diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml index b6aa1b0aa0..80e11e5d11 100644 --- a/.github/workflows/backend.yml +++ b/.github/workflows/backend.yml @@ -41,8 +41,8 @@ jobs: # full pipeline. On PRs, run only when backend-relevant paths changed. backend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.backend == 'true' }} steps: - - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@v7 + - uses: dorny/paths-filter@v4 id: filter with: filters: | @@ -59,15 +59,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -128,15 +128,15 @@ jobs: # Testcontainers requires Docker — ubuntu-latest has it pre-installed. steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -182,7 +182,7 @@ jobs: # against an ephemeral Postgres, asserts exit 0. services: postgres: - image: postgres:17-alpine + image: postgres:18-alpine env: POSTGRES_PASSWORD: migrator_smoke_pwd POSTGRES_DB: fsh_migrator_smoke @@ -196,15 +196,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -240,10 +240,10 @@ jobs: MIN_LINE: '80' steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json @@ -288,15 +288,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -336,15 +336,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 168528711c..eb60612f9f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,9 @@ name: CodeQL Analysis on: + push: + branches: [main] + paths: + - 'src/**' pull_request: branches: [main] paths: @@ -15,12 +19,16 @@ jobs: analyze: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: github/codeql-action/init@v3 + - uses: actions/checkout@v7 + - uses: github/codeql-action/init@v4 with: languages: csharp - - uses: actions/setup-dotnet@v5 + build-mode: manual + - uses: actions/setup-dotnet@v6 with: global-json-file: global.json - - run: dotnet build src/FSH.Starter.slnx -c Release - - uses: github/codeql-action/analyze@v3 + # NuGet audit is off for this build only. The weekly scan runs against an unchanged main, so a + # newly published advisory fails restore under TreatWarningsAsErrors and the code scan never runs + # (that is what broke it every week from 2026-10-19). Backend CI still gates advisories on every PR. + - run: dotnet build src/FSH.Starter.slnx -c Release -p:NuGetAudit=false + - uses: github/codeql-action/analyze@v4 diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml index 82d647ce3e..4d279e409c 100644 --- a/.github/workflows/frontend.yml +++ b/.github/workflows/frontend.yml @@ -27,8 +27,8 @@ jobs: outputs: frontend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.frontend == 'true' }} steps: - - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@v7 + - uses: dorny/paths-filter@v4 id: filter with: filters: | @@ -50,10 +50,10 @@ jobs: working-directory: clients/${{ matrix.app }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -83,10 +83,10 @@ jobs: working-directory: clients/${{ matrix.app }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -125,7 +125,7 @@ jobs: app: [admin, dashboard] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Build image run: docker build -t fsh-${{ matrix.app }}:ci clients/${{ matrix.app }} diff --git a/.github/workflows/template-smoke.yml b/.github/workflows/template-smoke.yml index ac2e7e4f80..7163bbd80a 100644 --- a/.github/workflows/template-smoke.yml +++ b/.github/workflows/template-smoke.yml @@ -41,20 +41,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: '22' - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -90,15 +90,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} diff --git a/deploy/docker/README.md b/deploy/docker/README.md index d5d0731cb4..5a908bbba2 100644 --- a/deploy/docker/README.md +++ b/deploy/docker/README.md @@ -9,9 +9,9 @@ This brings up the full stack on a single host: | `dashboard` | `fsh/dashboard:local` | `FSH_DASHBOARD_PORT` (default 8082) | Tenant dashboard (nginx + React) | | `migrator` | `fsh/dbmigrator:local` | — | One-shot: applies EF migrations + seeds the root tenant + creates the default admin user | | `postgres` | `postgres:18-alpine` | (internal) | Identity, tenant catalog, module schemas | -| `redis` | `valkey/valkey:9.1.0-alpine` | (internal) | HybridCache L2, Data Protection keys, idempotency store | -| `rustfs` | `rustfs/rustfs:1.0.0` | `FSH_S3_PORT` (default 9000), S3 API only | S3-compatible blob store for the Files module ([RustFS](https://rustfs.com)); published because browsers upload to it through presigned URLs | -| `mailpit` | `axllent/mailpit:v1.31.3` | `127.0.0.1:FSH_MAILPIT_PORT` (default 8025), SMTP 1025 internal | Local mail catcher ([Mailpit](https://mailpit.axllent.org)), only with the `mail-catcher` profile, which `.env.example` enables | +| `redis` | `valkey/valkey:9.1.3-alpine` | (internal) | HybridCache L2, Data Protection keys, idempotency store | +| `rustfs` | `rustfs/rustfs:1.0.4` | `FSH_S3_PORT` (default 9000), S3 API only | S3-compatible blob store for the Files module ([RustFS](https://rustfs.com)); published because browsers upload to it through presigned URLs | +| `mailpit` | `axllent/mailpit:v1.33.0` | `127.0.0.1:FSH_MAILPIT_PORT` (default 8025), SMTP 1025 internal | Local mail catcher ([Mailpit](https://mailpit.axllent.org)), only with the `mail-catcher` profile, which `.env.example` enables | The compose file does **not** include a reverse proxy or TLS terminator. You bring your own edge — Cloudflare Tunnel, AWS ALB, Tailscale Funnel, your existing nginx, anything that can route a TLS subdomain to a host:port on this machine. diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml index 448a43c1ac..73aebde685 100644 --- a/deploy/docker/docker-compose.yml +++ b/deploy/docker/docker-compose.yml @@ -35,7 +35,7 @@ services: # - "5432:5432" redis: - image: valkey/valkey:9.1.0-alpine + image: valkey/valkey:9.1.3-alpine container_name: fsh-redis restart: unless-stopped command: @@ -58,7 +58,7 @@ services: # - "6379:6379" rustfs: - image: rustfs/rustfs:1.0.0 + image: rustfs/rustfs:1.0.4 container_name: fsh-rustfs restart: unless-stopped environment: @@ -91,7 +91,7 @@ services: # everything else (private/, and keys from before public/ existed) needs a # presigned URL. Re-applied on every `up`, so it also narrows older policies. rustfs-init: - image: amazon/aws-cli:2.37.3 + image: amazon/aws-cli:2.39.3 container_name: fsh-rustfs-init restart: "no" depends_on: @@ -112,7 +112,7 @@ services: # Local mail catcher, started only with the mail-catcher profile # (COMPOSE_PROFILES in .env). SMTP (1025) stays on the compose network. mailpit: - image: axllent/mailpit:v1.31.3 + image: axllent/mailpit:v1.33.0 container_name: fsh-mailpit restart: unless-stopped profiles: [mail-catcher] diff --git a/deploy/terraform/.terraform-version b/deploy/terraform/.terraform-version index 850e742404..e34208c937 100644 --- a/deploy/terraform/.terraform-version +++ b/deploy/terraform/.terraform-version @@ -1 +1 @@ -1.14.0 +1.15.4 diff --git a/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl b/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl index 7abd670b63..a3c140d382 100644 --- a/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl +++ b/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl @@ -2,49 +2,52 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "6.46.0" - constraints = ">= 6.0.0, ~> 6.46" + version = "6.71.0" + constraints = ">= 6.0.0, ~> 6.71" hashes = [ - "h1:4TQ6PLtOXgRf3ojUYjUkwH2JSmio/pSi75Ok9k0CMDE=", - "h1:9OKHG3Cvawwk/1k96R+xSVjI7sSiQfbXuhFz/Psd6ME=", - "h1:HAB8KLxgUe1Pb+e8ile18AxzhNWeHV9FUBmEM5YHzNM=", - "h1:MtD90GmY1s4b3iKQlX8r6K06Y9Vx7JmB5sv1cBdw0rU=", - "h1:SbQ3sCRV99tzNDyCaq6O+UZpmYgzsCnXuJ6BhHmlwu8=", - "zh:0a771c2981bb31b8a8e6790f800f5ae9c860a0e05d39a249d16d557713299f6c", - "zh:0dd5ca8f1997a73f3fbadca80aefdc4e47785f2dcec189dd8828c4f835a02318", - "zh:56f6972652aa038b320c96de6460c48dd350244e5d2cdf6d43d62d27a7de8828", - "zh:792f9a16a3567795a8c7ad91a67253ee84a2a462791a7b920ef9c607529e324f", - "zh:7d8a41d268006a98e70457c606c60de5948c7e22e1192c40c8b2fe4d9c069450", - "zh:876a1033ebdd05b99d3f4e565881c7c4832c92aab5c91ee4c04903001d19a79f", - "zh:90aa9d7925be5a1d31f38c9c29117e68b91c7d0367f8f76f26df458935ea4f18", - "zh:94c8f5a40a646fbd1b85bc7a6efa88b3e260d9aef4c432091f26fa4319297631", + "h1:aLOQts7nCLMR0kb/jCdP56wlQQoGqhKLctKgtQjDopc=", + "h1:rMbzU/i9txGvoI/hiB6EMln0NlmxM/61SrI9XBvI41Q=", + "h1:sZCupscga0Grk22+04FNY1RYDeOcVbCTd6ff8+hsF94=", + "h1:tmOIsPrIHwR6en567EnkR0nqIr9yD0XQcadgSsPpG2g=", + "zh:09aa14408c5ab26915fb2a469b5eb67c06393a2054d78592ba4c32f7a882e918", + "zh:1d1138128dc4866f6c16b1ef3b871b3fd9a3dc648e9056e06e210d1817aa052b", + "zh:2c17a79821a0e06fbf1834a12e92227db29c2001fef7ef0b347af2e6dad83f14", + "zh:55616730a485c9c7283546a84f1ac5f8341152c5572338a54fc7af5f69ebfb92", + "zh:7e6461ec2976b5961a1d4f3c08c68fae0645d7f5e0a404f7647baa3b88d337d8", + "zh:7ec935166b2251d075fea980012f5267078785399585e8b443dca484fc57df0f", + "zh:885b3290cd48738cbf9ee8a6d47a4452889843f8f53b8cf67fc8c9b16e553721", + "zh:8930fb33c6c965f7cc82230cb7fbb0cfff9bb30becdfce5e0c2242512d849894", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a002ee5fa9d5d1010c59c266e64da989f60958321f8fa95c212460ea486412f0", - "zh:c5498f9502a209d1e51f1ac46ae53419a2fa60f6f307805ebf8a458535f06bfc", - "zh:c8a0ac2465d19ad85cddfa0e0f25f92688b1d1f39ff756a908138b9b1246d039", - "zh:d3c117dd5a332f072df84f60b7521ff8913c00586f325454baf6afc8816ee61d", - "zh:d5891fcb437e878274ab9f4047bf12a1878489d1474d5bb8c0049eb05de158da", - "zh:e3ac26177953ddf1d72e28b9a1f33d029675e9ea6652f7cc844a86c02b0ebd68", + "zh:a702f9a4dc7340182a8daf5b6ee562f14657fe14752f7d54dc799cf2fd91a868", + "zh:b624cb320d787fbfa6dc94be5a1fd52683d1ebd11b42646262b221a694e6ffb8", + "zh:bcbaded68b553afeea93604ec22c254b98f3951862bdeb68ae89c179c7dda117", + "zh:cb57bbcaf0fa3a70ea29b60d183d3a0dd020f041b18da5d1725d2acd17fa7d59", + "zh:d4ca164b1b6039557d8f5f5f911c4aaad1a187e9b3758f6885c95f8954f7de58", + "zh:eb0c705337cef7b96086e8b84702ba965eeeace7a4aa3235b2c8aad5f50f2fca", + "zh:f2787f40ce873d8c1308c92adec9b6adbd223506fe9d79bba447729e422f9146", ] } provider "registry.terraform.io/hashicorp/random" { - version = "3.9.0" - constraints = "~> 3.6" + version = "3.9.1" + constraints = "~> 3.9" hashes = [ - "h1:q/uaUTBdKgAmZESrwsoeDQff9uUA/cI/N5ZKNgVwa9c=", - "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1", - "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea", - "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f", - "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0", - "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61", - "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc", - "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398", + "h1:7uiStw0Rl9KOdX5UNMG/sp9nyadoD4LZekQTiYlYPhE=", + "h1:PYbnOqRuGn4c0/Ae1f7yOS/0zvmXNHFJRZjuF4KECnM=", + "h1:PlW+UZ4EElQF3NQwf41KQwavFujab3Czc51zu9dyVM8=", + "h1:g40qr7yDmIpaur4SsK5BcOda3HSo1RJ6zHVMqN4EJ+0=", + "zh:05f4734c1f0be840b711b3eff259ebc5fca436784c728955b1678078466f48d7", + "zh:0b91bf19371d012434eba1deeb6aab77158def9b39601