949] bump reva to v2.0.0-20260709150645-a9d5432e6f7f

Includes owncloud/reva#651, which adds the enable_user_sharing and
enable_public_sharing config options this feature depends on.

* feat: [OCISDEV-949] add options to disable direct and public sharing

Adds two independent, per-deployment config options:

- OCIS_ENABLE_USER_SHARING (default true), read by the frontend, graph,
  sharing and ocm services. When false, creating new user, group or
  federated shares is rejected (via reva's usershareprovider and
  ocmshareprovider, and via the graph Invite endpoint for the modern web
  client), the legacy sharees search endpoint returns no results, and
  the files_sharing.user.enabled / user_enumeration.enabled capabilities
  report false so the web UI hides the "share with people" search.
  Space membership invites are exempt.

- OCIS_ENABLE_PUBLIC_SHARING (default true), read by the frontend and
  sharing services. When false, creating new public links is rejected
  via reva's publicshareprovider, and files_sharing.public.enabled
  reports false so the web UI hides public link creation.

The two settings are fully independent of each other.
 2026-07-10 11:59:08 +02:00
Roman Perekhod
c66464cab6 fix: [OCISDEV-825] Rate-limit the exportPersonalData endpoint (#12519) 
* fix: Rate-limit the exportPersonalData endpoint

* fix: the RequreSelfUserID validation middleware added
 2026-07-08 14:57:44 +02:00
Michal Klos
6d31212600 fix: [OCISDEV-756] harden ocm create share (#12496) 
* fix: harden ocm create share

* chore: bump traefik
 2026-07-08 13:26:43 +02:00
dependabot[bot]
b59170681e build(deps): bump the minor-and-patch group across 1 directory with 8 updates (#12503) 
Bumps the minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/gookit/config/v2](https://github.com/gookit/config) | `2.2.8` | `2.2.9` |
| [github.com/jellydator/ttlcache/v3](https://github.com/jellydator/ttlcache) | `3.4.0` | `3.4.1` |
| [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) | `1.8.21` | `1.8.22` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.2` | `2.14.3` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.31.0` | `2.32.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.42.0` | `1.42.1` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.17.1` | `1.18.2` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.81.1` | `1.82.0` |



Updates `github.com/gookit/config/v2` from 2.2.8 to 2.2.9
- [Release notes](https://github.com/gookit/config/releases)
- [Commits](https://github.com/gookit/config/compare/v2.2.8...v2.2.9)

Updates `github.com/jellydator/ttlcache/v3` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/jellydator/ttlcache/releases)
- [Commits](https://github.com/jellydator/ttlcache/compare/v3.4.0...v3.4.1)

Updates `github.com/kovidgoyal/imaging` from 1.8.21 to 1.8.22
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.21...v1.8.22)

Updates `github.com/nats-io/nats-server/v2` from 2.14.2 to 2.14.3
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.14.2...v2.14.3)

Updates `github.com/onsi/ginkgo/v2` from 2.31.0 to 2.32.0
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.31.0...v2.32.0)

Updates `github.com/onsi/gomega` from 1.42.0 to 1.42.1
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.42.0...v1.42.1)

Updates `github.com/open-policy-agent/opa` from 1.17.1 to 1.18.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v1.17.1...v1.18.2)

Updates `google.golang.org/grpc` from 1.81.1 to 1.82.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0)

---
updated-dependencies:
- dependency-name: github.com/gookit/config/v2
  dependency-version: 2.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/jellydator/ttlcache/v3
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.8.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Roman Perekhod <2403905@gmail.com>
 2026-07-06 12:38:16 +00:00
Michal Klos
ef24492d15 feat: ci, trivy scan (#12484) 
* feat: ci, trivy scan

* chore: bump github.com/go-acme/lego
 2026-06-30 09:35:40 +02:00
dependabot[bot]
01107973b3 build(deps): bump the minor-and-patch group with 3 updates (#12452) 
Bumps the minor-and-patch group with 3 updates: [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc), [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) and [golang.org/x/image](https://github.com/golang/image).


