From 0df1b2091a2d4e08236499475c4cacd13dbeec31 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 12 Jun 2026 12:53:01 +0200 Subject: [PATCH 01/76] chore(deps): update all github action to v0.21.6 (#244) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 2 +- .github/workflows/update-catalogs.yml | 2 +- .github/workflows/update_os_libraries.yml | 4 ++-- Taskfile.yml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 46e2f33e..093c54d6 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -33,7 +33,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.5 + DAGGER_VERSION: 0.21.6 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index d2915064..878b0c8c 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -132,7 +132,7 @@ jobs: - name: Install Dagger env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.5 + DAGGER_VERSION: 0.21.6 run: | curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index 31233587..b75fd26a 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -39,7 +39,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.5 + DAGGER_VERSION: 0.21.6 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index bc456dc5..7e58c04f 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -28,7 +28,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.5 + DAGGER_VERSION: 0.21.6 with: version: ${{ env.DAGGER_VERSION }} verb: call @@ -66,7 +66,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.5 + DAGGER_VERSION: 0.21.6 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/Taskfile.yml b/Taskfile.yml index ffc902f4..e83b23d3 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -207,7 +207,7 @@ tasks: run: once vars: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_ENGINE_VERSION: v0.21.5 + DAGGER_ENGINE_VERSION: v0.21.6 cmds: - > docker run -d -v /var/lib/dagger --name {{ .DAGGER_ENGINE_NAME }} --restart always --network {{ .E2E_NETWORK }} From 3dd0b563fdff05ede3ecf9d1de7d16964a7bb156 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 09:59:29 +0200 Subject: [PATCH 02/76] chore(deps): update alpine/kubectl docker tag to v1.36.2 (#246) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index e83b23d3..6863a3e4 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -282,7 +282,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.1@sha256:c5b35e51aadf9eacc43cd301f519ae862a7f480a5b46d1b36b423d93c3b20abe + KUBECTL_VERSION: 1.36.2@sha256:e5e66d693f2c01b3962e959f4a58cdc0dbc28231dc134177d0d78dc91d742c56 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 4f2b6b2c4f8a1312e153fa00f1d9e467a7c27fca Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 11:02:19 +0200 Subject: [PATCH 03/76] chore(deps): update alpine/psql:18.4 docker digest to c39a6bd (#245) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index 5de41ff9..cf505712 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:cc22f42223f238b753c548d4cce95ced71951dac095882d1a569c49bef372707 + image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index 1c7bd625..fb22912a 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:cc22f42223f238b753c548d4cce95ced71951dac095882d1a569c49bef372707 + image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index 72ee92e4..a818abe0 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:cc22f42223f238b753c548d4cce95ced71951dac095882d1a569c49bef372707 + image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 828a9313..513f5185 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:cc22f42223f238b753c548d4cce95ced71951dac095882d1a569c49bef372707 + image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e command: ['sh', '-c'] args: - | From 552cb96e190b9e25ea16897f4f2b626822bfd026 Mon Sep 17 00:00:00 2001 From: Marco Nenciarini Date: Tue, 16 Jun 2026 11:32:32 +0200 Subject: [PATCH 04/76] ci: run Go unit tests for the maintenance module (#238) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The maintenance module under `dagger/maintenance` has unit tests but nothing in CI runs them. This adds a workflow that runs `go test` on every pull request and on pushes to `main`. The generated Dagger client (`internal/dagger`, `dagger.gen.go`) is gitignored, so the workflow runs `dagger develop` to regenerate it before testing. The generated client panics at init unless `DAGGER_SESSION_PORT` and `DAGGER_SESSION_TOKEN` are set; the unit tests never open a session, so dummy values are enough to get past that check without contacting an engine. Signed-off-by: Marco Nenciarini Signed-off-by: Niccolò Fei Co-authored-by: Niccolò Fei Co-authored-by: Gabriele Fedi --- .github/workflows/test.yml | 54 ++++++++++++++++++++++++++++++++++ dagger/maintenance/dagger.json | 2 +- dagger/maintenance/go.mod | 4 +-- dagger/maintenance/go.sum | 4 +-- 4 files changed, 59 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/test.yml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 00000000..c45e7fd6 --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,54 @@ +name: Dagger Module Unit tests + +on: + push: + branches: + - main + paths: + - 'dagger/maintenance/**' + pull_request: + paths: + - 'dagger/maintenance/**' + workflow_dispatch: + +defaults: + run: + shell: 'bash -Eeuo pipefail -x {0}' + +permissions: {} + +jobs: + unit-test: + name: Go unit tests + runs-on: ubuntu-24.04 + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 + with: + go-version-file: dagger/maintenance/go.mod + cache-dependency-path: dagger/maintenance/go.sum + + - name: Generate the Dagger client + uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 + env: + # renovate: datasource=github-tags depName=dagger/dagger versioning=semver + DAGGER_VERSION: 0.21.4 + with: + version: ${{ env.DAGGER_VERSION }} + verb: develop + module: ./dagger/maintenance/ + + - name: Run unit tests + working-directory: dagger/maintenance + env: + # The generated Dagger client reads these at package init time. The + # unit tests never open a session, so dummy values are enough to get + # past the init check without contacting an engine. + DAGGER_SESSION_PORT: "1" + DAGGER_SESSION_TOKEN: "test" + run: go test ./... diff --git a/dagger/maintenance/dagger.json b/dagger/maintenance/dagger.json index 24a5cd29..c64f92d5 100644 --- a/dagger/maintenance/dagger.json +++ b/dagger/maintenance/dagger.json @@ -1,6 +1,6 @@ { "name": "maintenance", - "engineVersion": "v0.20.6", + "engineVersion": "v0.21.4", "sdk": { "source": "go" } diff --git a/dagger/maintenance/go.mod b/dagger/maintenance/go.mod index 130d5f22..db45ab15 100644 --- a/dagger/maintenance/go.mod +++ b/dagger/maintenance/go.mod @@ -1,6 +1,6 @@ module dagger/maintenance -go 1.25.5 +go 1.26.1 require ( github.com/docker/buildx v0.33.0 @@ -95,7 +95,6 @@ require ( ) require ( - dagger.io/dagger v0.20.6-0.20260415192040-7058e9313c72 github.com/99designs/gqlgen v0.17.89 // indirect github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect github.com/Khan/genqlient v0.8.1 @@ -129,6 +128,7 @@ require ( github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/containerd/ttrpc v1.2.8 // indirect github.com/containerd/typeurl/v2 v2.2.3 // indirect + github.com/dagger/querybuilder v0.0.0-20260402040506-574a5e81cb59 github.com/distribution/reference v0.6.0 // indirect github.com/docker/cli v29.4.0+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect diff --git a/dagger/maintenance/go.sum b/dagger/maintenance/go.sum index a7c948c1..321eec1f 100644 --- a/dagger/maintenance/go.sum +++ b/dagger/maintenance/go.sum @@ -14,8 +14,6 @@ cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7 cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk= cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8= cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc= -dagger.io/dagger v0.20.6-0.20260415192040-7058e9313c72 h1:s39e07WvaUU6tLhpojK8ZEIoIbOSn5hHOJra0waenxQ= -dagger.io/dagger v0.20.6-0.20260415192040-7058e9313c72/go.mod h1:ZXg8+pQZaZUC8rAw4V/gPP8aKvKARIJZ+pfcV+RC1es= filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= github.com/99designs/gqlgen v0.17.89 h1:KzEcxPiMgQoMw3m/E85atUEHyZyt0PbAflMia5Kw8z8= @@ -159,6 +157,8 @@ github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= github.com/dagger/otel-go v1.43.0 h1:AYCnAamWmxtSxigWPTgC+8EWqiWPcDZEegh8y05gdJ8= github.com/dagger/otel-go v1.43.0/go.mod h1:83CTuXi70zcx1kaym5buqmb7RNzg1E9dEiQSFyLbLdU= +github.com/dagger/querybuilder v0.0.0-20260402040506-574a5e81cb59 h1:g6vfdGRyz6fAjfHz5FyYPZgHy8qcQ31fHrBl1iCOzxw= +github.com/dagger/querybuilder v0.0.0-20260402040506-574a5e81cb59/go.mod h1:jsdUJeYzcbyK1j/EqMGPrQgNYxl/Zfg06vvM9C/xXxs= github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ= github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From ac3d13a23cdcef5cd27f8d37a50d122d1b528158 Mon Sep 17 00:00:00 2001 From: Peggie Date: Wed, 17 Jun 2026 09:17:05 +0200 Subject: [PATCH 05/76] chore: update postgis OS libraries (#239) Updating the OS libraries of postgis Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: extension-os-libs-updater --- postgis/system-libs/18-bookworm-os-libs.txt | 2 +- postgis/system-libs/18-trixie-os-libs.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/postgis/system-libs/18-bookworm-os-libs.txt b/postgis/system-libs/18-bookworm-os-libs.txt index 737473e6..4669bd78 100644 --- a/postgis/system-libs/18-bookworm-os-libs.txt +++ b/postgis/system-libs/18-bookworm-os-libs.txt @@ -61,7 +61,7 @@ libopenjp2-7_2.5.0-2+deb12u3_amd64.deb liblcms2-2_2.14-2+deb12u1_amd64.deb MD5Sum:4a701d009079104e62992b219cee5f6e libnspr4_2%3a4.35-1_amd64.deb MD5Sum:1f8e0fda3f2527e0051768abd071c2fe libnss3_2%3a3.87.1-1+deb12u2_amd64.deb MD5Sum:1e66101d6c420e5999032e3f187282ed -libpoppler126_22.12.0-2+deb12u1_amd64.deb MD5Sum:1a8e3334bd9dc09a1b91e002f4c88c02 +libpoppler126_22.12.0-2+deb12u2_amd64.deb libqhull-r8.0_2020.2-5_amd64.deb MD5Sum:781260a36cd4d65a86fc349f26b68338 librttopo1_1.1.0-3_amd64.deb MD5Sum:901bfdc1a4a806d1c9be972018d65368 libspatialite7_5.0.1-3_amd64.deb MD5Sum:fb95bb6433ea0a15f712372b1afcf3b5 diff --git a/postgis/system-libs/18-trixie-os-libs.txt b/postgis/system-libs/18-trixie-os-libs.txt index 0689a723..af65b6ae 100644 --- a/postgis/system-libs/18-trixie-os-libs.txt +++ b/postgis/system-libs/18-trixie-os-libs.txt @@ -72,7 +72,7 @@ libgpgmepp6t64_1.24.2-3_amd64.deb MD5Sum:9b6067de043f9224848364739828216b liblcms2-2_2.16-2+deb13u2_amd64.deb MD5Sum:263113687b91aafa4e934fa16d91291b libnspr4_2%3a4.36-1_amd64.deb MD5Sum:dc825d7a7868119890f38608de1b5e21 libnss3_2%3a3.110-1+deb13u2_amd64.deb -libpoppler147_25.03.0-5+deb13u2_amd64.deb MD5Sum:b2bbe0f83c7f67176ab9b6800b86fac5 +libpoppler147_25.03.0-5+deb13u3_amd64.deb libqhull-r8.0_2020.2-6+b2_amd64.deb MD5Sum:3b0b21663513226a208f039abea3ad47 librttopo1_1.1.0-4_amd64.deb MD5Sum:b522568252b7ba63b0c4f87300400be9 libspatialite8t64_5.1.0-3+b2_amd64.deb MD5Sum:631307d38ff2755f5955023345b0b05d From 27588d7ed088f8dba4a1bf3da9bb2f32c4a682e8 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 03:13:27 +0000 Subject: [PATCH 06/76] chore(deps): update dependency postgresql-18-timescaledb (#249) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | minor | `2.27.2` → `2.28.0` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | minor | `2.27.2+dfsg-1.pgdg12+1` → `2.28.0+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | minor | `2.27.2+dfsg-1.pgdg13+1` → `2.28.0+dfsg-1.pgdg13+1` | --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.28.0`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2280-2026-06-16) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.27.2...2.28.0) This release contains performance improvements and bug fixes since the 2.27.2 release. We recommend that you upgrade at the next available opportunity. **Highlighted features in TimescaleDB v2.28.0** - **Faster `first()` and `last()` queries on compressed data.** TimescaleDB derives `first(value, time)` and `last(value, time)` aggregates straight from the columnstore's batch metadata, skipping batch decompression entirely. For the "latest reading per series" lookups that time-series workloads run constantly, that means meaningfully faster recency queries with no changes to your SQL queries. - **Lighter, less disruptive continuous aggregate refreshes.** `refresh_continuous_aggregate()` can now run incrementally in batches — the same behavior refresh policies already use — enabling breaking large manual refreshes into smaller chunks (tunable via `buckets_per_batch`, `max_batches_per_execution`, and `refresh_newest_first`) instead of one heavy operation. Refreshes also now take a lighter lock while processing the invalidation log, so they no longer block unrelated concurrent operations on the same continuous aggregate, improving behavior for concurrent workloads. - **Vectorized execution now covers `CASE` expressions.** TimescaleDB's columnar executor can now evaluate `CASE ... WHEN` expressions directly on compressed data, so queries using conditional logic stay on the fast vectorized path instead of falling back to slower row-by-row decompression. This speeds up a common pattern — conditional aggregations and computed columns over compressed history — with no query changes needed. - **Add new aggregations to a continuous aggregate without rebuilding it.** You can now run `ALTER MATERIALIZED VIEW ADD COLUMN GENERATED ALWAYS AS () STORED` to add a new computed aggregate to an existing continuous aggregate in place — no more dropping and recreating the whole aggregate just to track one more metric. New data populates the column going forward, letting your rollups evolve alongside your application. (Existing rows start as `NULL`; a forced refresh backfills them when you need historical values.) **Deprecation Notice: PostgreSQL 15 Support** This release marks the final minor version of TimescaleDB that will support PostgreSQL 15. Starting with our next release, version 2.29.0, we will officially drop support for Postgres 15, and only support Postgres 16, 17, and 18; however, all future patch releases within the current 2.28 version cycle will continue to fully support it. We recommend planning your PostgreSQL upgrades accordingly to ensure a smooth transition. **Deprecation Notice: `chunk_constraint` Catalog Table** Please note that the `_timescaledb_catalog.chunk_constraint` table has been dropped and temporarily replaced by a view, which introduces a change to the underlying objects while maintaining current query behavior. However, this compatibility view will be completely removed in a future release. To ensure your queries remain compatible moving forward, we strongly advise transitioning to the stable contracts provided by our [informational views](https://www.tigerdata.com/docs/reference/timescaledb/informational-views). **Backward-Incompatible Changes** - [#​9934](https://redirect.github.com/timescale/timescaledb/pull/9934) Remove adaptive chunking **Features** - [#​4054](https://redirect.github.com/timescale/timescaledb/pull/4054) Support `ANALYZE` and `VACUUM` on continuous aggregates by redirecting to the underlying materialization hypertable - [#​9125](https://redirect.github.com/timescale/timescaledb/pull/9125) Increase the parallelism of `SELECT` queries over compressed hypertables to approximately match the uncompressed data size - [#​9410](https://redirect.github.com/timescale/timescaledb/pull/9410) Mark `hypertable` and `chunk` as user catalog tables - [#​9416](https://redirect.github.com/timescale/timescaledb/pull/9416) Support some forms of `CASE` expression in columnar aggregation and grouping - [#​9580](https://redirect.github.com/timescale/timescaledb/pull/9580) Add `first` / `last` sparse indexes to compression - [#​9784](https://redirect.github.com/timescale/timescaledb/pull/9784) Use `first` / `last` sparse index for `orderby` metadata on new compressed chunks - [#​9668](https://redirect.github.com/timescale/timescaledb/pull/9668) Allow database owner to configure hypertables and policies - [#​9701](https://redirect.github.com/timescale/timescaledb/pull/9701) Relax lock during continuous aggregate invalidation log processing - [#​9730](https://redirect.github.com/timescale/timescaledb/pull/9730) Add in-memory observability for compressed chunks - [#​9735](https://redirect.github.com/timescale/timescaledb/pull/9735) Improve `GapFill` row count estimate - [#​9821](https://redirect.github.com/timescale/timescaledb/pull/9821) Allow subquery results which are exec params as GapFill arguments - [#​9825](https://redirect.github.com/timescale/timescaledb/pull/9825) Support `ADD COLUMN` on continuous aggregates - [#​9842](https://redirect.github.com/timescale/timescaledb/pull/9842) Suppress continuous aggregate invalidation tracking during bulk loads - [#​9878](https://redirect.github.com/timescale/timescaledb/pull/9878) Remove `chunk_constraint` catalog tracking for foreign keys - [#​9893](https://redirect.github.com/timescale/timescaledb/pull/9893) Remove `chunk_constraint` catalog tracking for non-dimensional constraints - [#​9903](https://redirect.github.com/timescale/timescaledb/pull/9903) Incremental refresh for `refresh_continuous_aggregate()` - [#​9915](https://redirect.github.com/timescale/timescaledb/pull/9915) Remove `_timescaledb_catalog.chunk_constraint` table - [#​9938](https://redirect.github.com/timescale/timescaledb/pull/9938) Add `rebuild_sparse_index` function - [#​9964](https://redirect.github.com/timescale/timescaledb/pull/9964) Add a function to lock OSM chunk's dimension slice - [#​9980](https://redirect.github.com/timescale/timescaledb/pull/9980) Support `first/last(value, time)` in `ColumnarIndexScan` **Bugfixes** - [#​9708](https://redirect.github.com/timescale/timescaledb/pull/9708) Guard time bucket parameter handling against bad input - [#​9745](https://redirect.github.com/timescale/timescaledb/pull/9745) Check constraints when adding unique constraints to chunks - [#​9890](https://redirect.github.com/timescale/timescaledb/pull/9890) Fix incremental refresh batch boundaries to align with variable-width buckets and start only where a chunk and an invalidation overlap - [#​9914](https://redirect.github.com/timescale/timescaledb/pull/9914) Fix use-after-free in segmentwise recompression - [#​9929](https://redirect.github.com/timescale/timescaledb/pull/9929) Fix background jobs being bumped in the queue forever and never running - [#​9955](https://redirect.github.com/timescale/timescaledb/pull/9955) Fix wrong results when using Batch Sorted Merge with no first-last index on a non-leading order by column - [#​9967](https://redirect.github.com/timescale/timescaledb/pull/9967) Block upgrade after downgrade with first/last indexes present - [#​9976](https://redirect.github.com/timescale/timescaledb/pull/9976) Fix wrong results when comparing a date column to a `timestamptz` value - [#​9977](https://redirect.github.com/timescale/timescaledb/pull/9977) Fix `COPY WHERE` into a hypertable with dropped columns - [#​9981](https://redirect.github.com/timescale/timescaledb/pull/9981) Fix set-returning functions in the sort key of `ColumnarScan` - [#​9982](https://redirect.github.com/timescale/timescaledb/pull/9982) Reject `ALTER TABLE ... INHERIT` when the parent is a hypertable - [#​9984](https://redirect.github.com/timescale/timescaledb/pull/9984) Fix handling of `NOT VALID NOT NULL` constraint for query optimization - [#​9986](https://redirect.github.com/timescale/timescaledb/pull/9986) Handle `MERGE WHEN NOT MATCHED BY SOURCE` on hypertables - [#​9988](https://redirect.github.com/timescale/timescaledb/pull/9988) Fix `time_bucket_gapfill` function detection - [#​10003](https://redirect.github.com/timescale/timescaledb/pull/10003) Block unsafe updates of unique columns on compressed chunks - [#​10024](https://redirect.github.com/timescale/timescaledb/pull/10024) Fix `approximate_row_count` handling of Infinity - [#​10025](https://redirect.github.com/timescale/timescaledb/pull/10025) Fix rename on compressed continuous aggregates - [#​10026](https://redirect.github.com/timescale/timescaledb/pull/10026) Fix chunk skipping near `PG_INT64_MAX` **New Settings** - `skip_cagg_invalidation`: skip continuous aggregate invalidation tracking for DML and DDL in the current session/transaction. Off by default. - `stats_max_chunks`: set the per-database compressed chunk statistics cache capacity. Defaults to 1024 chunks; set to 0 to disable the feature. **Thanks** - [@​Fabian-2596](https://redirect.github.com/Fabian-2596) for suggesting more accurate GapFill row count estimate - [@​otjdiepluong](https://redirect.github.com/otjdiepluong) for fixing spelling mistakes in timescaledb source code comments - [@​scimad](https://redirect.github.com/scimad) and [@​Nosfistis](https://redirect.github.com/Nosfistis) for suggesting expanding coverage for gapfill arguments