dcbd94450b3974a2a26", + "zh:0ee6eacd47ec00183d55d726a4b6c4ce951a199f944bf22f1aa58392ebdfa7a2", + "zh:19388a4074b76a89a43a6c8328d7ae8ee2e7de3d346af51e80d3e6d3d12925f1", + "zh:23e74d48c5e2ac2e823fd527f49fee9db37d32a1990c9e3bf126ead697b843eb", + "zh:3cabf7fbd096c520064aae3aba61aba670af83ab91291a71fa1b1332929c2b7f", + "zh:5c0a3b8af0be60be4eca12ddee385cfa8babc1ec8e98cdf9de2f2274c73eabfa", + "zh:60b4f8a8ef18f52bf8e19215229dae408bee732825964092db7c989fd2de4097", + "zh:7359015acfedcbd6366f2329c854cf8d3c8ca5cd0faa89d2d37db358d6eba6c5", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e", - "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef", - "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b", - "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257", - "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04", + "zh:7b38758402f0e13a1071162da28994023cd2ac676e54af350c9ffd8dfa73fa7b", + "zh:7c7fbb8895eb75bb4de1f933e98553bd99c8d048c89a925ddba490aa5a67f7dc", + "zh:8c2b8c6a7ccdec16b73e2fb9f3700ea097f58c592571e4c5de60c93d2301732c", ] } diff --git a/deploy/terraform/apps/starter/app_stack/versions.tf b/deploy/terraform/apps/starter/app_stack/versions.tf index 90fd7f4669..e894e60f2f 100644 --- a/deploy/terraform/apps/starter/app_stack/versions.tf +++ b/deploy/terraform/apps/starter/app_stack/versions.tf @@ -7,11 +7,11 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "~> 6.46" + version = "~> 6.71" } random = { source = "hashicorp/random" - version = "~> 3.6" + version = "~> 3.9" } } } diff --git a/deploy/terraform/bootstrap/.terraform.lock.hcl b/deploy/terraform/bootstrap/.terraform.lock.hcl index 968d368cf0..719ce5ed2d 100644 --- a/deploy/terraform/bootstrap/.terraform.lock.hcl +++ b/deploy/terraform/bootstrap/.terraform.lock.hcl @@ -2,24 +2,28 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "6.49.0" - constraints = "~> 6.46" + version = "6.71.0" + constraints = "~> 6.71" hashes = [ - "h1:zBF6IqpUiJAszE5L4HpWuOgG6nSnqGRnwr08frehB40=", - "zh:11a636bb415bf780f0ad300cab83d687aebdc51381112ae7b29862e0bee43017", - "zh:2d6c4bb861c073d9900a2afc39cc1e38492c6996653e53c7a2083b526fb10ae9", - "zh:49f7ee4a7488f3d31342c5e9dbb577c40e0847a0cab152a0082e9aeef45f5c0f", - "zh:561283c9c9bd36b9d09832e50769b941eb45c43c6ab031f27c8bf78256af4af1", - "zh:576bf944e66d097b29fc45b25a5bbc53e7d4e71a486e2cb126304cf77b51fe79", - "zh:6c6bf8860773c121b9ca22743f733feea943f890fa3aba8740a59579dea16fc4", - "zh:88b963a659e42daac7384a6abb99b3383f9f6c8abad5dedafcd443536b122b84", - "zh:947e9404235ca094e39e7f3f464f99436320a168e1607c550e581fbc70553d48", + "h1:aLOQts7nCLMR0kb/jCdP56wlQQoGqhKLctKgtQjDopc=", + "h1:rMbzU/i9txGvoI/hiB6EMln0NlmxM/61SrI9XBvI41Q=", + "h1:sZCupscga0Grk22+04FNY1RYDeOcVbCTd6ff8+hsF94=", + "h1:tmOIsPrIHwR6en567EnkR0nqIr9yD0XQcadgSsPpG2g=", + "zh:09aa14408c5ab26915fb2a469b5eb67c06393a2054d78592ba4c32f7a882e918", + "zh:1d1138128dc4866f6c16b1ef3b871b3fd9a3dc648e9056e06e210d1817aa052b", + "zh:2c17a79821a0e06fbf1834a12e92227db29c2001fef7ef0b347af2e6dad83f14", + "zh:55616730a485c9c7283546a84f1ac5f8341152c5572338a54fc7af5f69ebfb92", + "zh:7e6461ec2976b5961a1d4f3c08c68fae0645d7f5e0a404f7647baa3b88d337d8", + "zh:7ec935166b2251d075fea980012f5267078785399585e8b443dca484fc57df0f", + "zh:885b3290cd48738cbf9ee8a6d47a4452889843f8f53b8cf67fc8c9b16e553721", + "zh:8930fb33c6c965f7cc82230cb7fbb0cfff9bb30becdfce5e0c2242512d849894", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a9c5a37bd1e5e81e85ad3dc3141f1b453b96e9cb8e500bc15bfb9c488fc95dcc", - "zh:b7b8a028fb2eafb98c676f9438808318f7ff0ea76eba03a6653d0940848a31c7", - "zh:be29f31827d6d5567aaec26034e6cceb994460446778ba1d0a435fc7ccd8a9f5", - "zh:c24c60ecffe