Updates `github.com/coreos/go-oidc/v3` from 3.18.0 to 3.19.0
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0)

Updates `go.etcd.io/bbolt` from 1.4.3 to 1.5.0
- [Release notes](https://github.com/etcd-io/bbolt/releases)
- [Commits](https://github.com/etcd-io/bbolt/compare/v1.4.3...v1.5.0)

Updates `golang.org/x/image` from 0.42.0 to 0.43.0
- [Commits](https://github.com/golang/image/compare/v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-version: 3.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.etcd.io/bbolt
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-26 11:39:57 +02:00
Roman Perekhod
f3d2bc0557 fix: [OCISDEV-828] Fix the response code on deleting a non-existing link share on a space (#12266) 
fix: Return 404 when deleting a non-existing link share on a space
 2026-06-22 14:10:44 +02:00
Juan Pablo Villafañez
4945eb6833 Autoprop (#12386) 
* feat: metadata autopropagation

* feat: autoprop support for MFA / vault mode

* fix: replace some http clients with reva ones

* chore: required lib update

* fix: adjust unit tests and generate new mocks

* fix: apply autopropagation to all regular graph routes

* chore: updated reva dependency

* fix: return the right decorator for the thumbnails

* fix: remove autopropagation headers in the proxy
 2026-06-19 10:43:41 +02:00
dependabot[bot]
5c3e20071d build(deps): bump the minor-and-patch group across 1 directory with 13 updates (#12440) 
Bumps the minor-and-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.1` | `2.14.2` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.29.0` | `2.31.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.41.0` | `1.42.0` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.16.2` | `1.17.1` |
| [github.com/tus/tusd/v2](https://github.com/tus/tusd) | `2.9.2` | `2.10.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.68.0` | `0.69.0` |
| [go.opentelemetry.io/contrib/zpages](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.68.0` | `0.69.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.52.0` | `0.53.0` |
| [golang.org/x/image](https://github.com/golang/image) | `0.41.0` | `0.42.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.55.0` | `0.56.0` |



Updates `github.com/nats-io/nats-server/v2` from 2.14.1 to 2.14.2
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2)

Updates `github.com/onsi/ginkgo/v2` from 2.29.0 to 2.31.0
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.29.0...v2.31.0)

Updates `github.com/onsi/gomega` from 1.41.0 to 1.42.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.41.0...v1.42.0)

Updates `github.com/open-policy-agent/opa` from 1.16.2 to 1.17.1
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/v1.17.1/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v1.16.2...v1.17.1)

Updates `github.com/tus/tusd/v2` from 2.9.2 to 2.10.0
- [Release notes](https://github.com/tus/tusd/releases)
- [Commits](https://github.com/tus/tusd/compare/v2.9.2...v2.10.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.68.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0)

Updates `go.opentelemetry.io/contrib/zpages` from 0.68.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0)

Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0
- [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.53.0)

Updates `golang.org/x/image` from 0.41.0 to 0.42.0
- [Commits](https://github.com/golang/image/compare/v0.41.0...v0.42.0)

Updates `golang.org/x/net` from 0.55.0 to 0.56.0
- [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0)

Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](https://github.com/golang/sync/compare/v0.20.0...v0.21.0)

Updates `golang.org/x/term` from 0.43.0 to 0.44.0
- [Commits](https://github.com/golang/term/compare/v0.43.0...v0.44.0)

Updates `golang.org/x/text` from 0.37.0 to 0.38.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/tus/tusd/v2
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/zpages
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 15:55:33 +02:00
LarsJurgensen
1ff20df320 chore: bump reva to 806e6 (#12439) 
chore: bump reva to 806e6cde7fe5c5ecc9d6cf6372fa67120cd0c344
 2026-06-16 10:14:24 +00:00
kobergj
9eebf487dc fix(deps): [OCISDEV-834] recover from dead NATS connections in nats-js-kv (#12404) 
Bumps the kobergj/plugins nats-js-kv replace pin to fc78af4, which fixes
hasConn() to treat a permanently-closed NATS connection as no connection.
Previously hasConn() only checked n.conn != nil, so once the client
exhausted its reconnect attempts the connection stayed non-nil but dead,
initConn() never re-ran, and every KV operation failed with
'nats: connection closed' until the pod was restarted.

Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-12 10:12:50 +02:00
Matteo
332299ded9 fix(deployments): prevent PostgreSQL restart loop by fixing volume mount path (#12359) 
Mount the named volume at /var/lib/postgresql instead of /var/lib/postgresql/data
to avoid initdb failures caused by lost+found directory on ext4 storage backends.
 2026-06-01 10:31:44 +02:00
dependabot[bot]
9b1ba66a5a build(deps): bump the minor-and-patch group with 18 updates (#12357) 
Bumps the minor-and-patch group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/blevesearch/bleve/v2](https://github.com/blevesearch/bleve) | `2.5.7` | `2.6.0` |
| [github.com/davidbyttow/govips/v2](https://github.com/davidbyttow/govips) | `2.16.0` | `2.18.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.5` | `5.3.0` |
| [github.com/gookit/config/v2](https://github.com/gookit/config) | `2.2.7` | `2.2.8` |
| [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.28.0` | `2.29.0` |
| [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) | `1.8.19` | `1.8.21` |
| [github.com/libregraph/lico](https://github.com/libregraph/lico) | `0.66.0` | `0.67.0` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.0` | `2.14.1` |
| [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) | `1.51.0` | `1.52.0` |
| [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) | `1.1.0` | `1.1.4` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.40.0` | `1.41.0` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.12.3` | `1.16.2` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.18.0` | `1.19.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.66.0` | `0.68.0` |
| [go.opentelemetry.io/contrib/zpages](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.64.0` | `0.68.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.51.0` | `0.52.0` |
| [golang.org/x/image](https://github.com/golang/image) | `0.39.0` | `0.41.0` |
| [google.golang.org/genproto/googleapis/api](https://github.com/googleapis/go-genproto) | `0.0.0-20260401024825-9d38bb4040a9` | `0.0.0-20260414002931-afd174a4e478` |


Updates `github.com/blevesearch/bleve/v2` from 2.5.7 to 2.6.0
- [Release notes](https://github.com/blevesearch/bleve/releases)
- [Commits](https://github.com/blevesearch/bleve/compare/v2.5.7...v2.6.0)

Updates `github.com/davidbyttow/govips/v2` from 2.16.0 to 2.18.0
- [Release notes](https://github.com/davidbyttow/govips/releases)
- [Commits](https://github.com/davidbyttow/govips/compare/v2.16.0...v2.18.0)

Updates `github.com/go-chi/chi/v5` from 5.2.5 to 5.3.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0)

Updates `github.com/gookit/config/v2` from 2.2.7 to 2.2.8
- [Release notes](https://github.com/gookit/config/releases)
- [Commits](https://github.com/gookit/config/compare/v2.2.7...v2.2.8)

Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.28.0 to 2.29.0
- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)
- [Commits](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.28.0...v2.29.0)

Updates `github.com/kovidgoyal/imaging` from 1.8.19 to 1.8.21
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.19...v1.8.21)

Updates `github.com/libregraph/lico` from 0.66.0 to 0.67.0
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/compare/v0.66.0...v0.67.0)

Updates `github.com/nats-io/nats-server/v2` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.14.0...v2.14.1)

Updates `github.com/nats-io/nats.go` from 1.51.0 to 1.52.0
- [Release notes](https://github.com/nats-io/nats.go/releases)
- [Commits](https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0)

Updates `github.com/olekukonko/tablewriter` from 1.1.0 to 1.1.4
- [Release notes](https://github.com/olekukonko/tablewriter/releases)
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.0...v1.1.4)

Updates `github.com/onsi/gomega` from 1.40.0 to 1.41.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.40.0...v1.41.0)

Updates `github.com/open-policy-agent/opa` from 1.12.3 to 1.16.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v1.12.3...v1.16.2)