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index b0f3bb8f..f022d66d 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.27.2-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.0-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.27.2' + version: '2.28.0' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index 3d054714..58bf2c42 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.27.2+dfsg-1.pgdg13+1" + package = "2.28.0+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.27.2" + sql = "2.28.0" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.27.2+dfsg-1.pgdg12+1" + package = "2.28.0+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.27.2" + sql = "2.28.0" } } } From 98b69eaa6371875c8083fa771aaf0f21d8356661 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:00:55 +0200 Subject: [PATCH 07/76] chore(deps): update dependency postgresql-18-postgis-3 (#248) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- postgis/README.md | 4 ++-- postgis/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/postgis/README.md b/postgis/README.md index f878ac00..07c9ef66 100644 --- a/postgis/README.md +++ b/postgis/README.md @@ -29,7 +29,7 @@ spec: - name: postgis image: # renovate: suite=trixie-pgdg depName=postgresql-18-postgis-3 - reference: ghcr.io/cloudnative-pg/postgis-extension:3.6.3-18-trixie + reference: ghcr.io/cloudnative-pg/postgis-extension:3.6.4-18-trixie ld_library_path: - system # Requires CloudNativePG 1.29 (or higher) @@ -58,7 +58,7 @@ spec: extensions: - name: postgis # renovate: suite=trixie-pgdg depName=postgresql-18-postgis-3 extractVersion=^(?\d+\.\d+\.\d+) - version: '3.6.3' + version: '3.6.4' - name: postgis_raster - name: postgis_sfcgal - name: fuzzystrmatch diff --git a/postgis/metadata.hcl b/postgis/metadata.hcl index 8ac1fc42..8ea87ac2 100644 --- a/postgis/metadata.hcl +++ b/postgis/metadata.hcl @@ -22,17 +22,17 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-postgis-3 - package = "3.6.3+dfsg-1.pgdg12+1" + package = "3.6.4+dfsg-2.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-postgis-3 extractVersion=^(?\d+\.\d+\.\d+) - sql = "3.6.3" + sql = "3.6.4" } } trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-postgis-3 - package = "3.6.3+dfsg-1.pgdg13+1" + package = "3.6.4+dfsg-2.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-postgis-3 extractVersion=^(?\d+\.\d+\.\d+) - sql = "3.6.3" + sql = "3.6.4" } } } From 10bbd9e3bab25be412bb0301dd3a9c635a04b2a6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:25:17 +0200 Subject: [PATCH 08/76] chore(deps): update all github action to v0.21.7 (#247) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 2 +- .github/workflows/test.yml | 2 +- .github/workflows/update-catalogs.yml | 2 +- .github/workflows/update_os_libraries.yml | 4 ++-- Taskfile.yml | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 093c54d6..b1d36189 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -33,7 +33,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.6 + DAGGER_VERSION: 0.21.7 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 878b0c8c..73ffe1c6 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -132,7 +132,7 @@ jobs: - name: Install Dagger env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.6 + DAGGER_VERSION: 0.21.7 run: | curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c45e7fd6..e9895c9b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -37,7 +37,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.4 + DAGGER_VERSION: 0.21.7 with: version: ${{ env.DAGGER_VERSION }} verb: develop diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index b75fd26a..1bcd46fa 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -39,7 +39,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.6 + DAGGER_VERSION: 0.21.7 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 7e58c04f..3b0bd2da 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -28,7 +28,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.6 + DAGGER_VERSION: 0.21.7 with: version: ${{ env.DAGGER_VERSION }} verb: call @@ -66,7 +66,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.6 + DAGGER_VERSION: 0.21.7 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/Taskfile.yml b/Taskfile.yml index 6863a3e4..7ee1558e 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -207,7 +207,7 @@ tasks: run: once vars: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_ENGINE_VERSION: v0.21.6 + DAGGER_ENGINE_VERSION: v0.21.7 cmds: - > docker run -d -v /var/lib/dagger --name {{ .DAGGER_ENGINE_NAME }} --restart always --network {{ .E2E_NETWORK }} From c3d8a32820f6da7bd4b322a26742c9c421c260f8 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:42:38 +0200 Subject: [PATCH 09/76] chore(deps): update checkout action to v7 (#250) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 6 +++--- .github/workflows/test.yml | 2 +- .github/workflows/update-catalogs.yml | 4 ++-- .github/workflows/update_os_libraries.yml | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index b1d36189..bb87fd02 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -24,7 +24,7 @@ jobs: matrix: ${{ steps.get-matrix.outputs.matrix}} steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 73ffe1c6..1b88056a 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -27,7 +27,7 @@ jobs: images: ${{ steps.images.outputs.images }} steps: - name: Checkout Code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -94,7 +94,7 @@ jobs: image: ${{fromJson(needs.testbuild.outputs.images)}} steps: - name: Checkout Code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -122,7 +122,7 @@ jobs: cnpg: ["main", "1.28", "1.29"] steps: - name: Checkout Code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e9895c9b..7d0e778d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -23,7 +23,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index 1bcd46fa..ed63e0d5 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -22,12 +22,12 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Checkout artifacts - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: path: artifacts repository: cloudnative-pg/artifacts diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 3b0bd2da..a572098d 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -19,7 +19,7 @@ jobs: extensions: ${{ steps.get-extensions.outputs.extensions }} steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -53,7 +53,7 @@ jobs: extension: ${{ fromJson(needs.fetch-extensions.outputs.extensions) }} steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Log in to the GitHub Container registry uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 From a9dc798297e4995adbf0f5ea41c65a48748e5457 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 10:45:02 +0200 Subject: [PATCH 10/76] chore(deps): update alpine/psql:18.4 docker digest to 01cbd02 (#253) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index cf505712..bdc13686 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e + image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index fb22912a..c4165a82 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e + image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index a818abe0..52f1c008 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e + image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 513f5185..98f86fe7 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:c39a6bd320ec77168aa5a7a8f2bb872a920697131a232fb87f2f319be220b30e + image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 command: ['sh', '-c'] args: - | From c0bea49791556514c6b5fb81d98b3680a129a001 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 18:32:00 +0200 Subject: [PATCH 11/76] chore(deps): update alpine/kubectl:1.36.2 docker digest to 01d138c (#252) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 7ee1558e..a23f7631 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -282,7 +282,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.2@sha256:e5e66d693f2c01b3962e959f4a58cdc0dbc28231dc134177d0d78dc91d742c56 + KUBECTL_VERSION: 1.36.2@sha256:01d138ce994b684abc62d9cfdff44de42a4c8996dcc12626dd0193afc3fb5a95 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From ca4054636a4c97c05e6e1dd6f53a7cec965bc864 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 11:28:10 +0200 Subject: [PATCH 12/76] chore(deps): update registry:3.1.1 docker digest to 5620083 (#257) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index a23f7631..d3b893ef 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -191,7 +191,7 @@ tasks: run: once vars: # renovate: datasource=docker depName=registry versioning=docker - REGISTRY_VERSION: 3.1.1@sha256:85347ed2ecde64161c7a4788a4d7d3dcc9d6f86f7be95834022e3c6a423a945a + REGISTRY_VERSION: 3.1.1@sha256:5620083c96ffb6f6296bbda84b2da7e822ed95d8df10de6434cee19c39fe0e9c cmds: - > docker run -d --name {{ .REGISTRY_NAME }} --rm -p {{ .REGISTRY_HOST_PORT }}:{{ .REGISTRY_INTERNAL_PORT }} From d86429345d50f64415080f5bd9199e3fe1bae911 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 11:45:53 +0200 Subject: [PATCH 13/76] chore(deps): update dependency postgresql-18-pgvector (#255) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pgvector/README.md | 4 ++-- pgvector/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pgvector/README.md b/pgvector/README.md index 4467b687..ff68e760 100644 --- a/pgvector/README.md +++ b/pgvector/README.md @@ -30,7 +30,7 @@ spec: - name: pgvector image: # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - reference: ghcr.io/cloudnative-pg/pgvector:0.8.2-18-trixie + reference: ghcr.io/cloudnative-pg/pgvector:0.8.3-18-trixie ``` ### 2. Enable the extension in a database @@ -51,7 +51,7 @@ spec: extensions: - name: vector # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - version: '0.8.2' + version: '0.8.3' ``` ### 3. Verify installation diff --git a/pgvector/metadata.hcl b/pgvector/metadata.hcl index 6d122138..842a7f97 100644 --- a/pgvector/metadata.hcl +++ b/pgvector/metadata.hcl @@ -18,17 +18,17 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector - package = "0.8.2-1.pgdg12+1" + package = "0.8.3-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.2" + sql = "0.8.3" } } trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - package = "0.8.2-1.pgdg13+1" + package = "0.8.3-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.2" + sql = "0.8.3" } } } From dba3bb768278c46211b72441e0e45c7e16d612fc Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 24 Jun 2026 04:54:29 +0000 Subject: [PATCH 14/76] chore(deps): update dependency postgresql-18-timescaledb (#258) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.0` → `2.28.1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.0+dfsg-1.pgdg12+1` → `2.28.1+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.0+dfsg-1.pgdg13+1` → `2.28.1+dfsg-1.pgdg13+1` | --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.28.1`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2281-2026-06-23) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.28.0...2.28.1) This release contains performance improvements and bug fixes since the 2.28.0 release. We recommend that you upgrade at the next available opportunity. **Bugfixes** - [#​9913](https://redirect.github.com/timescale/timescaledb/pull/9913) Fix potential crash on `DML` on compressed tables when the plan uses `Bitmap Heap Scan` - [#​10091](https://redirect.github.com/timescale/timescaledb/pull/10091) Fix column rename for compressed chunks - [#​10056](https://redirect.github.com/timescale/timescaledb/pull/10056) Enforce `CHECK`, `NOT NULL` and view `WITH CHECK OPTION` constraints for direct compress inserts - [#​10059](https://redirect.github.com/timescale/timescaledb/pull/10059) Fix error when using `first`/`last` aggregates in a `HAVING` clause - [#​10060](https://redirect.github.com/timescale/timescaledb/pull/10060) Fix `first`/`last` optimization returning the same value for aggregates that share the value column but order by different columns - [#​10061](https://redirect.github.com/timescale/timescaledb/pull/10061) Fix internal error in `first`/`last` for unsortable types - [#​10069](https://redirect.github.com/timescale/timescaledb/pull/10069) Fix `bgw_job_stat_history` definition - [#​10073](https://redirect.github.com/timescale/timescaledb/pull/10073) Fix uncompressed size estimate for `varlen` - [#​10089](https://redirect.github.com/timescale/timescaledb/pull/10089) Fix deleting every row on compressed hypertable with subquery returning constant false - [#​10094](https://redirect.github.com/timescale/timescaledb/pull/10094) Fix use-after-free in `ALTER TABLE ADD CONSTRAINT` **Thanks** - [@​skrenes](https://redirect.github.com/skrenes) for reporting a problem with the `job_history` view when upgrading to 2.28.0
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index f022d66d..c6eefb08 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.0-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.1-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.28.0' + version: '2.28.1' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index 58bf2c42..75b602be 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.28.0+dfsg-1.pgdg13+1" + package = "2.28.1+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.0" + sql = "2.28.1" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.28.0+dfsg-1.pgdg12+1" + package = "2.28.1+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.0" + sql = "2.28.1" } } } From b5ef9cc5e70a3a63e0eb9f1089e17aebcbc38604 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 24 Jun 2026 09:10:18 +0000 Subject: [PATCH 15/76] chore(deps): update all github action (#260) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://redirect.github.com/actions/setup-go) ([changelog](https://redirect.github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c..924ae3a1cded613372ab5595356fb5720e22ba16)) | action | digest | `4a36011` → `924ae3a` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7d0e778d..416a2add 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,7 +28,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: dagger/maintenance/go.mod cache-dependency-path: dagger/maintenance/go.sum From 9068c5c91bbaefe2b033d6b9ec8f1bbc9604dd20 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 24 Jun 2026 11:36:40 +0200 Subject: [PATCH 16/76] chore(deps): update registry:3.1.1 docker digest to 1be5527 (#259) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [registry](https://redirect.github.com/distribution/distribution) | digest | `5620083` → `1be5527` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index d3b893ef..8288ec64 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -191,7 +191,7 @@ tasks: run: once vars: # renovate: datasource=docker depName=registry versioning=docker - REGISTRY_VERSION: 3.1.1@sha256:5620083c96ffb6f6296bbda84b2da7e822ed95d8df10de6434cee19c39fe0e9c + REGISTRY_VERSION: 3.1.1@sha256:1be55279f18a2fe1a74edf2664cac61c1bea305b7b4642dab412e7affdcb3e33 cmds: - > docker run -d --name {{ .REGISTRY_NAME }} --rm -p {{ .REGISTRY_HOST_PORT }}:{{ .REGISTRY_INTERNAL_PORT }} From 285eb327c35082526276804eb14e6b2018f6b3df Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 29 Jun 2026 10:54:35 +0000 Subject: [PATCH 17/76] chore(deps): update alpine/kubectl:1.36.2 docker digest to 03f27b6 (#264) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | alpine/kubectl | digest | `01d138c` → `03f27b6` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 8288ec64..d4137dc8 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -282,7 +282,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.2@sha256:01d138ce994b684abc62d9cfdff44de42a4c8996dcc12626dd0193afc3fb5a95 + KUBECTL_VERSION: 1.36.2@sha256:03f27b659dbbc2fb36b188dc5b4b4d83228616d164dbf1b2f8f0435b9c6a0ee9 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 922cadd2054e4f7ebe33d342131e0c65f177d970 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 13:54:43 +0200 Subject: [PATCH 18/76] chore(deps): update alpine/psql:18.4 docker digest to b884e06 (#265) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | alpine/psql | digest | `01cbd02` → `b884e06` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index bdc13686..7bdfacb7 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 + image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index c4165a82..02ab44ef 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 + image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index 52f1c008..f7dadf07 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 + image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 98f86fe7..5ba4a87c 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:01cbd02460d328e70d5ac67d96067d64607d7820b14dc5b5ca70852a10aef8a4 + image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 command: ['sh', '-c'] args: - | From be1c8dd1f8fcc139fd086eda9c571399a76bb787 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Thu, 2 Jul 2026 09:52:38 +0200 Subject: [PATCH 19/76] fix: set output to cacheonly when running bake --check (#262) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `bake --check` only lints (no image needs to be produced). Override the output to `cacheonly` so index annotations are never applied to a single-platform export. Closes #261 Signed-off-by: Niccolò Fei --- Taskfile.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index d4137dc8..01a73b51 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -56,7 +56,10 @@ tasks: msg: 'Not a valid target, metadata.hcl file is missing. Target: {{.TARGET}}' cmds: - echo -e "{{.BLUE}}Checking target {{.TARGET}}...{{.NC}}" - - docker buildx bake -f {{.TARGET}}/metadata.hcl -f docker-bake.hcl --check + # --check builds a single platform, which conflicts with the index-level + # OCI annotations in docker-bake.hcl. Override the output to cacheonly so + # the check only lints the build without exporting an image. + - docker buildx bake -f {{.TARGET}}/metadata.hcl -f docker-bake.hcl --check --set "*.output=type=cacheonly" requires: vars: - name: TARGET From 838f4f71a3deaee03e14ba08d0f1ae68ae4999f4 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 2 Jul 2026 12:10:18 +0200 Subject: [PATCH 20/76] chore(deps): update all github action (#267) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 1b88056a..a92463c7 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -39,7 +39,7 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} - name: Set up QEMU - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 with: platforms: 'linux/arm64' @@ -47,7 +47,7 @@ jobs: uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 - name: Build and push - uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7 + uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7 id: build env: BUILDX_METADATA_PROVENANCE: disabled From 91e19d3f014845db8805d518a3829a220a5c6ed2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 2 Jul 2026 12:24:30 +0200 Subject: [PATCH 21/76] chore(deps): update all github action (#270) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 4 ++-- .github/workflows/update_os_libraries.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index a92463c7..e620cb4d 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Log in to the GitHub Container registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -44,7 +44,7 @@ jobs: platforms: 'linux/arm64' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Build and push uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7 diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index a572098d..2b6d5c86 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Log in to the GitHub Container registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4 with: registry: ghcr.io username: ${{ github.actor }} From add5ecd1f2e6662f70f1122f14155b130d6403a7 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 2 Jul 2026 12:33:58 +0200 Subject: [PATCH 22/76] chore(deps): update dependency postgresql-18-pgvector (#268) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pgvector/README.md | 4 ++-- pgvector/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pgvector/README.md b/pgvector/README.md index ff68e760..20e849ef 100644 --- a/pgvector/README.md +++ b/pgvector/README.md @@ -30,7 +30,7 @@ spec: - name: pgvector image: # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - reference: ghcr.io/cloudnative-pg/pgvector:0.8.3-18-trixie + reference: ghcr.io/cloudnative-pg/pgvector:0.8.4-18-trixie ``` ### 2. Enable the extension in a database @@ -51,7 +51,7 @@ spec: extensions: - name: vector # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - version: '0.8.3' + version: '0.8.4' ``` ### 3. Verify installation diff --git a/pgvector/metadata.hcl b/pgvector/metadata.hcl index 842a7f97..d80d3532 100644 --- a/pgvector/metadata.hcl +++ b/pgvector/metadata.hcl @@ -18,17 +18,17 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector - package = "0.8.3-1.pgdg12+1" + package = "0.8.4-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.3" + sql = "0.8.4" } } trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - package = "0.8.3-1.pgdg13+1" + package = "0.8.4-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.3" + sql = "0.8.4" } } } From 1bbe37c20e2810751ed336a146d249909a480897 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 13:19:28 +0200 Subject: [PATCH 23/76] chore(deps): update all github action (#271) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 2 +- .github/workflows/update_os_libraries.