From 3a9bd9ed689ad3b226438d3a5aef535685962f31 Mon Sep 17 00:00:00 2001 From: iammukeshm Date: Tue, 3 Nov 2026 22:54:52 +0530 Subject: [PATCH 1/4] chore(deps): upgrade NuGet packages, Aspire 13.6.4 and the SDK floor Move the .NET 10 patch line to 10.0.14 (including the Cryptography.Xml and Pkcs pins), Aspire to 13.6.4, OpenTelemetry to 1.20.1 and every other outdated package to its latest stable. Spectre.Console.Cli 0.57 made AsyncCommand.ExecuteAsync public, so the fsh commands override it as public. The MessagePack pin moves to 2.5.307 because Aspire.Hosting.JavaScript 13.6.4 needs it. global.json now asks for SDK 10.0.400 or later. --- global.json | 2 +- src/Directory.Packages.props | 136 +++++++++--------- .../FSH.Starter.AppHost.csproj | 2 +- src/Tools/CLI/Commands/DoctorCommand.cs | 2 +- src/Tools/CLI/Commands/InfoCommand.cs | 2 +- src/Tools/CLI/Commands/NewCommand.cs | 2 +- src/Tools/CLI/Commands/UpdateCommand.cs | 2 +- 7 files changed, 74 insertions(+), 74 deletions(-) diff --git a/global.json b/global.json index 512142d2be..01cb6588b0 100644 --- a/global.json +++ b/global.json @@ -1,6 +1,6 @@ { "sdk": { - "version": "10.0.100", + "version": "10.0.400", "rollForward": "latestFeature" } } diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props index bdcf0674b3..1060d3208a 100644 --- a/src/Directory.Packages.props +++ b/src/Directory.Packages.props @@ -9,29 +9,29 @@ - + - - - - + + + + runtime; build; native; contentfiles; analyzers; buildtransitive all - - + + - - - - - - - - + + + + + + + + @@ -43,102 +43,102 @@ - - - - - - + + + + + + - + - - - + + + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + - + - - + + - - - + - + - - + + - - - - - + + + + + - + - + @@ -146,6 +146,6 @@ below 2.5.301 fail NuGet audit (NU1903, GHSA-hv8m-jj95-wg3x: LZ4 decompression AccessViolation). Transitive pinning is enabled, so this entry alone bumps it. Remove once the SignalR backplane package depends on a patched version itself. --> - + \ No newline at end of file diff --git a/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj b/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj index 526a662916..672372f718 100644 --- a/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj +++ b/src/Host/FSH.Starter.AppHost/FSH.Starter.AppHost.csproj @@ -1,4 +1,4 @@ - + Exe diff --git a/src/Tools/CLI/Commands/DoctorCommand.cs b/src/Tools/CLI/Commands/DoctorCommand.cs index 355da0b897..1249286608 100644 --- a/src/Tools/CLI/Commands/DoctorCommand.cs +++ b/src/Tools/CLI/Commands/DoctorCommand.cs @@ -7,7 +7,7 @@ namespace FSH.CLI.Commands; public sealed class DoctorCommand : AsyncCommand { - protected override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) { AnsiConsole.MarkupLine($"[bold {FshConstants.AccentColor}]FSH Doctor[/] — checking your development environment"); AnsiConsole.WriteLine(); diff --git a/src/Tools/CLI/Commands/InfoCommand.cs b/src/Tools/CLI/Commands/InfoCommand.cs index 962de7c1ee..e626a1f1a7 100644 --- a/src/Tools/CLI/Commands/InfoCommand.cs +++ b/src/Tools/CLI/Commands/InfoCommand.cs @@ -7,7 +7,7 @@ namespace FSH.CLI.Commands; public sealed class InfoCommand : AsyncCommand { - protected override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) { string currentVersion = Assembly.GetExecutingAssembly() .GetCustomAttribute()?.InformationalVersion diff --git a/src/Tools/CLI/Commands/NewCommand.cs b/src/Tools/CLI/Commands/NewCommand.cs index f973bbb973..00284ca565 100644 --- a/src/Tools/CLI/Commands/NewCommand.cs +++ b/src/Tools/CLI/Commands/NewCommand.cs @@ -54,7 +54,7 @@ public sealed class Settings : CommandSettings public bool DryRun { get; init; } } - protected