Updates `github.com/tidwall/gjson` from 1.18.0 to 1.19.0
- [Commits](https://github.com/tidwall/gjson/compare/v1.18.0...v1.19.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.66.0 to 0.68.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.66.0...zpages/v0.68.0)

Updates `go.opentelemetry.io/contrib/zpages` from 0.64.0 to 0.68.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.64.0...zpages/v0.68.0)

Updates `golang.org/x/crypto` from 0.51.0 to 0.52.0
- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)

Updates `golang.org/x/image` from 0.39.0 to 0.41.0
- [Commits](https://github.com/golang/image/compare/v0.39.0...v0.41.0)

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20260401024825-9d38bb4040a9 to 0.0.0-20260414002931-afd174a4e478
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/blevesearch/bleve/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/davidbyttow/govips/v2
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/gookit/config/v2
  dependency-version: 2.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2
  dependency-version: 2.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.8.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/libregraph/lico
  dependency-version: 0.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats.go
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/olekukonko/tablewriter
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/zpages
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/genproto/googleapis/api
  dependency-version: 0.0.0-20260414002931-afd174a4e478
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 09:38:46 +02:00
Roman Perekhod
d7a7cd9033 feat: [OCISDEV-720] fix public link (#12332) 2026-05-21 17:55:15 +02:00
Matteo
7d566c1ea2 feat: expose MFA session duration as configurable capability (#12335) 2026-05-21 15:32:26 +02:00
Michal Klos
a091d099ce fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files read-only in Web frontend (#12346) 
* fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files as read-only in Web frontend

* fix: ci after godata bump

ocis CI bumped github.com/CiscoM31/godata from v1.0.10 → v1.0.11 as a transitive dependency of the reva bump. The new godata version parses "mail add 10 (invalid operator) as a parse error → 400 instead of unsupported operation → 501.

* fix ci: more precise role

* fix: bump reva to pull fix merged into reva
 2026-05-21 09:47:20 +00:00
dependabot[bot]
4f357e1c72 build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#12331) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 10:30:39 +02:00
Michal Klos
4b99dd8c8f chore: consolidated bumps and security updates (#12325) 
* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1

* chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3

* chore(deps): bump github.com/russellhaering/goxmldsig from 1.5.0 to 1.6.0

* build(deps): bump fpicalausa/remove-stale-branches from 2.4.0 to 2.6.1

* build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1

* build(deps): bump actions/download-artifact from 4.3.0 to 8.0.1

* build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.8

* chore(deps): bump github.com/shamaton/msgpack/v2 to v2.4.1 and reva to v2.0.0-20260519092700-9da01c6fb954

* chore: regenerate lock fil s and vendor

* chore: changelog

* fix: bump golang.org/x/image to v0.39.0 (GO-2026-4815, GO-2026-4961, GO-2026-4962)
 2026-05-19 12:52:58 +00:00
Michal Klos
d0cd414e3a fix: [OCISDEV-864] CI, fix passing version string value to image (#12309) 
* fix: release fix passing version string value to image

* fix: bump release tag

* chore: bump go-git

* fix: missing fcntl64 int the build image due to GHA image update
 2026-05-18 10:24:41 +02:00
Roman Perekhod
9e0ebd2c25 feat: bump reva to latest 2026-05-15 13:23:55 +02:00
Michal Klos
b2adb15d6d feat: drop drone (#12243) 2026-05-13 12:14:45 +02:00
Michal Klos
61b1817d0b chore: security dependency bumps (#12245) 
* chore: bump follow-redirects to >=1.16.0

* chore: bump @xmldom/xmldom to >=0.8.12

* chore: bump serialize-javascript to >=7.0.5

* chore: bump picomatch to 2.3.2 / 4.0.4

* chore: bump flatted to >=3.4.2

* chore: bump undici to >=7.24.0

* chore: bump svgo to >=4.0.1

* chore: bump minimatch to 3.1.3 / 5.1.8

* build(deps): bump i18next-http-backend in /services/idp

Bumps [i18next-http-backend](https://github.com/i18next/i18next-http-backend) from 2.7.3 to 3.0.5.
- [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next-http-backend/compare/v2.7.3...v3.0.5)

---
updated-dependencies:
- dependency-name: i18next-http-backend
  dependency-version: 3.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump amd64/alpine from 3.23.3 to 3.23.4 in /ocis/docker

Bumps amd64/alpine from 3.23.3 to 3.23.4.