3a7d44c762e62a29a802aec604096715ad3110b7ca2207124eb3a", - "zh:e2a247c5c7815437969e87cdce1f27f323eea75b97ed53f7605fef05d6406071", - "zh:e590ce9aca3f4fd964f7bf908a24dc3bc88e0b03a8554ccc81b9edcc84690670", + "zh:a702f9a4dc7340182a8daf5b6ee562f14657fe14752f7d54dc799cf2fd91a868", + "zh:b624cb320d787fbfa6dc94be5a1fd52683d1ebd11b42646262b221a694e6ffb8", + "zh:bcbaded68b553afeea93604ec22c254b98f3951862bdeb68ae89c179c7dda117", + "zh:cb57bbcaf0fa3a70ea29b60d183d3a0dd020f041b18da5d1725d2acd17fa7d59", + "zh:d4ca164b1b6039557d8f5f5f911c4aaad1a187e9b3758f6885c95f8954f7de58", + "zh:eb0c705337cef7b96086e8b84702ba965eeeace7a4aa3235b2c8aad5f50f2fca", + "zh:f2787f40ce873d8c1308c92adec9b6adbd223506fe9d79bba447729e422f9146", ] } diff --git a/deploy/terraform/bootstrap/main.tf b/deploy/terraform/bootstrap/main.tf index f3cc6daee4..fc943314ee 100644 --- a/deploy/terraform/bootstrap/main.tf +++ b/deploy/terraform/bootstrap/main.tf @@ -12,7 +12,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "~> 6.46" + version = "~> 6.71" } } diff --git a/deploy/terraform/modules/network/main.tf b/deploy/terraform/modules/network/main.tf index dad55bf976..29d295eaaa 100644 --- a/deploy/terraform/modules/network/main.tf +++ b/deploy/terraform/modules/network/main.tf @@ -144,7 +144,7 @@ resource "aws_vpc_endpoint" "s3" { count = var.enable_s3_endpoint ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.s3" + service_name = "com.amazonaws.${data.aws_region.current.region}.s3" vpc_endpoint_type = "Gateway" route_table_ids = concat([aws_route_table.public.id], [for rt in aws_route_table.private : rt.id]) @@ -157,7 +157,7 @@ resource "aws_vpc_endpoint" "ecr_api" { count = var.enable_ecr_endpoints ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.ecr.api" + service_name = "com.amazonaws.${data.aws_region.current.region}.ecr.api" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] @@ -172,7 +172,7 @@ resource "aws_vpc_endpoint" "ecr_dkr" { count = var.enable_ecr_endpoints ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.ecr.dkr" + service_name = "com.amazonaws.${data.aws_region.current.region}.ecr.dkr" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] @@ -187,7 +187,7 @@ resource "aws_vpc_endpoint" "logs" { count = var.enable_logs_endpoint ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.logs" + service_name = "com.amazonaws.${data.aws_region.current.region}.logs" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] @@ -202,7 +202,7 @@ resource "aws_vpc_endpoint" "secretsmanager" { count = var.enable_secretsmanager_endpoint ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.secretsmanager" + service_name = "com.amazonaws.${data.aws_region.current.region}.secretsmanager" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] diff --git a/global.json b/global.json index 512142d2be..01cb6588b0 100644 --- a/global.json +++ b/global.json @@ -1,6 +1,6 @@ { "sdk": { - "version": "10.0.100", + "version": "10.0.400", "rollForward": "latestFeature" } } diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props index bdcf0674b3..1060d3208a 100644 --- a/src/Directory.Packages.props +++ b/src/Directory.Packages.props @@ -9,29 +9,29 @@ - + - - - - + + + + runtime; build; native; contentfiles; analyzers; buildtransitive all - - + + - - - - - - - - + + + + + + + + @@ -43,102 +43,102 @@ - - - - - - + + + + + + - + - - - + + + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + - + - - + + - - - + - + - - + + - - - - - + + + + + - + - + @@ -146,6 +146,6 @@ below 2.5.301 fail NuGet audit (NU1903, GHSA-hv8m-jj95-wg3x: LZ4 decompression AccessViolation). Transitive pinning is enabled, so this entry alone bumps