override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) { ArgumentNullException.ThrowIfNull(settings); diff --git a/src/Tools/CLI/Commands/UpdateCommand.cs b/src/Tools/CLI/Commands/UpdateCommand.cs index c3d66644d1..a5f754cff0 100644 --- a/src/Tools/CLI/Commands/UpdateCommand.cs +++ b/src/Tools/CLI/Commands/UpdateCommand.cs @@ -6,7 +6,7 @@ namespace FSH.CLI.Commands; public sealed class UpdateCommand : AsyncCommand { - protected override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, CancellationToken cancellationToken) { AnsiConsole.MarkupLine($"[bold {FshConstants.AccentColor}]Updating FSH tools...[/]"); AnsiConsole.WriteLine(); From 5f618ff5a9ec0d349c1141def4f1fcb60b48d34a Mon Sep 17 00:00:00 2001 From: iammukeshm Date: Tue, 3 Nov 2026 22:54:52 +0530 Subject: [PATCH 2/4] chore(infra): run Postgres 18 everywhere and bump the pinned container images Testcontainers and the CI migrator smoke move from postgres:17-alpine to 18-alpine, matching Docker Compose and Aspire's default. Valkey 9.1.3, RustFS 1.0.4, Mailpit v1.33.0 and aws-cli 2.39.3; RedisInsight is pinned to 3.8.0 instead of latest. --- deploy/docker/README.md | 6 +++--- deploy/docker/docker-compose.yml | 8 ++++---- src/Host/FSH.Starter.AppHost/AppHost.cs | 8 ++++---- .../Infrastructure/MiddlewareWebApplicationFactory.cs | 4 ++-- .../Infrastructure/FshWebApplicationFactory.cs | 4 ++-- .../Tests/Caching/HybridCacheRedisTests.cs | 2 +- .../Tests/Health/TenantMigrationsHealthCheckTests.cs | 2 +- 7 files changed, 17 insertions(+), 17 deletions(-) diff --git a/deploy/docker/README.md b/deploy/docker/README.md index d5d0731cb4..5a908bbba2 100644 --- a/deploy/docker/README.md +++ b/deploy/docker/README.md @@ -9,9 +9,9 @@ This brings up the full stack on a single host: | `dashboard` | `fsh/dashboard:local` | `FSH_DASHBOARD_PORT` (default 8082) | Tenant dashboard (nginx + React) | | `migrator` | `fsh/dbmigrator:local` | — | One-shot: applies EF migrations + seeds the root tenant + creates the default admin user | | `postgres` | `postgres:18-alpine` | (internal) | Identity, tenant catalog, module schemas | -| `redis` | `valkey/valkey:9.1.0-alpine` | (internal) | HybridCache L2, Data Protection keys, idempotency store | -| `rustfs` | `rustfs/rustfs:1.0.0` | `FSH_S3_PORT` (default 9000), S3 API only | S3-compatible blob store for the Files module ([RustFS](https://rustfs.com)); published because browsers upload to it through presigned URLs | -| `mailpit` | `axllent/mailpit:v1.31.3` | `127.0.0.1:FSH_MAILPIT_PORT` (default 8025), SMTP 1025 internal | Local mail catcher ([Mailpit](https://mailpit.axllent.org)), only with the `mail-catcher` profile, which `.env.example` enables | +| `redis` | `valkey/valkey:9.1.3-alpine` | (internal) | HybridCache L2, Data Protection keys, idempotency store | +| `rustfs` | `rustfs/rustfs:1.0.4` | `FSH_S3_PORT` (default 9000), S3 API only | S3-compatible blob store for the Files module ([RustFS](https://rustfs.com)); published because browsers upload to it through presigned URLs | +| `mailpit` | `axllent/mailpit:v1.33.0` | `127.0.0.1:FSH_MAILPIT_PORT` (default 8025), SMTP 1025 internal | Local mail catcher ([Mailpit](https://mailpit.axllent.org)), only with the `mail-catcher` profile, which `.env.example` enables | The compose file does **not** include a reverse proxy or TLS terminator. You bring your own edge — Cloudflare Tunnel, AWS ALB, Tailscale Funnel, your existing nginx, anything that can route a TLS subdomain to a host:port on this machine. diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml index 448a43c1ac..73aebde685 100644 --- a/deploy/docker/docker-compose.yml +++ b/deploy/docker/docker-compose.yml @@ -35,7 +35,7 @@ services: # - "5432:5432" redis: - image: valkey/valkey:9.1.0-alpine + image: valkey/valkey:9.1.3-alpine container_name: fsh-redis restart: unless-stopped command: @@ -58,7 +58,7 @@ services: # - "6379:6379" rustfs: - image: rustfs/rustfs:1.0.0 + image: rustfs/rustfs:1.0.4 container_name: fsh-rustfs restart: unless-stopped environment: @@ -91,7 +91,7 @@ services: # everything else (private/, and keys from before public/ existed) needs a # presigned URL. Re-applied on every `up`, so it also narrows older policies. rustfs-init: - image: amazon/aws-cli:2.37.3 + image: amazon/aws-cli:2.39.3 container_name: fsh-rustfs-init restart: "no" depends_on: @@ -112,7 +112,7 @@ services: # Local mail catcher, started only with the mail-catcher profile # (COMPOSE_PROFILES in .env). SMTP (1025) stays on the compose network. mailpit: - image: axllent/mailpit:v1.31.3 + image: axllent/mailpit:v1.33.0 container_name: fsh-mailpit restart: unless-stopped profiles: [mail-catcher] diff --git a/src/Host/FSH.Starter.AppHost/AppHost.cs b/src/Host/FSH.Starter.AppHost/AppHost.cs index 2a0d09e5b8..0130c0f9d0 100644 --- a/src/Host/FSH.Starter.AppHost/AppHost.cs +++ b/src/Host/FSH.Starter.AppHost/AppHost.cs @@ -25,7 +25,7 @@ $"{postgres.Resource.ConnectionStringExpression};Minimum Pool Size=5"); // Valkey (BSD-3 Redis fork) as a plain container: Aspire 13.4.0 AddRedis() forces TLS-by-default in run mode and never materializes the container, so we drop to plain RESP over TCP. Name stays "redis" so config keys don't churn. -var redis = builder.AddContainer("redis", "valkey/valkey", "9.1.0") +var redis = builder.AddContainer("redis", "valkey/valkey", "9.1.3") .WithEndpoint(targetPort: 6379, scheme: "tcp", name: "tcp") .WithVolume($"{appPrefix}-redis-data", "/data") .WithLifetime(ContainerLifetime.Persistent); @@ -35,7 +35,7 @@ $"{redisEndpoint.Property(EndpointProperty.HostAndPort)}"); // RedisInsight cache browser (dev-only) sidecar; RI_REDIS_* pre-registers the Valkey connection via the container-network alias "redis". -builder.AddContainer("redis-insight", "redis/redisinsight", "latest") +builder.AddContainer("redis-insight", "redis/redisinsight", "3.8.0") .WithHttpEndpoint(port: 5540, targetPort: 5540, name: "http") .WithEnvironment("RI_REDIS_HOST0", "redis") .WithEnvironment("RI_REDIS_PORT0", "6379") @@ -52,7 +52,7 @@ var s3User = builder.AddParameter("rustfs-user", "rustfsadmin"); var s3Password = builder.AddParameter("rustfs-password", "rustfsadmin", secret: true); -var rustfs = builder.AddContainer("rustfs", "rustfs/rustfs", "1.0.0") +var rustfs = builder.AddContainer("rustfs", "rustfs/rustfs", "1.0.4") .WithHttpEndpoint(port: 9000, targetPort: 9000, name: "api") .WithHttpEndpoint(port: 9001, targetPort: 9001, name: "console") .WithEnvironment("RUSTFS_ACCESS_KEY", s3User) @@ -73,7 +73,7 @@ aws --endpoint-url http://rustfs:9000 s3api put-bucket-policy --bucket {{S3Bucket}} --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::{{S3Bucket}}/public/*"]}]}'; """).ReplaceLineEndings("\n"); -var s3Init = builder.AddContainer("rustfs-init", "amazon/aws-cli", "2.37.3") +var s3Init = builder.AddContainer("rustfs-init", "amazon/aws-cli", "2.39.3") .WithEntrypoint("/bin/sh") .WithArgs("-c", s3InitScript) .WithEnvironment("AWS_ACCESS_KEY_ID", s3User) diff --git a/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs b/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs index e7aae251ba..30edc1df6f 100644 --- a/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs +++ b/src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cs @@ -48,7 +48,7 @@ public sealed class MiddlewareWebApplicationFactory : WebApplicationFactory, I internal const string S3Bucket = "fsh-integration-test-uploads"; private static readonly SemaphoreSlim _migrationLock = new(1, 1); - private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:17-alpine") + private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:18-alpine") .WithDatabase("fsh_integration_tests") .WithUsername("postgres") .WithPassword("integration_test_pwd") @@ -44,7 +44,7 @@ public sealed class FshWebApplicationFactory : WebApplicationFactory, I // RustFS (S3-compatible) replaces MinIO, whose images were withdrawn from Docker Hub and quay.io. private const int S3Port = 9000; - private readonly IContainer _s3 = new ContainerBuilder("rustfs/rustfs:1.0.0") + private readonly IContainer _s3 = new ContainerBuilder("rustfs/rustfs:1.0.4") .WithPortBinding(S3Port, true) .WithEnvironment("RUSTFS_ACCESS_KEY", S3AccessKey) .WithEnvironment("RUSTFS_SECRET_KEY", S3SecretKey) diff --git a/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs b/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs index 26f9fe87c8..45f9c96b8e 100644 --- a/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs +++ b/src/Tests/Integration.Tests/Tests/Caching/HybridCacheRedisTests.cs @@ -17,7 +17,7 @@ namespace Integration.Tests.Tests.Caching; /// public sealed class HybridCacheRedisTests : IAsyncLifetime { - private readonly RedisContainer _redis = new RedisBuilder("valkey/valkey:9.1.0-alpine") + private readonly RedisContainer _redis = new RedisBuilder("valkey/valkey:9.1.3-alpine") .Build(); public Task InitializeAsync() => _redis.StartAsync(); diff --git a/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs b/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs index a66428f84c..9b28f5b7c4 100644 --- a/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs +++ b/src/Tests/Integration.Tests/Tests/Health/TenantMigrationsHealthCheckTests.cs @@ -19,7 +19,7 @@ namespace Integration.Tests.Tests.Health; /// public sealed class TenantMigrationsHealthCheckTests : IAsyncLifetime { - private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:17-alpine") + private readonly PostgreSqlContainer _postgres = new PostgreSqlBuilder("postgres:18-alpine") .WithDatabase("fsh_migrations_check") .WithUsername("postgres") .WithPassword("integration_test_pwd") From d0c173017fe7e41c580eb07156e739e9f17d14c8 Mon Sep 17 00:00:00 2001 From: iammukeshm Date: Tue, 3 Nov 2026 22:54:52 +0530 Subject: [PATCH 3/4] ci: bump action majors and keep the weekly CodeQL scan from failing on advisories CodeQL moves to v4, and the scan builds with NuGet audit off so a newly published advisory no longer stops the code scan (Backend CI still gates advisories). It also runs on pushes to main so the default branch gets alerts. setup-node v7, setup-dotnet v6, checkout v7, cache v6 and dorny/paths-filter v4. --- .github/workflows/backend.yml | 40 ++++++++++++++-------------- .github/workflows/codeql.yml | 18 +++++++++---- .github/workflows/frontend.yml | 14 +++++----- .github/workflows/template-smoke.yml | 14 +++++----- 4 files changed, 47 insertions(+), 39 deletions(-) diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml index 40f81b1f12..a82d0db28c 100644 --- a/.github/workflows/backend.yml +++ b/.github/workflows/backend.yml @@ -41,8 +41,8 @@ jobs: # full pipeline. On PRs, run only when backend-relevant paths changed. backend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.backend == 'true' }} steps: - - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@v7 + - uses: dorny/paths-filter@v4 id: filter with: filters: | @@ -59,15 +59,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -128,15 +128,15 @@ jobs: # Testcontainers requires Docker — ubuntu-latest has it pre-installed. steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -182,7 +182,7 @@ jobs: # against an ephemeral Postgres, asserts exit 0. services: postgres: - image: postgres:17-alpine + image: postgres:18-alpine env: POSTGRES_PASSWORD: migrator_smoke_pwd POSTGRES_DB: fsh_migrator_smoke @@ -196,15 +196,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -240,10 +240,10 @@ jobs: MIN_LINE: '80' steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json @@ -288,15 +288,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -336,15 +336,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 168528711c..eb60612f9f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,9 @@ name: CodeQL Analysis on: + push: + branches: [main] + paths: + - 'src/**' pull_request: branches: [main] paths: @@ -15,12 +19,16 @@ jobs: analyze: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: github/codeql-action/init@v3 + - uses: actions/checkout@v7 + - uses: github/codeql-action/init@v4 with: languages: csharp - - uses: actions/setup-dotnet@v5 + build-mode: manual + - uses: actions/setup-dotnet@v6 with: global-json-file: global.json - - run: dotnet build src/FSH.Starter.slnx -c Release - - uses: github/codeql-action/analyze@v3 + # NuGet audit is off for this build only. The weekly scan runs against an unchanged main, so a + # newly published advisory fails restore under TreatWarningsAsErrors and the code scan never runs + # (that is what broke it every week from 2026-10-19). Backend CI still gates advisories on every PR. + - run: dotnet build src/FSH.Starter.slnx -c Release -p:NuGetAudit=false + - uses: github/codeql-action/analyze@v4 diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml index 82d647ce3e..4d279e409c 100644 --- a/.github/workflows/frontend.yml +++ b/.github/workflows/frontend.yml @@ -27,8 +27,8 @@ jobs: outputs: frontend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.frontend == 'true' }} steps: - - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@v7 + - uses: dorny/paths-filter@v4 id: filter with: filters: | @@ -50,10 +50,10 @@ jobs: working-directory: clients/${{ matrix.app }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -83,10 +83,10 @@ jobs: working-directory: clients/${{ matrix.app }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -125,7 +125,7 @@ jobs: app: [admin, dashboard] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Build image run: docker build -t fsh-${{ matrix.app }}:ci clients/${{ matrix.app }} diff --git a/.github/workflows/template-smoke.yml b/.github/workflows/template-smoke.yml index ac2e7e4f80..7163bbd80a 100644 --- a/.github/workflows/template-smoke.yml +++ b/.github/workflows/template-smoke.yml @@ -41,20 +41,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: '22' - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} @@ -90,15 +90,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@v6 with: global-json-file: global.json - name: Cache NuGet packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }} From 0d1be468116a3c9779144a1438f3655dc8ca9f77 Mon Sep 17 00:00:00 2001 From: iammukeshm Date: Tue, 3 Nov 2026 22:54:53 +0530 Subject: [PATCH 4/4] chore(terraform): move the AWS provider to ~> 6.71 and random to ~> 3.9 Regenerate both lock files and replace the deprecated aws_region.id with aws_region.region. Align .terraform-version with the 1.15.4 floor. --- deploy/terraform/.terraform-version | 2 +- .../starter/app_stack/.terraform.lock.hcl | 75 ++++++++++--------- .../apps/starter/app_stack/versions.tf | 4 +- .../terraform/bootstrap/.terraform.lock.hcl | 38 +++++----- deploy/terraform/bootstrap/main.tf | 2 +- deploy/terraform/modules/network/main.tf | 10 +-- 6 files changed, 69 insertions(+), 62 deletions(-) diff --git a/deploy/terraform/.terraform-version b/deploy/terraform/.terraform-version index 850e742404..e34208c937 100644 --- a/deploy/terraform/.terraform-version +++ b/deploy/terraform/.terraform-version @@ -1 +1 @@ -1.14.0 +1.15.4 diff --git a/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl b/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl index 7abd670b63..a3c140d382 100644 --- a/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl +++ b/deploy/terraform/apps/starter/app_stack/.terraform.lock.hcl @@ -2,49 +2,52 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "6.46.0" - constraints = ">= 6.0.0, ~> 6.46" + version = "6.71.0" + constraints = ">= 6.0.0, ~> 6.71" hashes = [ - "h1:4TQ6PLtOXgRf3ojUYjUkwH2JSmio/pSi75Ok9k0CMDE=", - "h1:9OKHG3Cvawwk/1k96R+xSVjI7sSiQfbXuhFz/Psd6ME=", - "h1:HAB8KLxgUe1Pb+e8ile18AxzhNWeHV9FUBmEM5YHzNM=", - "h1:MtD90GmY1s4b3iKQlX8r6K06Y9Vx7JmB5sv1cBdw0rU=", - "h1:SbQ3sCRV99tzNDyCaq6O+UZpmYgzsCnXuJ6BhHmlwu8=", - "zh:0a771c2981bb31b8a8e6790f800f5ae9c860a0e05d39a249d16d557713299f6c", - "zh:0dd5ca8f1997a73f3fbadca80aefdc4e47785f2dcec189dd8828c4f835a02318", - "zh:56f6972652aa038b320c96de6460c48dd350244e5d2cdf6d43d62d27a7de8828", - "zh:792f9a16a3567795a8c7ad91a67253ee84a2a462791a7b920ef9c607529e324f", - "zh:7d8a41d268006a98e70457c606c60de5948c7e22e1192c40c8b2fe4d9c069450", - "zh:876a1033ebdd05b99d3f4e565881c7c4832c92aab5c91ee4c04903001d19a79f", - "zh:90aa9d7925be5a1d31f38c9c29117e68b91c7d0367f8f76f26df458935ea4f18", - "zh:94c8f5a40a646fbd1b85bc7a6efa88b3e260d9aef4c432091f26fa4319297631", + "h1:aLOQts7nCLMR0kb/jCdP56wlQQoGqhKLctKgtQjDopc=", + "h1:rMbzU/i9txGvoI/hiB6EMln0NlmxM/61SrI9XBvI41Q=", + "h1:sZCupscga0Grk22+04FNY1RYDeOcVbCTd6ff8+hsF94=", + "h1:tmOIsPrIHwR6en567EnkR0nqIr9yD0XQcadgSsPpG2g=", + "zh:09aa14408c5ab26915fb2a469b5eb67c06393a2054d78592ba4c32f7a882e918", + "zh:1d1138128dc4866f6c16b1ef3b871b3fd9a3dc648e9056e06e210d1817aa052b", + "zh:2c17a79821a0e06fbf1834a12e92227db29c2001fef7ef0b347af2e6dad83f14", + "zh:55616730a485c9c7283546a84f1ac5f8341152c5572338a54fc7af5f69ebfb92", + "zh:7e6461ec2976b5961a1d4f3c08c68fae0645d7f5e0a404f7647baa3b88d337d8", + "zh:7ec935166b2251d075fea980012f5267078785399585e8b443dca484fc57df0f", + "zh:885b3290cd48738cbf9ee8a6d47a4452889843f8f53b8cf67fc8c9b16e553721", + "zh:8930fb33c6c965f7cc82230cb7fbb0cfff9bb30becdfce5e0c2242512d849894", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a002ee5fa9d5d1010c59c266e64da989f60958321f8fa95c212460ea486412f0", - "zh:c5498f9502a209d1e51f1ac46ae53419a2fa60f6f307805ebf8a458535f06bfc", - "zh:c8a0ac2465d19ad85cddfa0e0f25f92688b1d1f39ff756a908138b9b1246d039", - "zh:d3c117dd5a332f072df84f60b7521ff8913c00586f325454baf6afc8816ee61d", - "zh:d5891fcb437e878274ab9f4047bf12a1878489d1474d5bb8c0049eb05de158da", - "zh:e3ac26177953ddf1d72e28b9a1f33d029675e9ea6652f7cc844a86c02b0ebd68", + "zh:a702f9a4dc7340182a8daf5b6ee562f14657fe14752f7d54dc799cf2fd91a868", + "zh:b624cb320d787fbfa6dc94be5a1fd52683d1ebd11b42646262b221a694e6ffb8", + "zh:bcbaded68b553afeea93604ec22c254b98f3951862bdeb68ae89c179c7dda117", + "zh:cb57bbcaf0fa3a70ea29b60d183d3a0dd020f041b18da5d1725d2acd17fa7d59", + "zh:d4ca164b1b6039557d8f5f5f911c4aaad1a187e9b3758f6885c95f8954f7de58", + "zh:eb0c705337cef7b96086e8b84702ba965eeeace7a4aa3235b2c8aad5f50f2fca", + "zh:f2787f40ce873d8c1308c92adec9b6adbd223506fe9d79bba447729e422f9146", ] } provider "registry.terraform.io/hashicorp/random" { - version = "3.9.0" - constraints = "~> 3.6" + version = "3.9.1" + constraints = "~> 3.9" hashes = [ - "h1:q/uaUTBdKgAmZESrwsoeDQff9uUA/cI/N5ZKNgVwa9c=", - "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1", - "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea", - "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f", - "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0", - "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61", - "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc", - "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398", + "h1:7uiStw0Rl9KOdX5UNMG/sp9nyadoD4LZekQTiYlYPhE=", + "h1:PYbnOqRuGn4c0/Ae1f7yOS/0zvmXNHFJRZjuF4KECnM=", + "h1:PlW+UZ4EElQF3NQwf41KQwavFujab3Czc51zu9dyVM8=", + "h1:g40qr7yDmIpaur4SsK5BcOda3HSo1RJ6zHVMqN4EJ+0=", + "zh:05f4734c1f0be840b711b3eff259ebc5fca436784c728955b1678078466f48d7", + "zh:0b91bf19371d012434eba1deeb6aab77158def9b39601dcbd94450b3974a2a26", + "zh:0ee6eacd47ec00183d55d726a4b6c4ce951a199f944bf22f1aa58392ebdfa7a2", + "zh:19388a4074b76a89a43a6c8328d7ae8ee2e7de3d346af51e80d3e6d3d12925f1", + "zh:23e74d48c5e2ac2e823fd527f49fee9db37d32a1990c9e3bf126ead697b843eb", + "zh:3cabf7fbd096c520064aae3aba61aba670af83ab91291a71fa1b1332929c2b7f", + "zh:5c0a3b8af0be60be4eca12ddee385cfa8babc1ec8e98cdf9de2f2274c73eabfa", + "zh:60b4f8a8ef18f52bf8e19215229dae408bee732825964092db7c989fd2de4097", + "zh:7359015acfedcbd6366f2329c854cf8d3c8ca5cd0faa89d2d37db358d6eba6c5", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e", - "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef", - "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b", - "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257", - "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04", + "zh:7b38758402f0e13a1071162da28994023cd2ac676e54af350c9ffd8dfa73fa7b", + "zh:7c7fbb8895eb75bb4de1f933e98553bd99c8d048c89a925ddba490aa5a67f7dc", + "zh:8c2b8c6a7ccdec16b73e2fb9f3700ea097f58c592571e4c5de60c93d2301732c", ] } diff --git a/deploy/terraform/apps/starter/app_stack/versions.tf b/deploy/terraform/apps/starter/app_stack/versions.tf index 90fd7f4669..e894e60f2f 100644 --- a/deploy/terraform/apps/starter/app_stack/versions.tf +++ b/deploy/terraform/apps/starter/app_stack/versions.tf @@ -7,11 +7,11 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "~> 6.46" + version = "~> 6.71" } random = { source = "hashicorp/random" - version = "~> 3.6" + version = "~> 3.9" } } } diff --git a/deploy/terraform/bootstrap/.terraform.lock.hcl b/deploy/terraform/bootstrap/.terraform.lock.hcl index 968d368cf0..719ce5ed2d 100644 --- a/deploy/terraform/bootstrap/.terraform.lock.hcl +++ b/deploy/terraform/bootstrap/.terraform.lock.hcl @@ -2,24 +2,28 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "6.49.0" - constraints = "~> 6.46" + version = "6.71.0" + constraints = "~> 6.71" hashes = [ - "h1:zBF6IqpUiJAszE5L4HpWuOgG6nSnqGRnwr08frehB40=", - "zh:11a636bb415bf780f0ad300cab83d687aebdc51381112ae7b29862e0bee43017", - "zh:2d6c4bb861c073d9900a2afc39cc1e38492c6996653e53c7a2083b526fb10ae9", - "zh:49f7ee4a7488f3d31342c5e9dbb577c40e0847a0cab152a0082e9aeef45f5c0f", - "zh:561283c9c9bd36b9d09832e50769b941eb45c43c6ab031f27c8bf78256af4af1", - "zh:576bf944e66d097b29fc45b25a5bbc53e7d4e71a486e2cb126304cf77b51fe79", - "zh:6c6bf8860773c121b9ca22743f733feea943f890fa3aba8740a59579dea16fc4", - "zh:88b963a659e42daac7384a6abb99b3383f9f6c8abad5dedafcd443536b122b84", - "zh:947e9404235ca094e39e7f3f464f99436320a168e1607c550e581fbc70553d48", + "h1:aLOQts7nCLMR0kb/jCdP56wlQQoGqhKLctKgtQjDopc=", + "h1:rMbzU/i9txGvoI/hiB6EMln0NlmxM/61SrI9XBvI41Q=", + "h1:sZCupscga0Grk22+04FNY1RYDeOcVbCTd6ff8+hsF94=", + "h1:tmOIsPrIHwR6en567EnkR0nqIr9yD0XQcadgSsPpG2g=", + "zh:09aa14408c5ab26915fb2a469b5eb67c06393a2054d78592ba4c32f7a882e918", + "zh:1d1138128dc4866