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index bb87fd02..18063d00 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -66,7 +66,7 @@ jobs: } >> "$GITHUB_ENV" - name: Check for changes - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 id: filter with: filters: | diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index e620cb4d..006d3009 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Log in to the GitHub Container registry - uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 2b6d5c86..da3b5ab9 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Log in to the GitHub Container registry - uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ghcr.io username: ${{ github.actor }} From 80b06c8f3e875d007dc847bf3a50f0d4cc7e1500 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 13:38:44 +0200 Subject: [PATCH 24/76] chore(deps): update alpine/kubectl:1.36.2 docker digest to 8c14592 (#272) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 01a73b51..b7335fa7 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -285,7 +285,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.2@sha256:03f27b659dbbc2fb36b188dc5b4b4d83228616d164dbf1b2f8f0435b9c6a0ee9 + KUBECTL_VERSION: 1.36.2@sha256:8c1459287ab748db6c8601ca23e91ba43ef20e1dcb83ad61f2e8e162d05fb325 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 3a3603a2e47de2cc684ccdf412e0b8ee66da6e0b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 13:54:59 +0200 Subject: [PATCH 25/76] chore(deps): update alpine/psql:18.4 docker digest to 54e0912 (#273) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index 7bdfacb7..4320d0bb 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 + image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index 02ab44ef..7f578175 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 + image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index f7dadf07..9505254b 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 + image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 5ba4a87c..307f802a 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b884e06e00f3318ce1cac67ce8305d3a793c72c4fe821fa397d20e2ea38b2636 + image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 command: ['sh', '-c'] args: - | From 6e9e59d847885ea5b431a9ff5a1f56d306d283d9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 18:29:52 +0000 Subject: [PATCH 26/76] chore(deps): update dependency postgresql-18-timescaledb (#269) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.1` → `2.28.2` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.1+dfsg-1.pgdg12+1` → `2.28.2+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.1+dfsg-1.pgdg13+1` → `2.28.2+dfsg-1.pgdg13+1` | --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.28.2`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2282-2026-06-30) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.28.1...2.28.2) This release contains bug fixes since the 2.28.1 release. We recommend that you upgrade at the next available opportunity. **Bugfixes** - [#​10126](https://redirect.github.com/timescale/timescaledb/pull/10126) Fix `bgw_job_stat_history` migration for 2.28.1 - [#​10133](https://redirect.github.com/timescale/timescaledb/pull/10133) Fix `chunk_constraint` migration - [#​10137](https://redirect.github.com/timescale/timescaledb/pull/10137) Fix column ordering on `first`/`last`-based sparse indexes - [#​10164](https://redirect.github.com/timescale/timescaledb/pull/10164) Automatically drop incompatible smallint bloom filters when upgrading instead of stopping the upgrade **Thanks** - [@​juantxorena](https://redirect.github.com/juantxorena) for reporting an issue with update script for 2.28.1 - [@​rusha1333](https://redirect.github.com/rusha1333) for reporting an issue when upgrading to 2.28.1
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index c6eefb08..ce243e61 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.1-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.2-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.28.1' + version: '2.28.2' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index 75b602be..322d4a09 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.28.1+dfsg-1.pgdg13+1" + package = "2.28.2+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.1" + sql = "2.28.2" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.28.1+dfsg-1.pgdg12+1" + package = "2.28.2+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.1" + sql = "2.28.2" } } } From 9755a49bdb19aaef02df236cd8b4a59396e7a925 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Wed, 8 Jul 2026 18:22:16 +0200 Subject: [PATCH 27/76] feat: derive build matrix from distros and PG versions in extension's metadata (#251) Previously the build matrix was a hardcoded cross-product of two global lists (distributions and PG versions), forcing every extension to build for every distribution and forcing all distributions to share the same PostgreSQL majors. The matrix is now derived from the explicit (distro, PG major) pairs each extension declares under its own metadata.versions, so extensions can declare their own valid combinations. docker-bake.hcl gains getBuildMatrix()/getBuildName() to centralize this, and the dagger maintenance module mirrors the same logic in Go, dropping its dependency on github.com/docker/buildx/bake in the process. The docker-bake.hcl/metadata.hcl load order is flipped so per-extension overrides (used by postgis) apply correctly. Closes #242 --- .github/workflows/bake_targets.yml | 2 +- BUILD.md | 7 +- Taskfile.yml | 7 +- dagger/maintenance/dagger.json | 2 +- dagger/maintenance/go.mod | 156 +------- dagger/maintenance/go.sum | 573 +---------------------------- dagger/maintenance/main.go | 57 ++- dagger/maintenance/parse.go | 94 ++--- dagger/maintenance/parse_test.go | 100 +++++ docker-bake.hcl | 77 ++-- postgis/metadata.hcl | 7 +- 11 files changed, 246 insertions(+), 836 deletions(-) create mode 100644 dagger/maintenance/parse_test.go diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 006d3009..9fdf5bd7 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -55,7 +55,7 @@ jobs: registry: ghcr.io/${{ github.repository_owner }} revision: ${{ github.sha }} with: - files: ./${{ inputs.extension_name }}/metadata.hcl,./docker-bake.hcl + files: ./docker-bake.hcl,./${{ inputs.extension_name }}/metadata.hcl push: true # From bake's metadata, extract each unique tag (e.g. the ones with the timestamp) diff --git a/BUILD.md b/BUILD.md index dd89994a..d0bc22a9 100644 --- a/BUILD.md +++ b/BUILD.md @@ -60,16 +60,17 @@ For more complex setups, you can use the `dagger` command directly to customize distributions or package names: ```bash -dagger call -sm ./dagger/maintenance/ create --name="" [ARGUMENTS] +dagger call -sm ./dagger/maintenance/ create --name="" [ARGUMENTS] \ + export --path ./ ``` **Common Arguments:** | Argument | Description | Default | | --- | --- | --- | -| `--distros` | Debian distributions the extension supports. | `[trixie, bookworm]` | +| `--distros` | Debian distributions the extension supports (comma separated list). | `[trixie, bookworm]` | | `--package-name` | The Debian package name (uses `%version%` placeholder). | `postgresql-%version%-` | -| `--versions` | Supported Postgres major versions. | `[18]` | +| `--versions` | Supported Postgres major versions (comma separated list). | `[18]` | | `--templates-dir` | Source directory containing custom template files. | Internal template dir | --- diff --git a/Taskfile.yml b/Taskfile.yml index b7335fa7..176ab93e 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -59,7 +59,7 @@ tasks: # --check builds a single platform, which conflicts with the index-level # OCI annotations in docker-bake.hcl. Override the output to cacheonly so # the check only lints the build without exporting an image. - - docker buildx bake -f {{.TARGET}}/metadata.hcl -f docker-bake.hcl --check --set "*.output=type=cacheonly" + - docker buildx bake -f docker-bake.hcl -f {{.TARGET}}/metadata.hcl --check --set "*.output=type=cacheonly" requires: vars: - name: TARGET @@ -95,9 +95,9 @@ tasks: - echo -e "{{.BLUE}}Baking target {{.TARGET}} (push={{.PUSH}})...{{.NC}}" - | if [ "{{.DRY_RUN}}" = "true" ]; then - echo -e "{{.GREEN}}[DRY RUN] docker buildx bake -f {{.TARGET}}/metadata.hcl -f docker-bake.hcl --metadata-file="{{.METADATA_FILE}}" --push={{.PUSH}}{{.NC}}" + echo -e "{{.GREEN}}[DRY RUN] docker buildx bake -f docker-bake.hcl -f {{.TARGET}}/metadata.hcl --metadata-file="{{.METADATA_FILE}}" --push={{.PUSH}}{{.NC}}" else - docker buildx bake -f {{.TARGET}}/metadata.hcl -f docker-bake.hcl --metadata-file="{{.METADATA_FILE}}" --push={{.PUSH}} + docker buildx bake -f docker-bake.hcl -f {{.TARGET}}/metadata.hcl --metadata-file="{{.METADATA_FILE}}" --push={{.PUSH}} fi - echo -e "{{.GREEN}}--- Successfully baked {{.TARGET}} ---{{.NC}}" requires: @@ -153,7 +153,6 @@ tasks: requires: vars: - name: NAME - desc: The name of the extension to create (lowercase alphanumeric, hyphens, and underscores only) generate-values: desc: Generate Chainsaw testing values for the specified target diff --git a/dagger/maintenance/dagger.json b/dagger/maintenance/dagger.json index c64f92d5..0d8b0523 100644 --- a/dagger/maintenance/dagger.json +++ b/dagger/maintenance/dagger.json @@ -1,6 +1,6 @@ { "name": "maintenance", - "engineVersion": "v0.21.4", + "engineVersion": "v0.21.7", "sdk": { "source": "go" } diff --git a/dagger/maintenance/go.mod b/dagger/maintenance/go.mod index db45ab15..4e0ade35 100644 --- a/dagger/maintenance/go.mod +++ b/dagger/maintenance/go.mod @@ -3,7 +3,6 @@ module dagger/maintenance go 1.26.1 require ( - github.com/docker/buildx v0.33.0 github.com/google/go-containerregistry v0.21.5 github.com/hashicorp/hcl/v2 v2.24.0 github.com/vektah/gqlparser/v2 v2.5.32 @@ -16,182 +15,39 @@ require github.com/dagger/otel-go v1.43.0 require go.opentelemetry.io/otel/sdk v1.43.0 require ( - github.com/Masterminds/semver/v3 v3.4.0 // indirect - github.com/ProtonMail/go-crypto v1.4.1 // indirect - github.com/agnivade/levenshtein v1.2.1 // indirect - github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect - github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 // indirect - github.com/aws/aws-sdk-go-v2/service/signin v1.0.10 // indirect - github.com/blang/semver v3.5.1+incompatible // indirect - github.com/clipperhouse/uax29/v2 v2.7.0 // indirect - github.com/cloudflare/circl v1.6.3 // indirect - github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect - github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect - github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c // indirect - github.com/digitorus/timestamp v0.0.0-20250524132541-c45532741eea // indirect - github.com/go-openapi/analysis v0.25.0 // indirect - github.com/go-openapi/errors v0.22.7 // indirect - github.com/go-openapi/jsonpointer v0.23.1 // indirect - github.com/go-openapi/jsonreference v0.21.5 // indirect - github.com/go-openapi/loads v0.23.3 // indirect - github.com/go-openapi/runtime v0.29.4 // indirect - github.com/go-openapi/spec v0.22.4 // indirect - github.com/go-openapi/strfmt v0.26.1 // indirect - github.com/go-openapi/swag v0.26.0 // indirect - github.com/go-openapi/swag/cmdutils v0.26.0 // indirect - github.com/go-openapi/swag/conv v0.26.0 // indirect - github.com/go-openapi/swag/fileutils v0.26.0 // indirect - github.com/go-openapi/swag/jsonname v0.26.0 // indirect - github.com/go-openapi/swag/jsonutils v0.26.0 // indirect - github.com/go-openapi/swag/loading v0.26.0 // indirect - github.com/go-openapi/swag/mangling v0.26.0 // indirect - github.com/go-openapi/swag/netutils v0.26.0 // indirect - github.com/go-openapi/swag/stringutils v0.26.0 // indirect - github.com/go-openapi/swag/typeutils v0.26.0 // indirect - github.com/go-openapi/swag/yamlutils v0.26.0 // indirect - github.com/go-openapi/validate v0.25.2 // indirect - github.com/gobwas/glob v0.2.3 // indirect - github.com/goccy/go-json v0.10.6 // indirect - github.com/golang/snappy v1.0.0 // indirect - github.com/google/certificate-transparency-go v1.3.3 // indirect - github.com/hiddeco/sshsig v0.2.0 // indirect - github.com/in-toto/attestation v1.2.0 // indirect - github.com/lestrrat-go/blackmagic v1.0.4 // indirect - github.com/lestrrat-go/dsig v1.3.0 // indirect - github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect - github.com/lestrrat-go/httpcc v1.0.1 // indirect - github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect - github.com/lestrrat-go/jwx/v3 v3.1.0 // indirect - github.com/lestrrat-go/option/v2 v2.0.0 // indirect - github.com/moby/moby/api v1.54.1 // indirect - github.com/moby/moby/client v0.4.0 // indirect - github.com/moby/policy-helpers v0.0.0-20260324161837-b7c0b994300b // indirect - github.com/oklog/ulid/v2 v2.1.1 // indirect - github.com/open-policy-agent/opa v1.15.2 // indirect - github.com/package-url/packageurl-go v0.1.5 // indirect - github.com/pelletier/go-toml/v2 v2.3.0 // indirect - github.com/prometheus/procfs v0.20.1 // indirect - github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect - github.com/segmentio/asm v1.2.1 // indirect - github.com/sigstore/protobuf-specs v0.5.1 // indirect - github.com/sigstore/rekor v1.5.1 // indirect - github.com/sigstore/rekor-tiles/v2 v2.2.1 // indirect - github.com/sigstore/sigstore v1.10.5 // indirect - github.com/sigstore/sigstore-go v1.1.4 // indirect - github.com/sigstore/timestamp-authority/v2 v2.0.6 // indirect - github.com/tchap/go-patricia/v2 v2.3.3 // indirect - github.com/theupdateframework/go-tuf/v2 v2.4.1 // indirect - github.com/transparency-dev/formats v0.1.0 // indirect - github.com/transparency-dev/merkle v0.0.2 // indirect - github.com/valyala/fastjson v1.6.10 // indirect - github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect - github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect - github.com/yashtewari/glob-intersection v0.2.0 // indirect - go.yaml.in/yaml/v2 v2.4.4 // indirect - go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect - golang.org/x/term v0.42.0 // indirect - k8s.io/klog/v2 v2.140.0 // indirect - sigs.k8s.io/yaml v1.6.0 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect + github.com/go-test/deep v1.1.1 // indirect + github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect + github.com/sergi/go-diff v1.4.0 // indirect + gotest.tools/v3 v3.5.2 // indirect ) require ( github.com/99designs/gqlgen v0.17.89 // indirect - github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect github.com/Khan/genqlient v0.8.1 - github.com/Microsoft/go-winio v0.6.2 // indirect github.com/agext/levenshtein v1.2.3 // indirect - github.com/apparentlymart/go-cidr v1.1.0 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect - github.com/aws/aws-sdk-go-v2 v1.41.6 // indirect - github.com/aws/aws-sdk-go-v2/config v1.32.16 // indirect - github.com/aws/aws-sdk-go-v2/credentials v1.19.15 // indirect - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.22 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.30.16 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.20 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.42.0 // indirect - github.com/aws/smithy-go v1.25.0 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/compose-spec/compose-go/v2 v2.10.2 // indirect - github.com/containerd/console v1.0.5 // indirect - github.com/containerd/containerd/api v1.10.0 // indirect - github.com/containerd/containerd/v2 v2.2.3 // indirect - github.com/containerd/continuity v0.4.5 // indirect - github.com/containerd/errdefs v1.0.0 // indirect - github.com/containerd/errdefs/pkg v0.3.0 // indirect - github.com/containerd/log v0.1.0 // indirect - github.com/containerd/platforms v1.0.0-rc.4 // indirect github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect - github.com/containerd/ttrpc v1.2.8 // indirect - github.com/containerd/typeurl/v2 v2.2.3 // indirect github.com/dagger/querybuilder v0.0.0-20260402040506-574a5e81cb59 - github.com/distribution/reference v0.6.0 // indirect github.com/docker/cli v29.4.0+incompatible // indirect - github.com/docker/distribution v2.8.3+incompatible // indirect - github.com/docker/docker v28.5.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.6 // indirect - github.com/docker/go-connections v0.7.0 // indirect - github.com/docker/go-units v0.5.0 // indirect - github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/fvbommel/sortorder v1.1.0 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-viper/mapstructure/v2 v2.5.0 // indirect - github.com/gofrs/flock v0.13.0 // indirect - github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/protobuf v1.5.4 // indirect github.com/google/go-cmp v0.7.0 // indirect - github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/gorilla/mux v1.8.1 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect - github.com/hashicorp/go-cleanhttp v0.5.2 // indirect - github.com/hashicorp/go-cty-funcs v0.1.0 // indirect - github.com/in-toto/in-toto-golang v0.10.0 // indirect - github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/klauspost/compress v1.18.5 // indirect - github.com/mattn/go-runewidth v0.0.23 // indirect - github.com/mattn/go-shellwords v1.0.13 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect - github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect - github.com/moby/buildkit v0.29.0 // indirect - github.com/moby/docker-image-spec v1.3.1 // indirect - github.com/moby/locker v1.0.1 // indirect - github.com/moby/patternmatcher v0.6.1 // indirect - github.com/moby/sys/atomicwriter v0.1.0 // indirect - github.com/moby/sys/mountinfo v0.7.2 // indirect - github.com/moby/sys/sequential v0.6.0 // indirect - github.com/moby/sys/signal v0.7.1 // indirect - github.com/moby/term v0.5.2 // indirect - github.com/morikuni/aec v1.1.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 - github.com/pkg/errors v0.9.1 // indirect - github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect - github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect - github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect - github.com/shibumi/go-pathspec v1.3.0 // indirect github.com/sirupsen/logrus v1.9.4 // indirect github.com/sosodev/duration v1.4.0 // indirect - github.com/spf13/cobra v1.10.2 // indirect - github.com/spf13/pflag v1.0.10 // indirect - github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect - github.com/tonistiigi/fsutil v0.0.0-20251211185533-a2aa163d723f // indirect - github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect - github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect - github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect github.com/vbatts/tar-split v0.12.2 // indirect - github.com/xhit/go-str2duration/v2 v2.1.0 // indirect github.com/zclconf/go-cty v1.18.1 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect @@ -205,13 +61,11 @@ require ( go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.yaml.in/yaml/v3 v3.0.4 - golang.org/x/crypto v0.50.0 // indirect golang.org/x/mod v0.35.0 // indirect golang.org/x/net v0.53.0 // indirect golang.org/x/sync v0.20.0 // indirect golang.org/x/sys v0.43.0 // indirect golang.org/x/text v0.36.0 - golang.org/x/time v0.15.0 // indirect golang.org/x/tools v0.44.