---
updated-dependencies:
- dependency-name: amd64/alpine
  dependency-version: 3.23.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/setup-node from 6.3.0 to 6.4.0

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](53b83947a5...48b55a011b)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/setup-go from 6.3.0 to 6.4.0

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v6.3.0...4a3601121dd01d1626a1e23e37211e3254c1c06c)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0

Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.35.0 to 0.36.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](57a97c7e78...ed142fd067)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](d08e5c354a...bcafcacb16)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](153bb8e044...b430933298)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: lock file regenerate

* chore: bump Azure/go-ntlmssp to v0.1.1

---------

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-06 14:39:54 +02:00
Julian Koberg
ee264345ca feat(graph): [OCISDEV-807] add SpaceEditorWithoutVersionsWithoutTrashbin role 
Adds a new space membership role "Can edit" that allows creating, uploading,
downloading, editing, moving and deleting on a space without access to file
versions or the trashbin. Also bumps reva to include the corresponding role
constructor.

Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
 2026-04-27 09:23:36 +02:00
Michal Klos
eaaf8533f4 chore: bump packages, consolidated dependabot (#12240) 
* chore(deps): bump @testing-library/jest-dom in /services/idp

Bumps [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) from 6.6.4 to 6.9.1.
- [Release notes](https://github.com/testing-library/jest-dom/releases)
- [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/jest-dom/compare/v6.6.4...v6.9.1)

---
updated-dependencies:
- dependency-name: "@testing-library/jest-dom"
  dependency-version: 6.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1

Bumps [filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519) from 1.1.0 to 1.1.1.
- [Commits](https://github.com/FiloSottile/edwards25519/compare/v1.1.0...v1.1.1)

---
updated-dependencies:
- dependency-name: filippo.io/edwards25519
  dependency-version: 1.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Merge branch 'master' into dependabot/go_modules/github.com/russellhaering/goxmldsig-1.6.0

* build(deps): bump alpine from 3.23.3 to 3.23.4

Bumps alpine from 3.23.3 to 3.23.4.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: 3.23.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump arm64v8/alpine from 3.23.3 to 3.23.4 in /ocis/docker

Bumps arm64v8/alpine from 3.23.3 to 3.23.4.

---
updated-dependencies:
- dependency-name: arm64v8/alpine
  dependency-version: 3.23.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/cache from 5.0.4 to 5.0.5

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](668228422a...27d5ce7f10)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump github.com/go-acme/lego/v4 from 4.25.2 to 4.34.0

Bumps [github.com/go-acme/lego/v4](https://github.com/go-acme/lego) from 4.25.2 to 4.34.0.
- [Release notes](https://github.com/go-acme/lego/releases)
- [Changelog](https://github.com/go-acme/lego/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-acme/lego/compare/v4.25.2...v4.34.0)

---
updated-dependencies:
- dependency-name: github.com/go-acme/lego/v4
  dependency-version: 4.34.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.1 to 5.18.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.17.1...v5.18.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.18.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: regenerate pnpm-lock.yaml

* fix(ci): replace nc-based fakeoffice with Python HTTP server

BusyBox nc -k restarts between connections leaving a gap where the
collaboration service gets ECONNRESET at startup, so healthz never
binds and the 300s wait times out. Python HTTPServer is gap-free.

---------

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-21 15:59:21 +00:00
dependabot[bot]
351db4fb2e build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#12185) 
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-version: 3.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 11:20:40 +00:00
dependabot[bot]
a3a0b05b0d build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#12186) 
Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 10:12:22 +00:00
Michal Klos
a72f543def fix: [OCISDEV-730] actions compliance (#12187) 2026-04-08 09:53:58 +00:00