it. Remove once the SignalR backplane package depends on a patched version itself. --> - + \ No newline at end of file diff --git a/src/Host/FSH.Starter.AppHost/AppHost.cs b/src/Host/FSH.Starter.AppHost/AppHost.cs index 2a0d09e5b8..0130c0f9d0 100644 --- a/src/Host/FSH.Starter.AppHost/AppHost.cs +++ b/src/Host/FSH.Starter.AppHost/AppHost.cs @@ -25,7 +25,7 @@ $"{postgres.Resource.ConnectionStringExpression};Minimum Pool Size=5"); // Valkey (BSD-3 Redis fork) as a plain container: Aspire 13.4.0 AddRedis() forces TLS-by-default in run mode and never materializes the container, so we drop to plain RESP over TCP. Name stays "redis" so config keys don't churn. -var redis = builder.AddContainer("redis", "valkey/valkey", "9.1.0") +var redis = builder.AddContainer("redis", "valkey/valkey", "9.1.3") .WithEndpoint(targetPort: 6379, scheme: "tcp", name: "tcp") .WithVolume($"{appPrefix}-redis-data", "/data") .WithLifetime(ContainerLifetime.Persistent); @@ -35,7 +35,7 @@ $"{redisEndpoint.Property(EndpointProperty.HostAndPort)}"); // RedisInsight cache browser (dev-only) sidecar; RI_REDIS_* pre-registers the Valkey connection via the container-network alias "redis". -builder.AddContainer("redis-insight", "redis/redisinsight", "latest") +builder.AddContainer("redis-insight", "redis/redisinsight", "3.8.0") .WithHttpEndpoint(port: 5540, targetPort: 5540, name: "http") .WithEnvironment("RI_REDIS_HOST0", "redis") .WithEnvironment("RI_REDIS_PORT0", "6379") @@ -52,7 +52,7 @@ var s3User = builder.AddParameter("rustfs-user", "rustfsadmin"); var s3Password = builder.AddParameter("rustfs-password", "rustfsadmin", secret: true); -var rustfs = builder.AddContainer("rustfs", "rustfs/rustfs", "1.0.0") +var rustfs = builder.AddContainer("rustfs", "rustfs/rustfs", "1.0.4") .WithHttpEndpoint(port: 9000, targetPort: 9000, name: "api") .WithHttpEndpoint(port: 9001, targetPort: 9001, name: "console") .WithEnvironment("RUSTFS_ACCESS_KEY", s3User) @@ -73,7 +73,7 @@ aws --endpoint-url http://rustfs:9000 s3api put-bucket-policy --bucket {{S3Bucket}} --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::{{S3Bucket}}/public/*"]}]}'; """).ReplaceLineEndings("\n"); -var s3Init = builder.AddContainer("rustfs-init", "amazon/aws-cli", "2.37.3") +var s3Init = builder.AddContainer("rustfs-init", "amazon/aws-cli", "2.39.3") .WithEntrypoint("/bin/sh") .WithArgs("-c", s3InitScript) .WithEnvironment("AWS_ACCESS_KEY_ID", s3User) diff --git a/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj b/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj index 526a662916..672372f718 100644 --- a/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj +++ b/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj @@ -1,4 +1,4 @@ - + Exe diff --git a/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs b/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs index e7aae251ba..30edc1df6f 100644 --- a/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs +++ b/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs @@ -48,7 +48,7 @@ public sealed class MiddlewareWebApplicationFactory : WebApplicationFactory, I internal const string S3Bucket = "fsh-integration-test-uploads"; private static readonly SemaphoreSlim _migrationLock = new(1, 1); - private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:17-alpine") + private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:18-alpine") .WithDatabase("fsh_integration_tests") .WithUsername("postgres") .WithPassword("integration_test_pwd") @@ -44,7 +44,7 @@ public sealed class FshWebApplicationFactory : WebApplicationFactory, I // RustFS (S3-compatible) replaces MinIO, whose images were