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect diff --git a/dagger/maintenance/go.sum b/dagger/maintenance/go.sum index 321eec1f..17f0d060 100644 --- a/dagger/maintenance/go.sum +++ b/dagger/maintenance/go.sum @@ -1,596 +1,94 @@ -cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= -cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= -cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM= -cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M= -cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= -cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= -cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= -cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= -cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc= -cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU= -cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU= -cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58= -cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8= -cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk= -cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8= -cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc= -filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= -filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= github.com/99designs/gqlgen v0.17.89 h1:KzEcxPiMgQoMw3m/E85atUEHyZyt0PbAflMia5Kw8z8= github.com/99designs/gqlgen v0.17.89/go.mod h1:GFqruTVGB7ZTdrf1uzOagpXbY7DrEt1pIxnTdhIbWvQ= -github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= -github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= -github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg= -github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= -github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= -github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= -github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs= -github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/Khan/genqlient v0.8.1 h1:wtOCc8N9rNynRLXN3k3CnfzheCUNKBcvXmVv5zt6WCs= github.com/Khan/genqlient v0.8.1/go.mod h1:R2G6DzjBvCbhjsEajfRjbWdVglSH/73kSivC9TLWVjU= -github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= -github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= -github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= -github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/Microsoft/hcsshim v0.14.1 h1:CMuB3fqQVfPdhyXhUqYdUmPUIOhJkmghCx3dJet8Cqs= -github.com/Microsoft/hcsshim v0.14.1/go.mod h1:VnzvPLyWUhxiPVsJ31P6XadxCcTogTguBFDy/1GR/OM= -github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM= -github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo= github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558= github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM= github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU= -github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0= -github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30= -github.com/anchore/go-struct-converter v0.1.0 h1:2rDRssAl6mgKBSLNiVCMADgZRhoqtw9dedlWa0OhD30= -github.com/anchore/go-struct-converter v0.1.0/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= -github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU= -github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc= github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY= github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4= -github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q= -github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE= -github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= -github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= -github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ= -github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk= -github.com/aws/aws-sdk-go-v2 v1.41.6 h1:1AX0AthnBQzMx1vbmir3Y4WsnJgiydmnJjiLu+LvXOg= -github.com/aws/aws-sdk-go-v2 v1.41.6/go.mod h1:dy0UzBIfwSeot4grGvY1AqFWN5zgziMmWGzysDnHFcQ= -github.com/aws/aws-sdk-go-v2/config v1.32.16 h1:Q0iQ7quUgJP0F/SCRTieScnaMdXr9h/2+wze1u3cNeM= -github.com/aws/aws-sdk-go-v2/config v1.32.16/go.mod h1:duCCnJEFqpt2RC6no1iK6q+8HpwOAkiUua0pY507dQc= -github.com/aws/aws-sdk-go-v2/credentials v1.19.15 h1:fyvgWTszojq8hEnMi8PPBTvZdTtEVmAVyo+NFLHBhH4= -github.com/aws/aws-sdk-go-v2/credentials v1.19.15/go.mod h1:gJiYyMOjNg8OEdRWOf3CrFQxM2a98qmrtjx1zuiQfB8= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.22 h1:IOGsJ1xVWhsi+ZO7/NW8OuZZBtMJLZbk4P5HDjJO0jQ= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.22/go.mod h1:b+hYdbU+jGKfXE8kKM6g1+h+L/Go3vMvzlxBsiuGsxg= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22 h1:GmLa5Kw1ESqtFpXsx5MmC84QWa/ZrLZvlJGa2y+4kcQ= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22/go.mod h1:6sW9iWm9DK9YRpRGga/qzrzNLgKpT2cIxb7Vo2eNOp0= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 h1:dY4kWZiSaXIzxnKlj17nHnBcXXBfac6UlsAx2qL6XrU= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22/go.mod h1:KIpEUx0JuRZLO7U6cbV204cWAEco2iC3l061IxlwLtI= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 h1:FPXsW9+gMuIeKmz7j6ENWcWtBGTe1kH8r9thNt5Uxx4= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23/go.mod h1:7J8iGMdRKk6lw2C+cMIphgAnT8uTwBwNOsGkyOCm80U= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8 h1:HtOTYcbVcGABLOVuPYaIihj6IlkqubBwFj10K5fxRek= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.8/go.mod h1:VsK9abqQeGlzPgUr+isNWzPlK2vKe9INMLWnY65f5Xs= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22 h1:PUmZeJU6Y1Lbvt9WFuJ0ugUK2xn6hIWUBBbKuOWF30s= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.22/go.mod h1:nO6egFBoAaoXze24a2C0NjQCvdpk8OueRoYimvEB9jo= -github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 h1:s/zDSG/a/Su9aX+v0Ld9cimUCdkr5FWPmBV8owaEbZY= -github.com/aws/aws-sdk-go-v2/service/kms v1.50.3/go.mod h1:/iSgiUor15ZuxFGQSTf3lA2FmKxFsQoc2tADOarQBSw= -github.com/aws/aws-sdk-go-v2/service/signin v1.0.10 h1:a1Fq/KXn75wSzoJaPQTgZO0wHGqE9mjFnylnqEPTchA= -github.com/aws/aws-sdk-go-v2/service/signin v1.0.10/go.mod h1:p6+MXNxW7IA6dMgHfTAzljuwSKD0NCm/4lbS4t6+7vI= -github.com/aws/aws-sdk-go-v2/service/sso v1.30.16 h1:x6bKbmDhsgSZwv6q19wY/u3rLk/3FGjJWyqKcIRufpE= -github.com/aws/aws-sdk-go-v2/service/sso v1.30.16/go.mod h1:CudnEVKRtLn0+3uMV0yEXZ+YZOKnAtUJ5DmDhilVnIw= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.20 h1:oK/njaL8GtyEihkWMD4k3VgHCT64RQKkZwh0DG5j8ak= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.20/go.mod h1:JHs8/y1f3zY7U5WcuzoJ/yAYGYtNIVPKLIbp61euvmg= -github.com/aws/aws-sdk-go-v2/service/sts v1.42.0 h1:ks8KBcZPh3PYISr5dAiXCM5/Thcuxk8l+PG4+A0exds= -github.com/aws/aws-sdk-go-v2/service/sts v1.42.0/go.mod h1:pFw33T0WLvXU3rw1WBkpMlkgIn54eCB5FYLhjDc9Foo= -github.com/aws/smithy-go v1.25.0 h1:Sz/XJ64rwuiKtB6j98nDIPyYrV1nVNJ4YU74gttcl5U= -github.com/aws/smithy-go v1.25.0/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= -github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= -github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= -github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ= -github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk= -github.com/bytecodealliance/wasmtime-go/v39 v39.0.1 h1:RibaT47yiyCRxMOj/l2cvL8cWiWBSqDXHyqsa9sGcCE= -github.com/bytecodealliance/wasmtime-go/v39 v39.0.1/go.mod h1:miR4NYIEBXeDNamZIzpskhJ0z/p8al+lwMWylQ/ZJb4= -github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= -github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= -github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= -github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= -github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= -github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE= -github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4= -github.com/compose-spec/compose-go/v2 v2.10.2 h1:USa1NUbDcl/cjb8T9iwnuFsnO79H+2ho2L5SjFKz3uI= -github.com/compose-spec/compose-go/v2 v2.10.2/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg= -github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ= -github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= -github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc= -github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= -github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o= -github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM= -github.com/containerd/containerd/v2 v2.2.3 h1:mOBRLaHGvmgy0bRo1Sg6OD8ugMKZIvCoWWMeMMygliA= -github.com/containerd/containerd/v2 v2.2.3/go.mod h1:ns24cwt+p36mRnuKE3hLRxVBpuSP+a/Y25AMki1t/RY= -github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4= -github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE= -github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= -github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= -github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= -github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk= -github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY= -github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o= -github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= -github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo= -github.com/containerd/nydus-snapshotter v0.15.13 h1:z9yCiTPMxVBIZlHxOPinZXhly2MdcIqxk9VXPlHIOJY= -github.com/containerd/nydus-snapshotter v0.15.13/go.mod h1:t95dwCb4I0RE4n1iOk0sJCWosNoACA8daOXmU5A2VHI= -github.com/containerd/platforms v1.0.0-rc.4 h1:M42JrUT4zfZTqtkUwkr0GzmUWbfyO5VO0Q5b3op97T4= -github.com/containerd/platforms v1.0.0-rc.4/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A= -github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y= -github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47bQ+KexvO8= github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= -github.com/containerd/ttrpc v1.2.8 h1:xbVu6D4qF2jihdh9rDVOKqUMiFBQk6YctTdo1zk087Y= -github.com/containerd/ttrpc v1.2.8/go.mod h1:wyZW2K79t4Hfcxl+GUvkZqRBzJlqFFvgEeeWXa42tyE= -github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40= -github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk= -github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= -github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= -github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= -github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= -github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q= -github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw= -github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is= -github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= github.com/dagger/otel-go v1.43.0 h1:AYCnAamWmxtSxigWPTgC+8EWqiWPcDZEegh8y05gdJ8= github.com/dagger/otel-go v1.43.0/go.mod h1:83CTuXi70zcx1kaym5buqmb7RNzg1E9dEiQSFyLbLdU= github.com/dagger/querybuilder v0.0.0-20260402040506-574a5e81cb59 h1:g6vfdGRyz6fAjfHz5FyYPZgHy8qcQ31fHrBl1iCOzxw= github.com/dagger/querybuilder v0.0.0-20260402040506-574a5e81cb59/go.mod h1:jsdUJeYzcbyK1j/EqMGPrQgNYxl/Zfg06vvM9C/xXxs= -github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ= -github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 h1:5RVFMOWjMyRy8cARdy79nAmgYw3hK/4HUq48LQ6Wwqo= -github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40= -github.com/dgraph-io/badger/v4 v4.9.1 h1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w= -github.com/dgraph-io/badger/v4 v4.9.1/go.mod h1:5/MEx97uzdPUHR4KtkNt8asfI2T4JiEiQlV7kWUo8c0= -github.com/dgraph-io/ristretto/v2 v2.2.0 h1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM= -github.com/dgraph-io/ristretto/v2 v2.2.0/go.mod h1:RZrm63UmcBAaYWC1DotLYBmTvgkrs0+XhBd7Npn7/zI= -github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo= -github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA= -github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc= -github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c h1:g349iS+CtAvba7i0Ee9EP1TlTZ9w+UncBY6HSmsFZa0= -github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c/go.mod h1:mCGGmWkOQvEuLdIRfPIpXViBfpWto4AhwtJlAvo62SQ= -github.com/digitorus/timestamp v0.0.0-20250524132541-c45532741eea h1:ALRwvjsSP53QmnN3Bcj0NpR8SsFLnskny/EIMebAk1c= -github.com/digitorus/timestamp v0.0.0-20250524132541-c45532741eea/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y= -github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= -github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI= -github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= -github.com/docker/buildx v0.33.0 h1:xuZeuQe/C/2tvLDgiIA6+Ynq3FFWSfsGNWIHM3q1hD8= -github.com/docker/buildx v0.33.0/go.mod h1:7JVma62htERKE5iy5YD1q64PKiAHUzXuhSBd4oq3I74= github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM= github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= -github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= -github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM= -github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.9.6 h1:cT2PbRPSlnMmNTfT2TDMXRyQ1KMWHG7xoTLBcn1ZNv0= github.com/docker/docker-credential-helpers v0.9.6/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= -github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c= -github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q= -github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8= -github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw= -github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= -github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= -github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= -github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= -github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= -github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw= -github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g= -github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0= -github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk= -github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw= -github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0= -github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug= -github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0= -github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= -github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-openapi/analysis v0.25.0 h1:EnjAq1yO8wEO9HbPmY8vLPEIkdZuuFhCAKBPvCB7bCs= -github.com/go-openapi/analysis v0.25.0/go.mod h1:5WFTRE43WLkPG9r9OtlMfqkkvUTYLVVCIxLlEpyF8kE= -github.com/go-openapi/errors v0.22.7 h1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA= -github.com/go-openapi/errors v0.22.7/go.mod h1://QW6SD9OsWtH6gHllUCddOXDL0tk0ZGNYHwsw4sW3w= -github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4= -github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY= -github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE= -github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw= -github.com/go-openapi/loads v0.23.3 h1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ= -github.com/go-openapi/loads v0.23.3/go.mod h1:NOH07zLajXo8y55hom0omlHWDVVvCwBM/S+csCK8LqA= -github.com/go-openapi/runtime v0.29.4 h1:k2lDxrGoSAJRdhFG2tONKMpkizY/4X1cciSdtzk4Jjo= -github.com/go-openapi/runtime v0.29.4/go.mod h1:K0k/2raY6oqXJnZAgWJB2i/12QKrhUKpZcH4PfV9P18= -github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ= -github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ= -github.com/go-openapi/strfmt v0.26.1 h1:7zGCHji7zSYDC2tCXIusoxYQz/48jAf2q+sF6wXTG+c= -github.com/go-openapi/strfmt v0.26.1/go.mod h1:Zslk5VZPOISLwmWTMBIS7oiVFem1o1EI6zULY8Uer7Y= -github.com/go-openapi/swag v0.26.0 h1:GVDXCmfvhfu1BxiHo8/FA+BbKmhecHnG3varjON5/RI= -github.com/go-openapi/swag v0.26.0/go.mod h1:82g3193sZJRbocs7bNCqGfIgq8pkuwVwCfhKIRlEQF0= -github.com/go-openapi/swag/cmdutils v0.26.0 h1:iowihOcvq7y4egO8cOq0dmfohz6wfeQ63U1EnuhO2TU= -github.com/go-openapi/swag/cmdutils v0.26.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= -github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I= -github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE= -github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU= -github.com/go-openapi/swag/fileutils v0.26.0/go.mod h1:0WDJ7lp67eNjPMO50wAWYlKvhOb6CQ37rzR7wrgI8Tc= -github.com/go-openapi/swag/jsonname v0.26.0 h1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w= -github.com/go-openapi/swag/jsonname v0.26.0/go.mod h1:urBBR8bZNoDYGr653ynhIx+gTeIz0ARZxHkAPktJK2M= -github.com/go-openapi/swag/jsonutils v0.26.0 h1:FawFML2iAXsPqmERscuMPIHmFsoP1tOqWkxBaKNMsnA= -github.com/go-openapi/swag/jsonutils v0.26.0/go.mod h1:2VmA0CJlyFqgawOaPI9psnjFDqzyivIqLYN34t9p91E= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0 h1:apqeINu/ICHouqiRZbyFvuDge5jCmmLTqGQ9V95EaOM= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0/go.mod h1:AyM6QT8uz5IdKxk5akv0y6u4QvcL9GWERt0Jx/F/R8Y= -github.com/go-openapi/swag/loading v0.26.0 h1:Apg6zaKhCJurpJer0DCxq99qwmhFddBhaMX7kilDcko= -github.com/go-openapi/swag/loading v0.26.0/go.mod h1:dBxQ/6V2uBaAQdevN18VELE6xSpJWZxLX4txe12JwDg= -github.com/go-openapi/swag/mangling v0.26.0 h1:Du2YC4YLA/Y5m/YKQd7AnY5qq0wRKSFZTTt8ktFaXcQ= -github.com/go-openapi/swag/mangling v0.26.0/go.mod h1:jifS7W9vbg+pw63bT+GI53otluMQL3CeemuyCHKwVx0= -github.com/go-openapi/swag/netutils v0.26.0 h1:CmZp+ZT7HrmFwrC3GdGsXBq2+42T1bjKBapcqVpIs3c= -github.com/go-openapi/swag/netutils v0.26.0/go.mod h1:5iK+Ok3ZohWWex1C50BFTPexi03UaPwjW4Oj8kgrpwo= -github.com/go-openapi/swag/stringutils v0.26.0 h1:qZQngLxs5s7SLijc3N2ZO+fUq2o8LjuWAASSrJuh+xg= -github.com/go-openapi/swag/stringutils v0.26.0/go.mod h1:sWn5uY+QIIspwPhvgnqJsH8xqFT2ZbYcvbcFanRyhFE= -github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFuuyQIKYybfq4= -github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE= -github.com/go-openapi/swag/yamlutils v0.26.0 h1:H7O8l/8NJJQ/oiReEN+oMpnGMyt8G0hl460nRZxhLMQ= -github.com/go-openapi/swag/yamlutils v0.26.0/go.mod h1:1evKEGAtP37Pkwcc7EWMF0hedX0/x3Rkvei2wtG/TbU= -github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0= -github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE= -github.com/go-openapi/testify/v2 v2.4.2 h1:tiByHpvE9uHrrKjOszax7ZvKB7QOgizBWGBLuq0ePx4= -github.com/go-openapi/testify/v2 v2.4.2/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= -github.com/go-openapi/validate v0.25.2 h1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0= -github.com/go-openapi/validate v0.25.2/go.mod h1:Pgl1LpPPGFnZ+ys4/hTlDiRYQdI1ocKypgE+8Q8BLfY= -github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo= -github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU= github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U= github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= -github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= -github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= -github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= -github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= -github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU= -github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M= -github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= -github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= -github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw= -github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0= -github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= -github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo= -github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= -github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= -github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= -github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs= -github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= -github.com/google/certificate-transparency-go v1.3.3 h1:hq/rSxztSkXN2tx/3jQqF6Xc0O565UQPdHrOWvZwybo= -github.com/google/certificate-transparency-go v1.3.3/go.mod h1:iR17ZgSaXRzSa5qvjFl8TnVD5h8ky2JMVio+dzoKMgA= -github.com/google/flatbuffers v25.2.10+incompatible h1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H/pNX4FP1v0Q= -github.com/google/flatbuffers v25.2.10+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM= github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU= -github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= -github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= -github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= -github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= -github.com/google/trillian v1.7.2 h1:EPBxc4YWY4Ak8tcuhyFleY+zYlbCDCa4Sn24e1Ka8Js= -github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81zxNQw05s= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8= -github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg= -github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE= -github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA= -github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= -github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= -github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI= -github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8= github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= -github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= -github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= -github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= -github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= -github.com/hashicorp/go-cty-funcs v0.1.0 h1:TRO/6x1unvTPpotTgrTU7qlcbd99JBLt+vmF6dMF6lY= -github.com/hashicorp/go-cty-funcs v0.1.0/go.mod