f6c16b1ef3b871b3fd9a3dc648e9056e06e210d1817aa052b", + "zh:2c17a79821a0e06fbf1834a12e92227db29c2001fef7ef0b347af2e6dad83f14", + "zh:55616730a485c9c7283546a84f1ac5f8341152c5572338a54fc7af5f69ebfb92", + "zh:7e6461ec2976b5961a1d4f3c08c68fae0645d7f5e0a404f7647baa3b88d337d8", + "zh:7ec935166b2251d075fea980012f5267078785399585e8b443dca484fc57df0f", + "zh:885b3290cd48738cbf9ee8a6d47a4452889843f8f53b8cf67fc8c9b16e553721", + "zh:8930fb33c6c965f7cc82230cb7fbb0cfff9bb30becdfce5e0c2242512d849894", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a9c5a37bd1e5e81e85ad3dc3141f1b453b96e9cb8e500bc15bfb9c488fc95dcc", - "zh:b7b8a028fb2eafb98c676f9438808318f7ff0ea76eba03a6653d0940848a31c7", - "zh:be29f31827d6d5567aaec26034e6cceb994460446778ba1d0a435fc7ccd8a9f5", - "zh:c24c60ecffe3a7d44c762e62a29a802aec604096715ad3110b7ca2207124eb3a", - "zh:e2a247c5c7815437969e87cdce1f27f323eea75b97ed53f7605fef05d6406071", - "zh:e590ce9aca3f4fd964f7bf908a24dc3bc88e0b03a8554ccc81b9edcc84690670", + "zh:a702f9a4dc7340182a8daf5b6ee562f14657fe14752f7d54dc799cf2fd91a868", + "zh:b624cb320d787fbfa6dc94be5a1fd52683d1ebd11b42646262b221a694e6ffb8", + "zh:bcbaded68b553afeea93604ec22c254b98f3951862bdeb68ae89c179c7dda117", + "zh:cb57bbcaf0fa3a70ea29b60d183d3a0dd020f041b18da5d1725d2acd17fa7d59", + "zh:d4ca164b1b6039557d8f5f5f911c4aaad1a187e9b3758f6885c95f8954f7de58", + "zh:eb0c705337cef7b96086e8b84702ba965eeeace7a4aa3235b2c8aad5f50f2fca", + "zh:f2787f40ce873d8c1308c92adec9b6adbd223506fe9d79bba447729e422f9146", ] } diff --git a/deploy/terraform/bootstrap/main.tf b/deploy/terraform/bootstrap/main.tf index f3cc6daee4..fc943314ee 100644 --- a/deploy/terraform/bootstrap/main.tf +++ b/deploy/terraform/bootstrap/main.tf @@ -12,7 +12,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "~> 6.46" + version = "~> 6.71" } } diff --git a/deploy/terraform/modules/network/main.tf b/deploy/terraform/modules/network/main.tf index dad55bf976..29d295eaaa 100644 --- a/deploy/terraform/modules/network/main.tf +++ b/deploy/terraform/modules/network/main.tf @@ -144,7 +144,7 @@ resource "aws_vpc_endpoint" "s3" { count = var.enable_s3_endpoint ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.s3" + service_name = "com.amazonaws.${data.aws_region.current.region}.s3" vpc_endpoint_type = "Gateway" route_table_ids = concat([aws_route_table.public.id], [for rt in aws_route_table.private : rt.id]) @@ -157,7 +157,7 @@ resource "aws_vpc_endpoint" "ecr_api" { count = var.enable_ecr_endpoints ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.ecr.api" + service_name = "com.amazonaws.${data.aws_region.current.region}.ecr.api" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] @@ -172,7 +172,7 @@ resource "aws_vpc_endpoint" "ecr_dkr" { count = var.enable_ecr_endpoints ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.ecr.dkr" + service_name = "com.amazonaws.${data.aws_region.current.region}.ecr.dkr" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] @@ -187,7 +187,7 @@ resource "aws_vpc_endpoint" "logs" { count = var.enable_logs_endpoint ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.logs" + service_name = "com.amazonaws.${data.aws_region.current.region}.logs" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id] @@ -202,7 +202,7 @@ resource "aws_vpc_endpoint" "secretsmanager" { count = var.enable_secretsmanager_endpoint ? 1 : 0 vpc_id = aws_vpc.this.id - service_name = "com.amazonaws.${data.aws_region.current.id}.secretsmanager" + service_name = "com.amazonaws.${data.aws_region.current.region}.secretsmanager" vpc_endpoint_type = "Interface" subnet_ids = [for s in aws_subnet.private : s.id] security_group_ids = [aws_security_group.vpc_endpoints[0].id]