withdrawn from Docker Hub and quay.io. private const int S3Port = 9000; - private readonly IContainer _s3 = new ContainerBuilder("rustfs/rustfs:1.0.0") + private readonly IContainer _s3 = new ContainerBuilder("rustfs/rustfs:1.0.4") .WithPortBinding(S3Port, true) .WithEnvironment("RUSTFS_ACCESS_KEY", S3AccessKey) .WithEnvironment("RUSTFS_SECRET_KEY", S3SecretKey) diff --git a/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs b/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs index 26f9fe87c8..45f9c96b8e 100644 --- a/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs +++ b/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs @@ -17,7 +17,7 @@ namespace Integration.Tests.Tests.Caching; /// public sealed class HybridCacheRedisTests : IAsyncLifetime { - private readonly RedisContainer _redis = new RedisBuilder("valkey/valkey:9.1.0-alpine") + private readonly RedisContainer _redis = new RedisBuilder("valkey/valkey:9.1.3-alpine") .Build(); public Task InitializeAsync() => _redis.StartAsync(); diff --git a/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs b/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs index a66428f84c..9b28f5b7c4 100644 --- a/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs +++ b/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs @@ -19,7 +19,7 @@ namespace Integration.Tests.Tests.Health; /// public sealed class TenantMigrationsHealthCheckTests : IAsyncLifetime { - private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:17-alpine") + private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:18-alpine") .WithDatabase("fsh_migrations_check") .WithUsername("postgres") .WithPassword("integration_test_pwd") diff --git a/src/Tools/CLI/Commands/DoctorCommand.cs b/src/Tools/CLI/Commands/DoctorCommand.cs index 355da0b897..1249286608 100644 --- a/src/Tools/CLI/Commands/DoctorCommand.cs +++ b/src/Tools/CLI/Commands/DoctorCommand.cs @@ -7,7 +7,7 @@ namespace FSH.CLI.Commands; public sealed class DoctorCommand : AsyncCommand { - protected override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) { AnsiConsole.MarkupLine($"[bold {FshConstants.AccentColor}]FSH Doctor[/] — checking your development environment"); AnsiConsole.WriteLine(); diff --git a/src/Tools/CLI/Commands/InfoCommand.cs b/src/Tools/CLI/Commands/InfoCommand.cs index 962de7c1ee..e626a1f1a7 100644 --- a/src/Tools/CLI/Commands/InfoCommand.cs +++ b/src/Tools/CLI/Commands/InfoCommand.cs @@ -7,7 +7,7 @@ namespace FSH.CLI.Commands; public sealed class InfoCommand : AsyncCommand { - protected override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) { string currentVersion = Assembly.GetExecutingAssembly() .GetCustomAttribute()?.InformationalVersion diff --git a/src/Tools/CLI/Commands/NewCommand.cs b/src/Tools/CLI/Commands/NewCommand.cs index f973bbb973..00284ca565 100644 --- a/src/Tools/CLI/Commands/NewCommand.cs +++ b/src/Tools/CLI/Commands/NewCommand.cs @@ -54,7 +54,7 @@ public sealed class Settings : CommandSettings public bool DryRun { get; init; } } - protected override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) { ArgumentNullException.ThrowIfNull(settings); diff --git a/src/Tools/CLI/Commands/UpdateCommand.cs b/src/Tools/CLI/Commands/UpdateCommand.cs index c3d66644d1..a5f754cff0 100644 --- a/src/Tools/CLI/Commands/UpdateCommand.cs +++ b/src/Tools/CLI/Commands/UpdateCommand.cs @@ -6,7 +6,7 @@ namespace FSH.CLI.Commands; public sealed class UpdateCommand : AsyncCommand { - protected override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) { AnsiConsole.MarkupLine($"[bold {FshConstants.AccentColor}]Updating FSH tools...[/]"); AnsiConsole.WriteLine();