h1:crc3afXAsjGOJ+12LNX8PImH+ejyxOjnjvsUteKcFIw= -github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= -github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= -github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48= -github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw= -github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc= -github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8= -github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM= -github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0= -github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts= -github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4= -github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw= -github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw= -github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= -github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= -github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I= -github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM= github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE= github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM= -github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0= -github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM= -github.com/hiddeco/sshsig v0.2.0 h1:gMWllgKCITXdydVkDL+Zro0PU96QI55LwUwebSwNTSw= -github.com/hiddeco/sshsig v0.2.0/go.mod h1:nJc98aGgiH6Yql2doqH4CTBVHexQA40Q+hMMLHP4EqE= -github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM= -github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs= -github.com/in-toto/attestation v1.2.0 h1:aPRUZ3azbqD7yEBD5fP3TD8Dszf+YHo284SOcpahjQk= -github.com/in-toto/attestation v1.2.0/go.mod h1:r79G45gOmzPismgObLSL+rZTFxUgZLOQJI6LofTZgXk= -github.com/in-toto/in-toto-golang v0.10.0 h1:+s2eZQSK3WmWfYV85qXVSBfqgawi/5L02MaqA4o/tpM= -github.com/in-toto/in-toto-golang v0.10.0/go.mod h1:wjT4RiyFlLWCmLUJjwB8oZcjaq7HA390aMJcD3xXgmg= -github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= -github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= -github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= -github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= -github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo= -github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw= -github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= -github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= -github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b h1:ZGiXF8sz7PDk6RgkP+A/SFfUD0ZR/AgG6SpRNEDKZy8= -github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b/go.mod h1:hQmNrgofl+IY/8L+n20H6E6PWBBTokdsv+q49j0QhsU= -github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY= -github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4= -github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY= -github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo= -github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= -github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= -github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= -github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA= -github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= -github.com/lestrrat-go/dsig v1.3.0 h1:phjMOCXvYzhuIgn7Voe2rex8z166vGfxRxmqM25P9/Q= -github.com/lestrrat-go/dsig v1.3.0/go.mod h1:RD2eOaidyPvpc7IJQoO3Qq52RWdy8ZcJs8lrOnoa1Kc= -github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7gcrVVMFPOzY= -github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU= -github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE= -github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E= -github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM= -github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0= -github.com/lestrrat-go/jwx/v3 v3.1.0 h1:AyyLtxc0QM75F75JroWgt1phwC7X+wOb3XKhH7XBZWw= -github.com/lestrrat-go/jwx/v3 v3.1.0/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU= -github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss= -github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg= -github.com/letsencrypt/boulder v0.20260223.0 h1:xdS2OnJNUasR6TgVIOpqqcvdkOu47+PQQMBk9ThuWBw= -github.com/letsencrypt/boulder v0.20260223.0/go.mod h1:r3aTSA7UZ7dbDfiGK+HLHJz0bWNbHk6YSPiXgzl23sA= -github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw= -github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= -github.com/mattn/go-shellwords v1.0.13 h1:DC0OMEpGjm6LfNFU4ckYcvbQKyp2vE8atyFGXNtDcf4= -github.com/mattn/go-shellwords v1.0.13/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= -github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM= -github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk= github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0= -github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4= -github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE= -github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= -github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= -github.com/moby/buildkit v0.29.0 h1:wxLEFbCOJntEDjSNNN2YWd8zxltZxT5muDQ0LzpbtpU= -github.com/moby/buildkit v0.29.0/go.mod h1:Dmv2FeDe34t75QuzeU87rBoZpAAkcpT5zeu4hXzmASc= -github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= -github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= -github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg= -github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc= -github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4= -github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= -github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw= -github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g= -github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U= -github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= -github.com/moby/policy-helpers v0.0.0-20260324161837-b7c0b994300b h1:lvBBM2ACrsG5/O1G1caEwlh0XeqA89IQK3xq0Sh/5NI= -github.com/moby/policy-helpers v0.0.0-20260324161837-b7c0b994300b/go.mod h1:Cbc1brDwYl1K294MmZB+6WhQR9Tr24hfhgSGND4UlL0= -github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= -github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs= -github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg= -github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4= -github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= -github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= -github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0= -github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8= -github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= -github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= -github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g= -github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28= -github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= -github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= -github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ= -github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw= -github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= -github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/natefinch/atomic v1.0.1 h1:ZPYKxkqQOx3KZ+RsbnP/YsgvxWQPGxjC0oBt2AhwV0A= -github.com/natefinch/atomic v1.0.1/go.mod h1:N/D/ELrljoqDyT3rZrsUmtsuzvHkeB/wWjHV22AZRbM= -github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s= -github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ= -github.com/open-policy-agent/opa v1.15.2 h1:dS9q+0Yvruq/VNvWJc5qCvCchn715OWc3HLHXn/UCCc= -github.com/open-policy-agent/opa v1.15.2/go.mod h1:c6SN+7jSsUcKJLQc5P4yhwx8YYDRbjpAiGkBOTqxaa4= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= -github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg= -github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= -github.com/opencontainers/selinux v1.13.1 h1:A8nNeceYngH9Ow++M+VVEwJVpdFmrlxsN22F+ISDCJE= -github.com/opencontainers/selinux v1.13.1/go.mod h1:S10WXZ/osk2kWOYKy1x2f/eXF5ZHJoUs8UU/2caNRbg= -github.com/package-url/packageurl-go v0.1.5 h1:O4efRXja2XQ5CtiiYiCZ22k/m7i5ugLiAghgcC+eDgk= -github.com/package-url/packageurl-go v0.1.5/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= -github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o= -github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM= -github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= -github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= -github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= -github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= -github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= -github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= -github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= -github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= -github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= -github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= -github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= -github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= -github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg= -github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= -github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= -github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= -github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= -github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A= -github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk= -github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4= -github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k= -github.com/secure-systems-lab/go-securesystemslib v0.10.0 h1:l+H5ErcW0PAehBNrBxoGv1jjNpGYdZ9RcheFkB2WI14= -github.com/secure-systems-lab/go-securesystemslib v0.10.0/go.mod h1:MRKONWmRoFzPNQ9USRF9i1mc7MvAVvF1LlW8X5VWDvk= -github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0= -github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= -github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI= -github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE= -github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U= -github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats= -github.com/sigstore/rekor v1.5.1 h1:Ca1egHRWRuDvXV4tZu9aXEXc3Gej9FG+HKeapV9OAMQ= -github.com/sigstore/rekor v1.5.1/go.mod h1:gTLDuZuo3SyQCuZvKqwRPA79Qo/2rw39/WtLP/rZjUQ= -github.com/sigstore/rekor-tiles/v2 v2.2.1 h1:UmV1CBQ3SjxxPGpFmwDoOhoIwiKpM2Qm1pU5tPGmvNk= -github.com/sigstore/rekor-tiles/v2 v2.2.1/go.mod h1:z8n6l6oidpaLjjE6rJERuQqY9X38ulnHZCXyL+DEL7U= -github.com/sigstore/sigstore v1.10.5 h1:KqrOjDhNOVY+uOzQFat2FrGLClPPCb3uz8pK3wuI+ow= -github.com/sigstore/sigstore v1.10.5/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs= -github.com/sigstore/sigstore-go v1.1.4 h1:wTTsgCHOfqiEzVyBYA6mDczGtBkN7cM8mPpjJj5QvMg= -github.com/sigstore/sigstore-go v1.1.4/go.mod h1:2U/mQOT9cjjxrtIUeKDVhL+sHBKsnWddn8URlswdBsg= -github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5 h1:aqHRubTITULckG9JAcq2FEhtKkT/RRE8oErfuV3smSI= -github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5/go.mod h1:h9eK9QyPqpFskF/ewFkRLtwh4/Q3FLc2/DXbym4IHN8= -github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5 h1:+9C6CUkv+J4iT67Lx+H1EGBfAdoAHqXumHadeIj9jA4= -github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5/go.mod h1:myZsg7wRiy/vf102g5uUAitYhtXCwepmAGxgHG1VHuE= -github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5 h1:BpQx6AhjwIN9LmlO4ypkcMcHiWiepgZQGSw5U69frHU= -github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5/go.mod h1:ejMD/17lMJ4HykQRPdj5NNr+OQYIEZto8HjDKghVMOA= -github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5 h1:OFwQZgWkB/6J6W5sy3SkXE4pJnhNRnE2cJd8ySXmHpo= -github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5/go.mod h1:Ee/enmyxi/RFLVlajbnjgH2wOWQwlJ0wY8qZrk43hEw= -github.com/sigstore/timestamp-authority/v2 v2.0.6 h1:1Vh7/SdmLsVLG6Br6/bisd1SnlicfDm0MJYiA+D7Ppw= -github.com/sigstore/timestamp-authority/v2 v2.0.6/go.mod h1:Nk5ucGBDyH0tXAIMZ0prf6xn8qfTnbJhSq+CDabYcfc= github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g= github.com/sosodev/duration v1.4.0 h1:35ed0KiVFriGHHzZZJaZLgmTEEICIyt8Sx0RQfj9IjE= github.com/sosodev/duration v1.4.0/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg= -github.com/spdx/tools-golang v0.5.7 h1:+sWcKGnhwp3vLdMqPcLdA6QK679vd86cK9hQWH3AwCg= -github.com/spdx/tools-golang v0.5.7/go.mod h1:jg7w0LOpoNAw6OxKEzCoqPC2GCTj45LyTlVmXubDsYw= -github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= -github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= -github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc= -github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k= -github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI= -github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug= -github.com/theupdateframework/go-tuf/v2 v2.4.1 h1:K6ewW064rKZCPkRo1W/CTbTtm/+IB4+coG1iNURAGCw= -github.com/theupdateframework/go-tuf/v2 v2.4.1/go.mod h1:Nex2enPVYDFCklrnbTzl3OVwD7fgIAj0J5++z/rvCj8= -github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI= -github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis= -github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0= -github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0/go.mod h1:jY5YN2BqD/KSCHM9SqZPIpJNG/u3zwfLXHgws4x2IRw= -github.com/tink-crypto/tink-go-hcvault/v2 v2.4.0 h1:j+S+WKBQ5ya26A5EM/uXoVe+a2IaPQN8KgBJZ22cJ+4= -github.com/tink-crypto/tink-go-hcvault/v2 v2.4.0/go.mod h1:OCKJIujnTzDq7f+73NhVs99oA2c1TR6nsOpuasYM6Yo= -github.com/tink-crypto/tink-go/v2 v2.6.0 h1:+KHNBHhWH33Vn+igZWcsgdEPUxKwBMEe0QC60t388v4= -github.com/tink-crypto/tink-go/v2 v2.6.0/go.mod h1:2WbBA6pfNsAfBwDCggboaHeB2X29wkU8XHtGwh2YIk8= -github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0= -github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs= -github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK56l8WPequOaR3i9LBqfPtEdXIQbUTzT55iqT4= -github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY= -github.com/tonistiigi/fsutil v0.0.0-20251211185533-a2aa163d723f h1:Z4NEQ86qFl1mHuCu9gwcE+EYCwDKfXAYXZbdIXyxmEA= -github.com/tonistiigi/fsutil v0.0.0-20251211185533-a2aa163d723f/go.mod h1:BKdcez7BiVtBvIcef90ZPc6ebqIWr4JWD7+EvLm6J98= -github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 h1:2f304B10LaZdB8kkVEaoXvAMVan2tl9AiK4G0odjQtE= -github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0/go.mod h1:278M4p8WsNh3n4a1eqiFcV2FGk7wE5fwUpUom9mK9lE= -github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0= -github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk= -github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab h1:H6aJ0yKQ0gF49Qb2z5hI1UHxSQt4JMyxebFR15KnApw= -github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab/go.mod h1:ulncasL3N9uLrVann0m+CDlJKWsIAP34MPcOJF6VRvc= -github.com/transparency-dev/formats v0.1.0 h1:oL0zUFuYUjg8AbtjPMnIRDmjbaHo5jCjEWU5yaNuz0g= -github.com/transparency-dev/formats v0.1.0/go.mod h1:d2FibUOHfCMdCe/+/rbKt1IPLBbPTDfwj46kt541/mU= -github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4= -github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A= -github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4= -github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE= github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= github.com/vektah/gqlparser/v2 v2.5.32 h1:k9QPJd4sEDTL+qB4ncPLflqTJ3MmjB9SrVzJrawpFSc= github.com/vektah/gqlparser/v2 v2.5.32/go.mod h1:c1I28gSOVNzlfc4WuDlqU7voQnsqI6OG2amkBAFmgts= -github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= -github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= -github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0= -github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= -github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc= -github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU= -github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg= -github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok= -github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms= -github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk= github.com/zclconf/go-cty v1.18.1 h1:yEGE8M4iIZlyKQURZNb2SnEyZlZHUcBCnx6KF81KuwM= github.com/zclconf/go-cty v1.18.1/go.mod h1:qpnV6EDNgC1sns/AleL1fvatHw72j+S+nS+MJ+T2CSg= github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo= github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM= -go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= -go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg= -go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 h1:cuXaPAfIoJKsYjBjPSb2nKZEmgM43zVr25l37IxhKME= -go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0/go.mod h1:BuzhPofpCzlDi/Q/Xjg54M4/3oWqqyDe2Zeq7A2I0QE= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo= go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0 h1:ZVg+kCXxd9LtAaQNKBxAvJ5NpMf7LpvEr4MIZqb0TMQ= @@ -623,73 +121,24 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= -go.step.sm/crypto v0.77.2 h1:qFjjei+RHc5kP5R7NW9OUWT7SqWIuAOvOkXqg4fNWj8= -go.step.sm/crypto v0.77.2/go.mod h1:W0YJb9onM5l78qgkXIJ2Up6grnwW8EtpCKIza/NCg0o= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= -go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= -go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc= -go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= -go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= -go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U= -go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= -golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= -golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA= -google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA= -google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE= -google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw= google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec= google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc= google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= @@ -699,18 +148,12 @@ google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= -gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= -k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= -k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= -pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk= -pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= -sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= -sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= -software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k= -software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI= diff --git a/dagger/maintenance/main.go b/dagger/maintenance/main.go index 0ca1b8b7..d9478d73 100644 --- a/dagger/maintenance/main.go +++ b/dagger/maintenance/main.go @@ -72,20 +72,18 @@ func (m *Maintenance) UpdateOSLibs( return nil, err } - files := make([]*dagger.File, 0, len(matrix.Distributions)*len(matrix.MajorVersions)) - for _, distribution := range matrix.Distributions { - for _, majorVersion := range matrix.MajorVersions { - file, err := updateOSLibsOnTarget( - ctx, - extension, - distribution, - majorVersion, - ) - if err != nil { - return source, err - } - files = append(files, file) + files := make([]*dagger.File, 0, len(matrix.Combinations)) + for _, combo := range matrix.Combinations { + file, err := updateOSLibsOnTarget( + ctx, + extension, + combo.Distribution, + combo.MajorVersion, + ) + if err != nil { + return source, err } + files = append(files, file) } source = source.WithFiles(targetDir, files) } @@ -487,8 +485,19 @@ func (m *Maintenance) GenerateCatalogs( if len(targetExtensions) == 0 { return nil, fmt.Errorf("no extensions found in source directory") } + if len(catalogs) == 0 { + return nil, fmt.Errorf("no catalogs matched the selection criteria") + } + + metadataByDir := make(map[string]*extensionMetadata, len(targetExtensions)) + for dir, extension := range targetExtensions { + metadata, err := parseExtensionMetadata(ctx, source.Directory(dir)) + if err != nil { + return nil, fmt.Errorf("while parsing extension %s metadata: %w", extension, err) + } + metadataByDir[dir] = metadata + } - catalogWritten := false for _, catalog := range catalogs { catalogOS, ok := catalog.Metadata.Labels[LabelImageOS] if !ok { @@ -496,22 +505,15 @@ func (m *Maintenance) GenerateCatalogs( } for dir, extension := range targetExtensions { - matrix, err := parseBuildMatrix(ctx, source, dir) - if err != nil { - return nil, fmt.Errorf("while parsing build Matrix for extension %s: %w", extension, err) - } - if !slices.Contains(matrix.Distributions, catalogOS) { + metadata := metadataByDir[dir] + matrix := buildMatrixFromMetadata(metadata) + if !matrix.hasDistribution(catalogOS) { continue } - metadata, err := parseExtensionMetadata(ctx, source.Directory(dir)) - if err != nil { - return nil, fmt.Errorf("while parsing extension %s metadata: %w", extension, err) - } - for i := range catalog.Spec.Images { img := &catalog.Spec.Images[i] - if !slices.Contains(matrix.MajorVersions, strconv.Itoa(img.Major)) { + if !matrix.contains(catalogOS, strconv.Itoa(img.Major)) { continue } @@ -545,11 +547,6 @@ func (m *Maintenance) GenerateCatalogs( if err != nil { return nil, fmt.Errorf("while writing catalog %s: %w", catalog.Metadata.Name, err) } - catalogWritten = true - } - - if !catalogWritten { - return nil, fmt.Errorf("no catalogs matched the selection criteria") } return outDir, nil diff --git a/dagger/maintenance/parse.go b/dagger/maintenance/parse.go index 12e833d6..edf7b8bb 100644 --- a/dagger/maintenance/parse.go +++ b/dagger/maintenance/parse.go @@ -1,21 +1,42 @@ package main import ( + "cmp" "context" - "encoding/json" "fmt" - "path" + "slices" - "github.com/docker/buildx/bake" "github.com/hashicorp/hcl/v2" "github.com/hashicorp/hcl/v2/hclsimple" "dagger/maintenance/internal/dagger" ) +// buildMatrix is the set of distribution/PG-major combinations to build. +// It holds explicit pairs (rather than two independent lists), so each distribution +// can declare its own set of PG majors. type buildMatrix struct { - Distributions []string - MajorVersions []string + Combinations []buildCombo +} + +// buildCombo is a single distribution + PG major combination to build. +type buildCombo struct { + Distribution string + MajorVersion string +} + +// hasDistribution reports if given a distribution is present in a buildMatrix. +func (m *buildMatrix) hasDistribution(distribution string) bool { + return slices.ContainsFunc(m.Combinations, func(combo buildCombo) bool { + return combo.Distribution == distribution + }) +} + +// contains reports if a given distribution/major pair is present in a buildMatrix. +func (m *buildMatrix) contains(distribution, majorVersion string) bool { + return slices.ContainsFunc(m.Combinations, func(combo buildCombo) bool { + return combo.Distribution == distribution && combo.MajorVersion == majorVersion + }) } type extensionVersion struct { @@ -43,56 +64,43 @@ type extensionMetadata struct { } const ( - bakeFileName = "docker-bake.hcl" metadataFile = "metadata.hcl" ) +// parseBuildMatrix derives the build matrix for a target extension by reading +// its metadata.hcl from the source directory. func parseBuildMatrix(ctx context.Context, source *dagger.Directory, target string) (*buildMatrix, error) { - bakeData, err := source.File(bakeFileName).Contents(ctx) - if err != nil { - return nil, err - } - metadata, err := source.File(path.Join(target, metadataFile)).Contents(ctx) - if err != nil { - return nil, err - } - _, p, err := bake.ParseFiles([]bake.File{ - { - Name: bakeFileName, - Data: []byte(bakeData), - }, - { - Name: metadataFile, - Data: []byte(metadata), - }, - }, nil, nil) + metadata, err := parseExtensionMetadata(ctx, source.Directory(target)) if err != nil { return nil, err } + return buildMatrixFromMetadata(metadata), nil +} + +// buildMatrixFromMetadata derives the build matrix (distributions and PG majors) +// directly from the keys of the metadata.versions map, mirroring how the +// docker-bake.hcl matrix is computed. +func buildMatrixFromMetadata(metadata *extensionMetadata) *buildMatrix { var matrix buildMatrix - for _, variable := range p.AllVariables { - switch variable.Name { - case "distributions": - if variable.Value != nil { - var arr []string - if err := json.Unmarshal([]byte(*variable.Value), &arr); err != nil { - return nil, err - } - matrix.Distributions = arr - } - case "pgVersions": - if variable.Value != nil { - var arr []string - if err := json.Unmarshal([]byte(*variable.Value), &arr); err != nil { - return nil, err - } - matrix.MajorVersions = arr - } + for distribution, versionsByMajor := range metadata.Versions { + for majorVersion := range versionsByMajor { + matrix.Combinations = append(matrix.Combinations, buildCombo{ + Distribution: distribution, + MajorVersion: majorVersion, + }) } } - return &matrix, nil + // Sort for deterministic ordering, since map iteration order is random. + slices.SortFunc(matrix.Combinations, func(a, b buildCombo) int { + if c := cmp.Compare(a.Distribution, b.Distribution); c != 0 { + return c + } + return cmp.Compare(a.MajorVersion, b.MajorVersion) + }) + + return &matrix } func parseExtensionMetadata(ctx context.Context, extensionDirectory *dagger.Directory) (*extensionMetadata, error) { diff --git a/dagger/maintenance/parse_test.go b/dagger/maintenance/parse_test.go new file mode 100644 index 00000000..3604c9bb --- /dev/null +++ b/dagger/maintenance/parse_test.go @@ -0,0 +1,100 @@ +package main + +import ( + "slices" + "testing" +) + +func TestBuildMatrixFromMetadata(t *testing.T) { + tests := []struct { + name string + versions versionMap + want []buildCombo + }{ + { + name: "two distros, one major", + versions: versionMap{ + "trixie": {"18": {Package: "x"}}, + "bookworm": {"18": {Package: "x"}}, + }, + want: []buildCombo{ + {Distribution: "bookworm", MajorVersion: "18"}, + {Distribution: "trixie", MajorVersion: "18"}, + }, + }, + { + name: "single distro", + versions: versionMap{ + "trixie": {"18": {Package: "x"}}, + }, + want: []buildCombo{ + {Distribution: "trixie", MajorVersion: "18"}, + }, + }, + { + // Each distribution declares its own set of PG majors: + // bookworm builds 17 and 18, trixie builds only 18. + // There must be no trixie/17 combo. + name: "each distro declares its own majors", + versions: versionMap{ + "bookworm": {"17": {Package: "x"}, "18": {Package: "x"}}, + "trixie": {"18": {Package: "x"}}, + }, + want: []buildCombo{ + {Distribution: "bookworm", MajorVersion: "17"}, + {Distribution: "bookworm", MajorVersion: "18"}, + {Distribution: "trixie", MajorVersion: "18"}, + }, + }, + { + name: "empty versions", + versions: versionMap{}, + want: nil, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + matrix := buildMatrixFromMetadata(&extensionMetadata{Versions: tt.versions}) + + if !slices.Equal(matrix.Combinations, tt.want) { + t.Errorf("Combinations: got %v, want %v", matrix.Combinations, tt.want) + } + }) + } +} + +func TestBuildMatrix(t *testing.T) { + matrix := buildMatrixFromMetadata(&extensionMetadata{Versions: versionMap{ + "bookworm": {"18": {Package: "x"}, "19": {Package: "x"}}, + "trixie": {"18": {Package: "x"}}, + }}) + + t.Run("contains", func(t *testing.T) { + cases := []struct { + distro string + major string + want bool + }{ + {"bookworm", "18", true}, + {"bookworm", "19", true}, + {"trixie", "18", true}, + {"trixie", "19", false}, // trixie does not declare 19 + {"bullseye", "18", false}, // bullseye is not present + } + for _, c := range cases { + if got := matrix.contains(c.distro, c.major); got != c.want { + t.Errorf("contains(%q, %q) = %v, want %v", c.distro, c.major, got, c.want) + } + } + }) + + t.Run("hasDistribution", func(t *testing.T) { + if !matrix.hasDistribution("trixie") { + t.Error("hasDistribution(trixie) = false, want true") + } + if matrix.hasDistribution("bullseye") { + t.Error("hasDistribution(bullseye) = true, want false") + } + }) +} diff --git a/docker-bake.hcl b/docker-bake.hcl index bfe54293..d99d11f5 100644 --- a/docker-bake.hcl +++ b/docker-bake.hcl @@ -15,19 +15,6 @@ variable "revision" { default = "" } -variable "distributions" { - default = [ - "bookworm", - "trixie" - ] -} - -variable "pgVersions" { - default = [ - "18" - ] -} - fullname = ( environment == "testing") ? "${registry}/${metadata.image_name}-testing" : "${registry}/${metadata.image_name}" now = timestamp() authors = "The CloudNativePG Contributors" @@ -35,8 +22,7 @@ url = "https://github.com/cloudnative-pg/postgres-extensions-containers" target "default" { matrix = { - pgVersion = pgVersions - distro = distributions + build = getBuildMatrix() } platforms = [ @@ -46,17 +32,17 @@ target "default" { dockerfile = "Dockerfile" context = "${metadata.name}/" - name = "${metadata.name}-${sanitize(getExtensionVersion(distro, pgVersion))}-${pgVersion}-${distro}" + name = getBuildName(metadata.name, build.distro, build.pgVersion) tags = [ - "${getImageName(fullname)}:${getExtensionVersion(distro, pgVersion)}-${pgVersion}-${distro}", - "${getImageName(fullname)}:${getExtensionVersion(distro, pgVersion)}-${formatdate("YYYYMMDDhhmm", now)}-${pgVersion}-${distro}", + "${getImageName(fullname)}:${getExtensionVersion(build.distro, build.pgVersion)}-${build.pgVersion}-${build.distro}", + "${getImageName(fullname)}:${getExtensionVersion(build.distro, build.pgVersion)}-${formatdate("YYYYMMDDhhmm", now)}-${build.pgVersion}-${build.distro}", ] args = { - PG_MAJOR = "${pgVersion}" - EXT_VERSION = "${getExtensionPackage(distro, pgVersion)}" - BASE = "${getBaseImage(distro, pgVersion)}" + PG_MAJOR = "${build.pgVersion}" + EXT_VERSION = "${getExtensionPackage(build.distro, build.pgVersion)}" + BASE = "${getBaseImage(build.distro, build.pgVersion)}" } output = [ @@ -70,37 +56,37 @@ target "default" { "index,manifest:org.opencontainers.image.created=${now}", "index,manifest:org.opencontainers.image.url=${url}", "index,manifest:org.opencontainers.image.source=${url}", - "index,manifest:org.opencontainers.image.version=${getExtensionVersion(distro, pgVersion)}", + "index,manifest:org.opencontainers.image.version=${getExtensionVersion(build.distro, build.pgVersion)}", "index,manifest:org.opencontainers.image.revision=${revision}", "index,manifest:org.opencontainers.image.vendor=${authors}", - "index,manifest:org.opencontainers.image.title=${metadata.name} ${getExtensionVersion(distro, pgVersion)} ${pgVersion} ${distro}", - "index,manifest:org.opencontainers.image.description=A ${metadata.name} ${getExtensionVersion(distro, pgVersion)} container image for PostgreSQL ${pgVersion} on ${distro}", + "index,manifest:org.opencontainers.image.title=${metadata.name} ${getExtensionVersion(build.distro, build.pgVersion)} ${build.pgVersion} ${build.distro}", + "index,manifest:org.opencontainers.image.description=A ${metadata.name} ${getExtensionVersion(build.distro, build.pgVersion)} container image for PostgreSQL ${build.pgVersion} on ${build.distro}", "index,manifest:org.opencontainers.image.documentation=${url}", "index,manifest:org.opencontainers.image.authors=${authors}", "index,manifest:org.opencontainers.image.licenses=${join(" AND ", metadata.licenses)}", "index,manifest:org.opencontainers.image.base.name=scratch", - "index,manifest:io.cloudnativepg.image.base.name=${getBaseImage(distro, pgVersion)}", - "index,manifest:io.cloudnativepg.image.base.pgmajor=${pgVersion}", - "index,manifest:io.cloudnativepg.image.base.os=${distro}", - "index,manifest:io.cloudnativepg.image.sql.version=${getExtensionSqlVersion(distro, pgVersion)}", + "index,manifest:io.cloudnativepg.image.base.name=${getBaseImage(build.distro, build.pgVersion)}", + "index,manifest:io.cloudnativepg.image.base.pgmajor=${build.pgVersion}", + "index,manifest:io.cloudnativepg.image.base.os=${build.distro}", + "index,manifest:io.cloudnativepg.image.sql.version=${getExtensionSqlVersion(build.distro, build.pgVersion)}", ] labels = { "org.opencontainers.image.created" = "${now}", "org.opencontainers.image.url" = "${url}", "org.opencontainers.image.source" = "${url}", - "org.opencontainers.image.version" = "${getExtensionVersion(distro, pgVersion)}", + "org.opencontainers.image.version" = "${getExtensionVersion(build.distro, build.pgVersion)}", "org.opencontainers.image.revision" = "${revision}", "org.opencontainers.image.vendor" = "${authors}", - "org.opencontainers.image.title" = "${metadata.name} ${getExtensionVersion(distro, pgVersion)} ${pgVersion} ${distro}", - "org.opencontainers.image.description" = "A ${metadata.name} ${getExtensionVersion(distro, pgVersion)} container image for PostgreSQL ${pgVersion} on ${distro}", + "org.opencontainers.image.title" = "${metadata.name} ${getExtensionVersion(build.distro, build.pgVersion)} ${build.pgVersion} ${build.distro}", + "org.opencontainers.image.description" = "A ${metadata.name} ${getExtensionVersion(build.distro, build.pgVersion)} container image for PostgreSQL ${build.pgVersion} on ${build.distro}", "org.opencontainers.image.documentation" = "${url}", "org.opencontainers.image.authors" = "${authors}", "org.opencontainers.image.licenses" = "${join(" AND ", metadata.licenses)}", "org.opencontainers.image.base.name" = "scratch", - "io.cloudnativepg.image.base.name" = "${getBaseImage(distro, pgVersion)}", - "io.cloudnativepg.image.base.pgmajor" = "${pgVersion}", - "io.cloudnativepg.image.base.os" = "${distro}", - "io.cloudnativepg.image.sql.version" = "${getExtensionSqlVersion(distro, pgVersion)}", + "io.cloudnativepg.image.base.name" = "${getBaseImage(build.distro, build.pgVersion)}", + "io.cloudnativepg.image.base.pgmajor" = "${build.pgVersion}", + "io.cloudnativepg.image.base.os" = "${build.distro}", + "io.cloudnativepg.image.sql.version" = "${getExtensionSqlVersion(build.distro, build.pgVersion)}", } } @@ -109,6 +95,27 @@ function getImageName { result = lower(name) } +function getBuildName { + params = [ extName, distro, pgVersion ] + result = format("%s-%s-%s-%s", extName, sanitize(getExtensionVersion(distro, pgVersion)), pgVersion, distro) +} + +// The build matrix is the explicit set of (distro, pgVersion) pairs declared +// in metadata.versions. Using a single flattened dimension (instead of a +// cross-product of two lists) lets each distribution declare its own set of +// PG majors without producing combinations that don't exist. +function getBuildMatrix { + params = [] + result = flatten([ + for distro in keys(metadata.versions) : [ + for pgVersion in keys(metadata.versions[distro]) : { + distro = distro + pgVersion = pgVersion + } + ] + ]) +} + function getExtensionPackage { params = [ distro, pgVersion ] result = metadata.versions[distro][pgVersion]["package"] diff --git a/postgis/metadata.hcl b/postgis/metadata.hcl index 8ea87ac2..49e052ef 100644 --- a/postgis/metadata.hcl +++ b/postgis/metadata.hcl @@ -38,11 +38,12 @@ metadata = { } } +// Re-declare name + matrix (matching docker-bake.hcl) so the matrix-expanded +// targets merge by name and pick up the extra POSTGIS_MAJOR build arg. target "default" { - name = "${metadata.name}-${sanitize(getExtensionVersion(distro, pgVersion))}-${pgVersion}-${distro}" + name = getBuildName(metadata.name, build.distro, build.pgVersion) matrix = { - pgVersion = pgVersions - distro = distributions + build = getBuildMatrix() } args = { From 87b0579722d822442f618d41d7e47da3060fb0be Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 09:55:19 +0200 Subject: [PATCH 28/76] chore(deps): update alpine/psql:18.4 docker digest to 7a47218 (#277) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index 4320d0bb..367dda9a 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 + image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index 7f578175..9cd31930 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 + image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index 9505254b..b64323b6 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 + image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 307f802a..25292d21 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 + image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 command: ['sh', '-c'] args: - | From f47540c10434cb867dde58199ea0d8bf40619ce8 Mon Sep 17 00:00:00 2001 From: Peggie Date: Mon, 13 Jul 2026 10:42:43 +0200 Subject: [PATCH 29/76] chore: update postgis OS libraries (#263) Updating the OS libraries of postgis Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: extension-os-libs-updater --- postgis/system-libs/18-bookworm-os-libs.txt | 14 +++++++------- postgis/system-libs/18-trixie-os-libs.txt | 16 ++++++++-------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/postgis/system-libs/18-bookworm-os-libs.txt b/postgis/system-libs/18-bookworm-os-libs.txt index 4669bd78..c7ebeb6c 100644 --- a/postgis/system-libs/18-bookworm-os-libs.txt +++ b/postgis/system-libs/18-bookworm-os-libs.txt @@ -11,13 +11,13 @@ libsnappy1v5_1.1.9-3_amd64.deb MD5Sum:5867cae0b6dcc8238ac96d31523f2907 libblosc1_1.21.3+ds-1_amd64.deb MD5Sum:7f3b0f7da1e478f24df9069e4bfb9567 libboost-serialization1.74.0_1.74.0+ds1-21_amd64.deb MD5Sum:db154c4708c5a4641abfee7ee4ad3dad libbrotli1_1.0.9-2+b6_amd64.deb MD5Sum:58aff9bd35bab67549bdc84eb7edffcf -libnghttp2-14_1.52.0-1+deb12u3_amd64.deb +libnghttp2-14_1.52.0-1+deb12u3_amd64.deb MD5Sum:d681e56846f2d3d68a237da84943b2d9 libpsl5_0.21.2-1_amd64.deb MD5Sum:37ebfb57fdbf01631629ee9f36c8b478 librtmp1_2.4+20151223.gitfa8646d.1-2+b2_amd64.deb MD5Sum:d757abb668fc1ee0d9488805bfb4371e libssh2-1_1.10.0-3+b1_amd64.deb MD5Sum:14bb6443448b5fc0477e7c76ca9ba4a5 -libcurl3-gnutls_7.88.1-10+deb12u14_amd64.deb MD5Sum:519c5af2270952ce9727d0c70cc87e75 +libcurl3-gnutls_7.88.1-10+deb12u15_amd64.deb MD5Sum:9a1adaaf7357666e817f3aaded74e210 libcfitsio10_4.2.0-3_amd64.deb MD5Sum:c9e785735af14b6a90fc80990a634eb2 -libcurl4_7.88.1-10+deb12u14_amd64.deb MD5Sum:72a0750a6cbd7bf11a832966a933fe13 +libcurl4_7.88.1-10+deb12u15_amd64.deb MD5Sum:31f3ce5464013ac2f6f580533dbeb9fb libdav1d6_1.0.0-2+deb12u1_amd64.deb MD5Sum:e041891f3cff962c8ecd994865318ee3 libde265-0_1.0.11-1+deb12u2_amd64.deb MD5Sum:27c287d4fd4e486eb99514cf973cef67 libdeflate0_1.14-1_amd64.deb MD5Sum:e505f1277c856889aa2b539320e3e154 @@ -36,7 +36,7 @@ libwebp7_1.2.4-0.2+deb12u1_amd64.deb MD5Sum:19f6c9801f036b0615b9bf650c3ee1fa libtiff6_4.5.0-6+deb12u4_amd64.deb MD5Sum:f283ac0d100dc6a749470b06e3908a8a libproj25_9.1.1-1+b1_amd64.deb MD5Sum:c21fd1eb543b730bbb79ef8d0144b3d1 libgeotiff5_1.7.1-2+b1_amd64.deb MD5Sum:31740ac80f3b6d2fe054ae61de84fb29 -libgif7_5.2.1-2.5_amd64.deb MD5Sum:2dc4f441af51115e5f8367d7d6e9b50a +libgif7_5.2.1-2.5+deb12u1_amd64.deb MD5Sum:63cf3dd05c8f28e6ab6559567b2e4ff0 libtirpc-common_1.3.3+ds-1_all.deb MD5Sum:e49aca93814724ed80fa8932a1f7523b libtirpc3_1.3.3+ds-1_amd64.deb MD5Sum:b759d3e9dc474c3404da044249e84d2b libhdf4-0-alt_4.2.15-5_amd64.deb MD5Sum:b4c73847eedba3a520ee217208efe6cc @@ -50,18 +50,18 @@ liburiparser1_0.9.7+dfsg-2_amd64.deb MD5Sum:7cf05c028b38acd81c591e4f6a112f49 libkmlbase1_1.3.0-10_amd64.deb MD5Sum:ade5c0c1c3f065c907046e1bb2a25bab libkmldom1_1.3.0-10_amd64.deb MD5Sum:0a4c395f2daf8f76507e0837a0660984 libkmlengine1_1.3.0-10_amd64.deb MD5Sum:9ae0159850a4bdb2cdaecf4d93b2f295 -libmariadb3_1%3a10.11.14-0+deb12u2_amd64.deb MD5Sum:3df3e924e24c2732f336ebad560f6c81 +libmariadb3_1%3a10.11.18-0+deb12u1_amd64.deb MD5Sum:cf60586fa26c69e7d7f9cc3fac6576a4 libhdf5-hl-100_1.10.8+repack1-1_amd64.deb MD5Sum:16fd3bf27d8e53d8f65f5fe2b4585dbb libnetcdf19_1%3a4.9.0-3+b1_amd64.deb MD5Sum:e73d40a2b2af5352e4451c844229c121 libltdl7_2.4.7-7~deb12u1_amd64.deb MD5Sum:a02756178c3360b03d56768e366357a4 libodbc2_2.3.11-2+deb12u1_amd64.deb MD5Sum:972c6044a881b768dc5c714bc41957b7 libodbcinst2_2.3.11-2+deb12u1_amd64.deb MD5Sum:7c3f95926a167983c8c79137fe6fdb6d libogdi4.1_4.1.0+ds-6_amd64.deb MD5Sum:bca573b90eb2ef8e6fa4c7ab66c77927 -libopenjp2-7_2.5.0-2+deb12u3_amd64.deb +libopenjp2-7_2.5.0-2+deb12u3_amd64.deb MD5Sum:bb7b72ae72a38620bed002a063d5dc64 liblcms2-2_2.14-2+deb12u1_amd64.deb MD5Sum:4a701d009079104e62992b219cee5f6e libnspr4_2%3a4.35-1_amd64.deb MD5Sum:1f8e0fda3f2527e0051768abd071c2fe libnss3_2%3a3.87.1-1+deb12u2_amd64.deb MD5Sum:1e66101d6c420e5999032e3f187282ed -libpoppler126_22.12.0-2+deb12u2_amd64.deb +libpoppler126_22.12.0-2+deb12u2_amd64.deb MD5Sum:23886480fe5be6b0c6fe09059318aba8 libqhull-r8.0_2020.2-5_amd64.deb MD5Sum:781260a36cd4d65a86fc349f26b68338 librttopo1_1.1.0-3_amd64.deb MD5Sum:901bfdc1a4a806d1c9be972018d65368 libspatialite7_5.0.1-3_amd64.deb MD5Sum:fb95bb6433ea0a15f712372b1afcf3b5 diff --git a/postgis/system-libs/18-trixie-os-libs.txt b/postgis/system-libs/18-trixie-os-libs.txt index af65b6ae..a9f316e9 100644 --- a/postgis/system-libs/18-trixie-os-libs.txt +++ b/postgis/system-libs/18-trixie-os-libs.txt @@ -18,16 +18,16 @@ libsnappy1v5_1.2.2-1_amd64.deb MD5Sum:5e2457205f23689a487168e17d9d4b7e libblosc1_1.21.5+ds-1+b2_amd64.deb MD5Sum:6640bac3b9912e70a7fb004338fde1a8 libboost-serialization1.83.0_1.83.0-4.2_amd64.deb MD5Sum:0db3c604d979abcd786c51e623ca413d libbrotli1_1.1.0-2+b7_amd64.deb MD5Sum:e268acc326140ae9f1731f335335fc8d -libnghttp2-14_1.64.0-1.1+deb13u1_amd64.deb +libnghttp2-14_1.64.0-1.1+deb13u1_amd64.deb MD5Sum:3650643a734bbd58529afd0493d181b2 libnghttp3-9_1.8.0-1_amd64.deb MD5Sum:6b1f90e4153530a76878e9fde0244c66 libngtcp2-16_1.11.0-1+deb13u1_amd64.deb MD5Sum:73c7dc70b69796219facc3d77a092303 libngtcp2-crypto-gnutls8_1.11.0-1+deb13u1_amd64.deb MD5Sum:085da7b6511e5afdbbd1b33f59054431 libpsl5t64_0.21.2-1.1+b1_amd64.deb MD5Sum:09aa06d971ce5ff6d02b452c0e1f15f9 librtmp1_2.4+20151223.gitfa8646d.1-2+b5_amd64.deb MD5Sum:355aeaaf937d70dcc873a458f6244c6e -libssh2-1t64_1.11.1-1_amd64.deb MD5Sum:d4b36da8909e226c1829bf9c07aca38c -libcurl3t64-gnutls_8.14.1-2+deb13u3_amd64.deb MD5Sum:a38ebe44d140452a152d58bd41abc74f +libssh2-1t64_1.11.1-1+deb13u1_amd64.deb MD5Sum:ebbc03c2f321467d2e0ea0097c14f7fd +libcurl3t64-gnutls_8.14.1-2+deb13u4_amd64.deb MD5Sum:9afc089158cea4cbc7cf26c951b600bf libcfitsio10t64_4.6.2-2_amd64.deb MD5Sum:856f7ba809c5e389e30d711356d158d9 -libcurl4t64_8.14.1-2+deb13u3_amd64.deb MD5Sum:36254c982f11fa51348be0c7bdddea3a +libcurl4t64_8.14.1-2+deb13u4_amd64.deb MD5Sum:1ce441ba039d03e1f68100922946691b libde265-0_1.0.15-1+b3_amd64.deb MD5Sum:0c323aaaf6ea41343412aa9da949ef36 libdeflate0_1.23-2_amd64.deb MD5Sum:7c4b5c0d85726d2d9475d48d3587c775 libpng16-16t64_1.6.48-1+deb13u5_amd64.deb MD5Sum:0cd2789cb2b8855e0a0798c0c5ffb213 @@ -45,7 +45,7 @@ libwebp7_1.5.0-0.1_amd64.deb MD5Sum:bf682e1e438b4927c3807cad4ca6c1a9 libtiff6_4.7.0-3+deb13u2_amd64.deb MD5Sum:c510dc7c6ddec953c6eed3ba380a6c35 libproj25_9.6.0-1_amd64.deb MD5Sum:cf5a9d654805f47dc18e83f4ef2af4f6 libgeotiff5_1.7.4-1_amd64.deb MD5Sum:cde344178cfd6dd8706a86ba587ec534 -libgif7_5.2.2-1+b1_amd64.deb MD5Sum:35d26913676cf9f5ddf40063629a2ddd +libgif7_5.2.2-1+deb13u1_amd64.deb MD5Sum:b32a7f65ceaed3e3ce40abc20d3c3d2b libsz2_1.1.3-1+b1_amd64.deb MD5Sum:1d27983f2f9ef5efd8b47652603560cd libhdf4-0-alt_4.3.0-1+b1_amd64.deb MD5Sum:d55ae40aad48594e1b02fd87f3c6c061 libhdf5-310_1.14.5+repack-3_amd64.deb MD5Sum:b96e3a5656dcd4452dee459ba4ac10e1 @@ -66,13 +66,13 @@ libodbcinst2_2.3.12-2_amd64.deb MD5Sum:8d70f2bdc4494da9678d6d5b14cef135 libtirpc-common_1.3.6+ds-1_all.deb MD5Sum:d536fb98a02d3d13a7b1a29e3a038131 libtirpc3t64_1.3.6+ds-1_amd64.deb MD5Sum:a53fcff1f56e64fb19db15eb07756ddd libogdi4.1_4.1.1+ds-5_amd64.deb MD5Sum:6c910ba088247ac4bb86c1603f9c5534 -libopenjp2-7_2.5.3-2.1~deb13u2_amd64.deb +libopenjp2-7_2.5.3-2.1~deb13u2_amd64.deb MD5Sum:07e72f2421f5a7f6692e7ca04b879709 libgpgme11t64_1.24.2-3_amd64.deb MD5Sum:0e26d3e34af7581bda9fd6086fd29cc7 libgpgmepp6t64_1.24.2-3_amd64.deb MD5Sum:9b6067de043f9224848364739828216b liblcms2-2_2.16-2+deb13u2_amd64.deb MD5Sum:263113687b91aafa4e934fa16d91291b libnspr4_2%3a4.36-1_amd64.deb MD5Sum:dc825d7a7868119890f38608de1b5e21 -libnss3_2%3a3.110-1+deb13u2_amd64.deb -libpoppler147_25.03.0-5+deb13u3_amd64.deb +libnss3_2%3a3.110-1+deb13u3_amd64.deb MD5Sum:4b63b2494e8e2e644b0c58d2ad409b07 +libpoppler147_25.03.0-5+deb13u4_amd64.deb MD5Sum:85a124f7fd20122d5eb5f2a30a75a051 libqhull-r8.0_2020.2-6+b2_amd64.deb MD5Sum:3b0b21663513226a208f039abea3ad47 librttopo1_1.1.0-4_amd64.deb MD5Sum:b522568252b7ba63b0c4f87300400be9 libspatialite8t64_5.1.0-3+b2_amd64.deb MD5Sum:631307d38ff2755f5955023345b0b05d From 13bce9a75afb3f8888a66682b4813655c16907b1 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 11:10:16 +0200 Subject: [PATCH 30/76] chore(deps): update alpine/kubectl:1.36.2 docker digest to f91cb22 (#276) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 176ab93e..f7c6edec 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.2@sha256:8c1459287ab748db6c8601ca23e91ba43ef20e1dcb83ad61f2e8e162d05fb325 + KUBECTL_VERSION: 1.36.2@sha256:f91cb226fa6f356221c1be464ea2ac7205346a5e35f60e1889867cd881581192 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From e13cc07982abdd88e61954b066b54f4e222f13f4 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 12:41:41 +0200 Subject: [PATCH 31/76] chore(deps): update dependency postgresql-18-pgvector (#278) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pgvector/README.md | 4 ++-- pgvector/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pgvector/README.md b/pgvector/README.md index 20e849ef..93281d80 100644 --- a/pgvector/README.md +++ b/pgvector/README.md @@ -30,7 +30,7 @@ spec: - name: pgvector image: # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - reference: ghcr.io/cloudnative-pg/pgvector:0.8.4-18-trixie + reference: ghcr.io/cloudnative-pg/pgvector:0.8.5-18-trixie ``` ### 2. Enable the extension in a database @@ -51,7 +51,7 @@ spec: extensions: - name: vector # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - version: '0.8.4' + version: '0.8.5' ``` ### 3. Verify installation diff --git a/pgvector/metadata.hcl b/pgvector/metadata.hcl index d80d3532..76c73dae 100644 --- a/pgvector/metadata.hcl +++ b/pgvector/metadata.hcl @@ -18,17 +18,17 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector - package = "0.8.4-1.pgdg12+1" + package = "0.8.5-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.4" + sql = "0.8.5" } } trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - package = "0.8.4-1.pgdg13+1" + package = "0.8.5-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.4" + sql = "0.8.5" } } } From 38d9417a4dfecdaa716735b2e50da229ed3bb928 Mon Sep 17 00:00:00 2001 From: Husn E Rabbi Date: Mon, 13 Jul 2026 17:09:54 +0500 Subject: [PATCH 32/76] feat: add pg_ivm extension (#49) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #59 Signed-off-by: Husn E Rabbi Signed-off-by: Niccolò Fei Signed-off-by: Marco Nenciarini Co-authored-by: Niccolò Fei Co-authored-by: Gabriele Fedi Co-authored-by: Marco Nenciarini --- CODEOWNERS | 3 + README.md | 1 + pg-ivm/Dockerfile | 28 +++++++ pg-ivm/README.md | 100 ++++++++++++++++++++++++ pg-ivm/metadata.hcl | 37 +++++++++ pg-ivm/test/chainsaw-test.yaml | 28 +++++++ pg-ivm/test/check-extension-assert.yaml | 6 ++ pg-ivm/test/check-extension.yaml | 34 ++++++++ pg-ivm/test/cluster-assert.yaml | 8 ++ pg-ivm/test/cluster.yaml | 15 ++++ pg-ivm/test/database-assert.yaml | 5 ++ pg-ivm/test/database.yaml | 10 +++ 12 files changed, 275 insertions(+) create mode 100644 pg-ivm/Dockerfile create mode 100644 pg-ivm/README.md create mode 100644 pg-ivm/metadata.hcl create mode 100644 pg-ivm/test/chainsaw-test.yaml create mode 100644 pg-ivm/test/check-extension-assert.yaml create mode 100644 pg-ivm/test/check-extension.yaml create mode 100644 pg-ivm/test/cluster-assert.yaml create mode 100644 pg-ivm/test/cluster.yaml create mode 100644 pg-ivm/test/database-assert.yaml create mode 100644 pg-ivm/test/database.yaml diff --git a/CODEOWNERS b/CODEOWNERS index 82a1a8a4..8ed922e4 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -9,3 +9,6 @@ # wal2json /wal2json/ @cloudnative-pg/maintainers @NiccoloFei @solidDoWant + +# pg-ivm +/pg-ivm/ @shusaan @cloudnative-pg/maintainers @NiccoloFei diff --git a/README.md b/README.md index 7be75e4b..9d47142f 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ from a trusted, auditable repository | :--- | :--- | :--- | :--- | | **[pgAudit](pgaudit)** | PostgreSQL audit extension | [github.com/pgaudit/pgaudit](https://github.com/pgaudit/pgaudit) | CNPG maintainers | | **[pg_crash](pg-crash)** | **Disruptive** fault injection and chaos engineering extension | [github.com/cybertec-postgresql/pg_crash](https://github.com/cybertec-postgresql/pg_crash) | CNPG maintainers | +| **[pg_ivm](pg-ivm)** | Incremental View Maintenance for PostgreSQL | [github.com/sraoss/pg_ivm](https://github.com/sraoss/pg_ivm) | @shusaan | | **[pgvector](pgvector)** | Vector similarity search for PostgreSQL | [github.com/pgvector/pgvector](https://github.com/pgvector/pgvector) | CNPG maintainers | | **[PostGIS](postgis)** | Geospatial database extension for PostgreSQL | [postgis.net/](https://postgis.net/) | CNPG maintainers | | **[TimescaleDB Apache-2 Edition](timescaledb-oss)** | Time-series database for PostgreSQL (open source version) | [github.com/timescale/timescaledb/](https://github.com/timescale/timescaledb/) | @shusaan | diff --git a/pg-ivm/Dockerfile b/pg-ivm/Dockerfile new file mode 100644 index 00000000..8b41d204 --- /dev/null +++ b/pg-ivm/Dockerfile @@ -0,0 +1,28 @@ +# SPDX-FileCopyrightText: Copyright © contributors to CloudNativePG, established as CloudNativePG a Series of LF Projects, LLC. +# SPDX-License-Identifier: Apache-2.0 + +ARG BASE=ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie +FROM $BASE AS builder + +ARG PG_MAJOR +ARG EXT_VERSION + +USER 0 + +RUN apt-get update && \ + apt-get install -y --no-install-recommends "postgresql-${PG_MAJOR}-pg-ivm=${EXT_VERSION}" + +FROM scratch +ARG PG_MAJOR + +# Licenses +COPY --from=builder /usr/share/doc/postgresql-${PG_MAJOR}-pg-ivm/copyright /licenses/postgresql-${PG_MAJOR}-pg-ivm/ + +# Libraries +COPY --from=builder /usr/lib/postgresql/${PG_MAJOR}/lib/pg_ivm* /lib/ +COPY --from=builder /usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/ /lib/bitcode/ + +# Share +COPY --from=builder /usr/share/postgresql/${PG_MAJOR}/extension/pg_ivm* /share/extension/ + +USER 65532:65532 diff --git a/pg-ivm/README.md b/pg-ivm/README.md new file mode 100644 index 00000000..29fc28c8 --- /dev/null +++ b/pg-ivm/README.md @@ -0,0 +1,100 @@ +# `pg_ivm` + + +[pg_ivm](https://github.com/sraoss/pg_ivm) is an open-source extension +that provides **Incremental View Maintenance (IVM)** for PostgreSQL, allowing +materialized views to be updated incrementally when base tables change. + +## Usage + +### 1. Add the pg_ivm extension image to your Cluster + +Define the `pg_ivm` extension under the `postgresql.extensions` section of +your `Cluster` resource. **Note:** `pg_ivm` must be loaded via `shared_preload_libraries` +for its trigger-based IVM functionality to work correctly. For example: + +```yaml +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: cluster-pg-ivm +spec: + imageName: ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie + instances: 1 + + storage: + size: 1Gi + + postgresql: + shared_preload_libraries: + - "pg_ivm" + extensions: + - name: pg_ivm + image: + # renovate: suite=trixie-pgdg depName=postgresql-18-pg-ivm + reference: ghcr.io/cloudnative-pg/pg-ivm:1.13-18-trixie +``` + +### 2. Enable the extension in a database + +You can install `pg_ivm` in a specific database by creating or updating a +`Database` resource. For example, to enable it in the `app` database: + +```yaml +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: cluster-pg-ivm-app +spec: + name: app + owner: app + cluster: + name: cluster-pg-ivm + extensions: + - name: pg_ivm + # renovate: suite=trixie-pgdg depName=postgresql-18-pg-ivm extractVersion=^(?\d+\.\d+) + version: '1.13' +``` + +### 3. Verify installation + +Once the database is ready, connect to it with `psql` and run: + +```sql +\dx +``` + +You should see `pg_ivm` listed among the installed extensions. + +## Contributors + +This extension is maintained by: + +- Husn E Rabbi (@shusaan) + +The maintainers are responsible for: + +- Monitoring upstream releases and security vulnerabilities. +- Ensuring compatibility with supported PostgreSQL versions. +- Reviewing and merging contributions specific to this extension's container + image and lifecycle. + +--- + +## Licenses and Copyright + +This container image contains software that may be licensed under various +open-source licenses. + +All relevant license and copyright information for the `pg_ivm` extension +and its dependencies are bundled within the image at: + +```text +/licenses/ +``` + +By using this image, you agree to comply with the terms of the licenses +contained therein. diff --git a/pg-ivm/metadata.hcl b/pg-ivm/metadata.hcl new file mode 100644 index 00000000..d879fc49 --- /dev/null +++ b/pg-ivm/metadata.hcl @@ -0,0 +1,37 @@ +# SPDX-FileCopyrightText: Copyright © contributors to CloudNativePG, established as CloudNativePG a Series of LF Projects, LLC. +# SPDX-License-Identifier: Apache-2.0 +metadata = { + name = "pg-ivm" + sql_name = "pg_ivm" + image_name = "pg-ivm" + licenses = ["PostgreSQL"] + shared_preload_libraries = ["pg_ivm"] + postgresql_parameters = {} + extension_control_path = [] + dynamic_library_path = [] + ld_library_path = [] + bin_path = [] + env = {} + auto_update_os_libs = false + required_extensions = [] + create_extension = true + + versions = { + trixie = { + "18" = { + // renovate: suite=trixie-pgdg depName=postgresql-18-pg-ivm + package = "1.13-1.pgdg13+1" + // renovate: suite=trixie-pgdg depName=postgresql-18-pg-ivm extractVersion=^(?\d+\.\d+) + sql = "1.13" + } + } + bookworm = { + "18" = { + // renovate: suite=bookworm-pgdg depName=postgresql-18-pg-ivm + package = "1.13-1.pgdg12+1" + // renovate: suite=bookworm-pgdg depName=postgresql-18-pg-ivm extractVersion=^(?\d+\.\d+) + sql = "1.13" + } + } + } +} diff --git a/pg-ivm/test/chainsaw-test.yaml b/pg-ivm/test/chainsaw-test.yaml new file mode 100644 index 00000000..783f2628 --- /dev/null +++ b/pg-ivm/test/chainsaw-test.yaml @@ -0,0 +1,28 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: verify-pg-ivm-extension +spec: + timeouts: + apply: 5s + assert: 3m + delete: 30s + description: Verify pg_ivm extension is properly installed + steps: + - name: Create a Cluster with the extension + try: + - apply: + file: cluster.yaml + - apply: + file: database.yaml + - assert: + file: cluster-assert.yaml + - assert: + file: database-assert.yaml + + - name: Verify extension is installed + try: + - apply: + file: check-extension.yaml + - assert: + file: check-extension-assert.yaml diff --git a/pg-ivm/test/check-extension-assert.yaml b/pg-ivm/test/check-extension-assert.yaml new file mode 100644 index 00000000..a7971fc7 --- /dev/null +++ b/pg-ivm/test/check-extension-assert.yaml @@ -0,0 +1,6 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: extension-installed +status: + succeeded: 1 diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml new file mode 100644 index 00000000..58fb11d2 --- /dev/null +++ b/pg-ivm/test/check-extension.yaml @@ -0,0 +1,34 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: extension-installed +spec: + template: + spec: + restartPolicy: OnFailure + containers: + - name: data-test + env: + - name: EXT_VERSION + value: ($values.version) + - name: DB_URI + valueFrom: + secretKeyRef: + name: (join('-', [$values.name, 'app'])) + key: uri + # renovate: datasource=docker depName=alpine/psql versioning=docker + image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 + command: ['sh', '-c'] + args: + - | + set -e + DB_URI=$(echo $DB_URI | sed "s|/\*|/|") + test "$(psql "$DB_URI" -tAc "SELECT EXISTS (SELECT FROM pg_catalog.pg_extension WHERE extname = 'pg_ivm' AND extversion = '${EXT_VERSION}')" -q)" = "t" + psql "$DB_URI" -c "DROP TABLE IF EXISTS test_ivm CASCADE;" + psql "$DB_URI" -c "DROP TABLE IF EXISTS base_table CASCADE;" + psql "$DB_URI" -c "CREATE TABLE base_table (id INT PRIMARY KEY, value TEXT);" + psql "$DB_URI" -c "INSERT INTO base_table VALUES (1, 'test');" + psql "$DB_URI" -c "SELECT pgivm.create_immv('test_ivm', 'SELECT * FROM base_table');" + test "$(psql "$DB_URI" -tAc "SELECT COUNT(*) FROM test_ivm" -q)" = "1" + psql "$DB_URI" -c "INSERT INTO base_table VALUES (2, 'test2');" + test "$(psql "$DB_URI" -tAc "SELECT COUNT(*) FROM test_ivm" -q)" = "2" diff --git a/pg-ivm/test/cluster-assert.yaml b/pg-ivm/test/cluster-assert.yaml new file mode 100644 index 00000000..aa221230 --- /dev/null +++ b/pg-ivm/test/cluster-assert.yaml @@ -0,0 +1,8 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: ($values.name) +status: + readyInstances: 1 + phase: Cluster in healthy state + image: ($values.pg_image) diff --git a/pg-ivm/test/cluster.yaml b/pg-ivm/test/cluster.yaml new file mode 100644 index 00000000..48d6fe06 --- /dev/null +++ b/pg-ivm/test/cluster.yaml @@ -0,0 +1,15 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: ($values.name) +spec: + imageName: ($values.pg_image) + instances: 1 + + storage: + size: 1Gi + + postgresql: + parameters: ($values.postgresql_parameters) + shared_preload_libraries: ($values.shared_preload_libraries) + extensions: ($values.extensions) diff --git a/pg-ivm/test/database-assert.yaml b/pg-ivm/test/database-assert.yaml new file mode 100644 index 00000000..9417b87b --- /dev/null +++ b/pg-ivm/test/database-assert.yaml @@ -0,0 +1,5 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: (join('-', [$values.name, 'app'])) +status: ($values.database_assert_status) diff --git a/pg-ivm/test/database.yaml b/pg-ivm/test/database.yaml new file mode 100644 index 00000000..2d6810c2 --- /dev/null +++ b/pg-ivm/test/database.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: (join('-', [$values.name, 'app'])) +spec: + name: app + owner: app + cluster: + name: ($values.name) + extensions: ($values.database_config.extensions_spec) From 72c2850a9e5b977c51d1e5276897f4b1bcbbe952 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Tue, 14 Jul 2026 09:34:00 +0200 Subject: [PATCH 33/76] ci: automate smoke-test cnpg matrix (#274) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Automate the list of cnpg releases used to generate the smoke test Job matrix. Get the latest release branch via renovate, then calculate the previous supported release branch arithmetically. Adjust renovate to use semver-coerced versioning to pull the latest cnpg release. Closes #275 Signed-off-by: Niccolò Fei --- .github/workflows/bake_targets.yml | 22 +++++++++++++++++++++- Taskfile.yml | 2 +- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 9fdf5bd7..94f7e23e 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -107,6 +107,25 @@ jobs: snyk_token: ${{ secrets.SNYK_TOKEN }} dockerfile: "${{ inputs.extension_name }}/Dockerfile" + generate-smoke-test-matrix: + name: Generate matrix for smoke tests + runs-on: ubuntu-24.04 + permissions: {} + outputs: + versions: ${{ steps.versions.outputs.versions }} + steps: + # main plus the latest and previous supported minor release branches. + - name: Compute CNPG release matrix + id: versions + env: + # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver-coerced extractVersion=^v(?\d+\.\d+)\.\d+$ + LATEST_RELEASE: "1.29" + run: | + PREVIOUS_RELEASE=$(awk -F. '{print $1"."$2-1}' <<< "$LATEST_RELEASE") + versions=$(jq -cn --arg latest "$LATEST_RELEASE" --arg previous "$PREVIOUS_RELEASE" \ + '["main", $previous, $latest]') + echo "versions=$versions" >> "$GITHUB_OUTPUT" + smoke-test: name: Smoke test runs-on: ubuntu-24.04 @@ -115,11 +134,12 @@ jobs: packages: read needs: - testbuild + - generate-smoke-test-matrix strategy: fail-fast: false matrix: image: ${{fromJson(needs.testbuild.outputs.images)}} - cnpg: ["main", "1.28", "1.29"] + cnpg: ${{fromJson(needs.generate-smoke-test-matrix.outputs.versions)}} steps: - name: Checkout Code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 diff --git a/Taskfile.yml b/Taskfile.yml index f7c6edec..1ff5b226 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -21,7 +21,7 @@ vars: KIND_NODE_VERSION: v1.36.1@sha256:3489c7674813ba5d8b1a9977baea8a6e553784dab7b84759d1014dbd78f7ebd5 K8S_VERSION: '{{ regexReplaceAll "^v([0-9.]+).*" .KIND_NODE_VERSION "$1" }}' KIND_CLUSTER_NAME: pg-extensions-{{ .K8S_VERSION }} - # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver extractVersion=^v(?\d+\.\d+)\.\d+$ + # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver-coerced extractVersion=^v(?\d+\.\d+)\.\d+$ CNPG_RELEASE_DEFAULT: 1.29 tasks: From 307bb2de7c62303689e50357ad73e9e4b6333b41 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 09:53:54 +0200 Subject: [PATCH 34/76] chore(deps): update dependency cloudnative-pg/cloudnative-pg to v1.30 (#280) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 2 +- Taskfile.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 94f7e23e..e010afa4 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -119,7 +119,7 @@ jobs: id: versions env: # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver-coerced extractVersion=^v(?\d+\.\d+)\.\d+$ - LATEST_RELEASE: "1.29" + LATEST_RELEASE: "1.30" run: | PREVIOUS_RELEASE=$(awk -F. '{print $1"."$2-1}' <<< "$LATEST_RELEASE") versions=$(jq -cn --arg latest "$LATEST_RELEASE" --arg previous "$PREVIOUS_RELEASE" \ diff --git a/Taskfile.yml b/Taskfile.yml index 1ff5b226..4b0b4586 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -22,7 +22,7 @@ vars: K8S_VERSION: '{{ regexReplaceAll "^v([0-9.]+).*" .KIND_NODE_VERSION "$1" }}' KIND_CLUSTER_NAME: pg-extensions-{{ .K8S_VERSION }} # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver-coerced extractVersion=^v(?\d+\.\d+)\.\d+$ - CNPG_RELEASE_DEFAULT: 1.29 + CNPG_RELEASE_DEFAULT: 1.30 tasks: default: From d76b1e5d13df5c6b3c45cf8b4a9aaa55488d7811 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 11:56:18 +0200 Subject: [PATCH 35/76] chore(deps): update alpine/psql:18.4 docker digest to 7a47218 (#279) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pg-ivm/test/check-extension.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml index 58fb11d2..7e58d889 100644 --- a/pg-ivm/test/check-extension.yaml +++ b/pg-ivm/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:54e0912fe60096d54e1e755a2dbe686e0db89d100647d053cc2f04c934f69a82 + image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 command: ['sh', '-c'] args: - | From 3a13c62ada62f4826d26a1b4ab788afc1df31bd7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Wed, 15 Jul 2026 15:49:08 +0200 Subject: [PATCH 36/76] chore: quote CNPG_RELEASE_DEFAULT (#282) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An unquoted 1.30 is parsed as a float, not a string, so it gets normalized as 1.3 which makes `e2e:setup-env` fail because `cloudnative-pg/artifacts/release-1.3/manifests/operator-manifest.yaml` doesn't exist. Closes #281 Signed-off-by: Niccolò Fei --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 4b0b4586..252b87cd 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -22,7 +22,7 @@ vars: K8S_VERSION: '{{ regexReplaceAll "^v([0-9.]+).*" .KIND_NODE_VERSION "$1" }}' KIND_CLUSTER_NAME: pg-extensions-{{ .K8S_VERSION }} # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver-coerced extractVersion=^v(?\d+\.\d+)\.\d+$ - CNPG_RELEASE_DEFAULT: 1.30 + CNPG_RELEASE_DEFAULT: '1.30' tasks: default: From 8b0b537000d99ad5ee9248ec36fef210fab38204 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 11:09:40 +0200 Subject: [PATCH 37/76] chore(deps): update alpine/kubectl:1.36.2 docker digest to 9b05311 (#285) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 252b87cd..9b9df1ef 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.2@sha256:f91cb226fa6f356221c1be464ea2ac7205346a5e35f60e1889867cd881581192 + KUBECTL_VERSION: 1.36.2@sha256:9b053116c5c9b746e466230ea3b8bd381757064ee483e236dbadcf7f798f73cf DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 7b26d022c3babd8b37830459f78c13702744d593 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 11:21:54 +0200 Subject: [PATCH 38/76] chore(deps): update alpine/psql:18.4 docker digest to b3e4fc0 (#286) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pg-ivm/test/check-extension.yaml | 2 +- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml index 7e58d889..ede2d7c2 100644 --- a/pg-ivm/test/check-extension.yaml +++ b/pg-ivm/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 + image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 command: ['sh', '-c'] args: - | diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index 367dda9a..1340f63a 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 + image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index 9cd31930..fafa3c71 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 + image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index b64323b6..811bdf7d 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 + image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 25292d21..a768e5b2 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:7a472183a71a655468a0acf201f51d06f1c046c0096923f1caf9053bbeda0a71 + image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 command: ['sh', '-c'] args: - | From 8b779fff856a2c66c52e4192e6d2c7058a5c1fd9 Mon Sep 17 00:00:00 2001 From: Peggie Date: Mon, 20 Jul 2026 11:54:17 +0200 Subject: [PATCH 39/76] chore: update postgis OS libraries (#289) Updating the OS libraries of postgis Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: extension-os-libs-updater --- postgis/system-libs/18-trixie-os-libs.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/postgis/system-libs/18-trixie-os-libs.txt b/postgis/system-libs/18-trixie-os-libs.txt index a9f316e9..9d2179c7 100644 --- a/postgis/system-libs/18-trixie-os-libs.txt +++ b/postgis/system-libs/18-trixie-os-libs.txt @@ -42,7 +42,7 @@ libjbig0_2.1-6.1+b2_amd64.deb MD5Sum:590134f899b900c7c9f8f87cf750ea63 liblerc4_4.0.0+ds-5_amd64.deb MD5Sum:8c5933a75125eed15b466c16bf201bfa libsharpyuv0_1.5.0-0.1_amd64.deb MD5Sum:438d9fd296a1102dfa7f001641d8857a libwebp7_1.5.0-0.1_amd64.deb MD5Sum:bf682e1e438b4927c3807cad4ca6c1a9 -libtiff6_4.7.0-3+deb13u2_amd64.deb MD5Sum:c510dc7c6ddec953c6eed3ba380a6c35 +libtiff6_4.7.0-3+deb13u3_amd64.deb libproj25_9.6.0-1_amd64.deb MD5Sum:cf5a9d654805f47dc18e83f4ef2af4f6 libgeotiff5_1.7.4-1_amd64.deb MD5Sum:cde344178cfd6dd8706a86ba587ec534 libgif7_5.2.2-1+deb13u1_amd64.deb MD5Sum:b32a7f65ceaed3e3ce40abc20d3c3d2b From bdb895e91bcaf5f7c502629c4266b024b396fefd Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 11:55:02 +0200 Subject: [PATCH 40/76] chore(deps): update actions/setup-go action to v7 (#283) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 416a2add..3fb75032 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,7 +28,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: go-version-file: dagger/maintenance/go.mod cache-dependency-path: dagger/maintenance/go.sum From a20a22cfda536641911b5e8061371260ca472b6d Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 03:14:14 +0000 Subject: [PATCH 41/76] chore(deps): update dependency postgresql-18-timescaledb (#284) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.2` → `2.28.3` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.2+dfsg-1.pgdg12+1` → `2.28.3+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.28.2+dfsg-1.pgdg13+1` → `2.28.3+dfsg-1.pgdg13+1` | --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.28.3`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2283-2026-07-16) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.28.2...2.28.3) This release contains performance improvements and bug fixes since the 2.28.2 release. We recommend that you upgrade at the next available opportunity. **Bugfixes** - [#​10082](https://redirect.github.com/timescale/timescaledb/pull/10082) Wrong result when evaluating a function returning `NULL` in the columnar query execution pipeline - [#​10178](https://redirect.github.com/timescale/timescaledb/pull/10178) Fix incorrect usage of sort transformation for sort key expressions with negative constants - [#​10179](https://redirect.github.com/timescale/timescaledb/pull/10179) Allow enabling and disabling triggers on hypertables with columnstore enabled - [#​10182](https://redirect.github.com/timescale/timescaledb/pull/10182) Fix columnstore sort pushdown to check for different query sort key collation - [#​10209](https://redirect.github.com/timescale/timescaledb/pull/10209) Fix potentially wrong results for `stddev(float4)` and `stddev(float8)` when used with `avg()` in the columnar query execution pipeline - [#​10212](https://redirect.github.com/timescale/timescaledb/pull/10212) Fix race condition when enabling compression on a hypertable - [#​10230](https://redirect.github.com/timescale/timescaledb/pull/10230) Batch filtering for compressed `DML` should respect collation - [#​10254](https://redirect.github.com/timescale/timescaledb/pull/10254) Direct delete failed to handle array predicates with `NULL` values and deleted more rows than intended ([#​10129](https://redirect.github.com/timescale/timescaledb/pull/10129)) - [#​10257](https://redirect.github.com/timescale/timescaledb/pull/10257) Reuse existing `dimension_slice` IDs when possible - [#​10265](https://redirect.github.com/timescale/timescaledb/pull/10265) Truncate constraint name before trying to rename **Thanks** - [@​juantxorena](https://redirect.github.com/juantxorena) for reporting that triggers could not be enabled or disabled on hypertables with columnstore enabled
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index ce243e61..53b780da 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.2-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.3-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.28.2' + version: '2.28.3' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index 322d4a09..9d7a6661 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.28.2+dfsg-1.pgdg13+1" + package = "2.28.3+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.2" + sql = "2.28.3" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.28.2+dfsg-1.pgdg12+1" + package = "2.28.3+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.2" + sql = "2.28.3" } } } From 46db169b9ee6aac95558f774ac8170963bdadf70 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 09:19:23 +0200 Subject: [PATCH 42/76] chore(deps): update actions/checkout digest to 3d3c42e (#290) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 6 +++--- .github/workflows/test.yml | 2 +- .github/workflows/update-catalogs.yml | 4 ++-- .github/workflows/update_os_libraries.yml | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 18063d00..8e98fbac 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -24,7 +24,7 @@ jobs: matrix: ${{ steps.get-matrix.outputs.matrix}} steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index e010afa4..118b8bcf 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -27,7 +27,7 @@ jobs: images: ${{ steps.images.outputs.images }} steps: - name: Checkout Code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false @@ -94,7 +94,7 @@ jobs: image: ${{fromJson(needs.testbuild.outputs.images)}} steps: - name: Checkout Code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false @@ -142,7 +142,7 @@ jobs: cnpg: ${{fromJson(needs.generate-smoke-test-matrix.outputs.versions)}} steps: - name: Checkout Code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3fb75032..619b897c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -23,7 +23,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index ed63e0d5..ed4ce694 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -22,12 +22,12 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Checkout artifacts - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: path: artifacts repository: cloudnative-pg/artifacts diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index da3b5ab9..6f3c662e 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -19,7 +19,7 @@ jobs: extensions: ${{ steps.get-extensions.outputs.extensions }} steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false @@ -53,7 +53,7 @@ jobs: extension: ${{ fromJson(needs.fetch-extensions.outputs.extensions) }} steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to the GitHub Container registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 From f0eb97fc5f69048218ea6da670d1a416d306b043 Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Wed, 22 Jul 2026 22:13:27 +1000 Subject: [PATCH 43/76] chore: add Gabriele Fedi as a component owner (#292) Relates cloudnative-pg/governance#72 Signed-off-by: Gabriele Bartolini --- CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CODEOWNERS b/CODEOWNERS index 8ed922e4..551ec6b9 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -2,7 +2,7 @@ # responsible for code in a repository. For details, please refer to # https://docs.github.com/en/free-pro-team@latest/github/creating-cloning-and-archiving-repositories/about-code-owners -* @cloudnative-pg/maintainers @NiccoloFei +* @cloudnative-pg/maintainers @NiccoloFei @GabriFedi97 # TimescaleDB (OSS version) /timescaledb-oss/ @shusaan @cloudnative-pg/maintainers @NiccoloFei From cacac01ea2306d8602ad5a76f71372c54ab115f5 Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Thu, 23 Jul 2026 21:04:55 +1000 Subject: [PATCH 44/76] chore: expand account names in CODEOWNERS file (#288) Limit the requirement to review an extension to the owner. Closes #287 Signed-off-by: Gabriele Bartolini --- CODEOWNERS | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CODEOWNERS b/CODEOWNERS index 551ec6b9..f73810e6 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -2,13 +2,13 @@ # responsible for code in a repository. For details, please refer to # https://docs.github.com/en/free-pro-team@latest/github/creating-cloning-and-archiving-repositories/about-code-owners -* @cloudnative-pg/maintainers @NiccoloFei @GabriFedi97 +* @leonardoce @mnencia @gbartolini @fcanovai @armru @NiccoloFei @GabriFedi97 # TimescaleDB (OSS version) -/timescaledb-oss/ @shusaan @cloudnative-pg/maintainers @NiccoloFei +/timescaledb-oss/ @shusaan # wal2json -/wal2json/ @cloudnative-pg/maintainers @NiccoloFei @solidDoWant +/wal2json/ @solidDoWant # pg-ivm -/pg-ivm/ @shusaan @cloudnative-pg/maintainers @NiccoloFei +/pg-ivm/ @shusaan From d5709b0362a875e099f672687f011ead1b5f4ae2 Mon Sep 17 00:00:00 2001 From: Peggie Date: Fri, 24 Jul 2026 11:50:15 +0200 Subject: [PATCH 45/76] chore: update postgis OS libraries (#291) Updating the OS libraries of postgis Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: extension-os-libs-updater --- postgis/system-libs/18-bookworm-os-libs.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/postgis/system-libs/18-bookworm-os-libs.txt b/postgis/system-libs/18-bookworm-os-libs.txt index c7ebeb6c..852501ce 100644 --- a/postgis/system-libs/18-bookworm-os-libs.txt +++ b/postgis/system-libs/18-bookworm-os-libs.txt @@ -60,7 +60,7 @@ libogdi4.1_4.1.0+ds-6_amd64.deb MD5Sum:bca573b90eb2ef8e6fa4c7ab66c77927 libopenjp2-7_2.5.0-2+deb12u3_amd64.deb MD5Sum:bb7b72ae72a38620bed002a063d5dc64 liblcms2-2_2.14-2+deb12u1_amd64.deb MD5Sum:4a701d009079104e62992b219cee5f6e libnspr4_2%3a4.35-1_amd64.deb MD5Sum:1f8e0fda3f2527e0051768abd071c2fe -libnss3_2%3a3.87.1-1+deb12u2_amd64.deb MD5Sum:1e66101d6c420e5999032e3f187282ed +libnss3_2%3a3.87.1-1+deb12u3_amd64.deb libpoppler126_22.12.0-2+deb12u2_amd64.deb MD5Sum:23886480fe5be6b0c6fe09059318aba8 libqhull-r8.0_2020.2-5_amd64.deb MD5Sum:781260a36cd4d65a86fc349f26b68338 librttopo1_1.1.0-3_amd64.deb MD5Sum:901bfdc1a4a806d1c9be972018d65368 From 81ebfd739c744645b326051d4d19f69582215123 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 14:09:51 +0200 Subject: [PATCH 46/76] chore(deps): update docker/login-action digest to 06fb636 (#294) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 2 +- .github/workflows/update_os_libraries.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 118b8bcf..f71fdec8 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Log in to the GitHub Container registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 + uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 6f3c662e..8502bfde 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to the GitHub Container registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 + uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4 with: registry: ghcr.io username: ${{ github.actor }} From 560a829c4b7f266f55a0e787918d049099fd6116 Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Mon, 27 Jul 2026 18:20:57 +1000 Subject: [PATCH 47/76] fix(PostGIS): strip `$libdir/` prefix from extension SQL scripts (#293) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ALTER EXTENSION UPDATE fails with could not access file "$libdir/postgis-3" because the PGDG-packaged postgis/address_standardizer SQL scripts hardcode $libdir/ both in LOAD statements and in AS function definitions, but with imageVolume-mounted extensions there is no $libdir to expand. dynamic_library_path already resolves the bare module name, so the $libdir/ prefix is stripped from all PostGIS install, upgrade, and contrib scripts at build time. This should eventually be fixed upstream, in the PostGIS itself. Signed-off-by: Gabriele Bartolini Signed-off-by: Niccolò Fei Assisted-by: Claude Co-authored-by: Niccolò Fei --- postgis/Dockerfile | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/postgis/Dockerfile b/postgis/Dockerfile index ccc7345b..88823042 100644 --- a/postgis/Dockerfile +++ b/postgis/Dockerfile @@ -16,6 +16,18 @@ RUN set -eux && \ "postgresql-${PG_MAJOR}-postgis-${POSTGIS_MAJOR}=${EXT_VERSION}" \ "postgresql-${PG_MAJOR}-postgis-${POSTGIS_MAJOR}-scripts=${EXT_VERSION}" +# Strip the "$libdir/" prefix from LOAD and CREATE FUNCTION ... AS statements +# in the extension and contrib scripts: with imageVolume-mounted extensions +# there is no $libdir to expand, and PostgreSQL 18+ fails to resolve it during +# CREATE/ALTER EXTENSION otherwise. +# dynamic_library_path already resolves the bare module name. +# Only strip right after an opening quote, so the pattern can't accidentally +# touch unrelated text. +RUN sed -i "s/'\$libdir\//'/g" \ + /usr/share/postgresql/${PG_MAJOR}/extension/postgis*.sql \ + /usr/share/postgresql/${PG_MAJOR}/extension/address_standardizer*.sql \ + /usr/share/postgresql/${PG_MAJOR}/contrib/postgis*/*.sql + # Gather PostGIS system libraries and their licenses RUN mkdir -p /system /licenses && \ # Get libraries From 5f8ab3940778e0100ba15c5550f0a7ce7f4ac594 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 11:16:42 +0200 Subject: [PATCH 48/76] chore(deps): update docker/login-action digest to abd2ef4 (#295) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 2 +- .github/workflows/update_os_libraries.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index f71fdec8..11537986 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Log in to the GitHub Container registry - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 8502bfde..6a7447d8 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to the GitHub Container registry - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4 with: registry: ghcr.io username: ${{ github.actor }} From bd257668b959d6cd226abfb7bdde85a62ece6c93 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:53:33 +0200 Subject: [PATCH 49/76] chore(deps): update alpine/kubectl docker tag to v1.36.3 (#297) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 9b9df1ef..dbf46ccf 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.2@sha256:9b053116c5c9b746e466230ea3b8bd381757064ee483e236dbadcf7f798f73cf + KUBECTL_VERSION: 1.36.3@sha256:d6821cb31037908ce603928165aa85177b098a0eaa434b3101e497a624a896b5 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 0abe95c06089203c39026a535c55080d0861e605 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:40:29 +0000 Subject: [PATCH 50/76] chore(deps): update docker/login-action digest to 371161b (#298) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker/login-action](https://redirect.github.com/docker/login-action) ([changelog](https://redirect.github.com/docker/login-action/compare/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7..371161bbe7024a29a25c5e19bfcbc0804fe9ad2c)) | action | digest | `abd2ef4` → `371161b` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 2 +- .github/workflows/update_os_libraries.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 11537986..6f1c622e 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Log in to the GitHub Container registry - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4 + uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 6a7447d8..956f907f 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to the GitHub Container registry - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4 + uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4 with: registry: ghcr.io username: ${{ github.actor }} From de3635845d008ca06b5302f342e8b70b5303364e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 02:49:32 +0000 Subject: [PATCH 51/76] chore(deps): update dependency postgresql-18-timescaledb (#303) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | minor | `2.28.3` → `2.29.0` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | minor | `2.28.3+dfsg-1.pgdg12+1` → `2.29.0+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | minor | `2.28.3+dfsg-1.pgdg13+1` → `2.29.0+dfsg-1.pgdg13+1` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/26) for more information. --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.29.0`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2290-2026-07-28) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.28.3...2.29.0) This release contains performance improvements and bug fixes since the 2.28.3 release. We recommend that you upgrade at the next available opportunity. **Release Highlights** - Chunk exclusion for DML operations improves the performance of `UPDATE` and `DELETE` statements on hypertables. By acquiring row exclusive locks only on the specific chunks being modified rather than the entire hypertable. This enhancement reduces lock contention in high-concurrency workloads involving DML, speeding up the planning of DML queries by using the optimized TimescaleDB chunk exclusion instead of the baseline Postgres constraint exclusion. - The query planner can now choose an additional algorithm for retrieving a small number of rows, for reading the columnstore data, optimizing the default behavior. This optimization improves some last-point queries on columnstore (think `ORDER BY time DESC LIMIT 1`) run several times faster than in previous releases. **Important: PostgreSQL 15 Support Removed** TimescaleDB 2.29.0 removes support for PostgreSQL 15. This release supports PostgreSQL 16, 17, and 18. If you are still running PostgreSQL 15, upgrade PostgreSQL before upgrading to TimescaleDB 2.29.0. **Backward-Incompatible Changes** - [#​10041](https://redirect.github.com/timescale/timescaledb/pull/10041) Remove support for PostgreSQL 15 **Features** - [#​9315](https://redirect.github.com/timescale/timescaledb/pull/9315) Speed up `DML` operations on hypertables by using the optimized TimescaleDB hypertable expansion code instead of the generic PostgreSQL inheritance hierarchy expansion - [#​9534](https://redirect.github.com/timescale/timescaledb/pull/9534) Speed up expression evaluation in the columnar pipeline by caching common subexpressions - [#​9684](https://redirect.github.com/timescale/timescaledb/pull/9684) Add `_timescaledb_functions.decompress_batch()` SQL function - [#​9732](https://redirect.github.com/timescale/timescaledb/pull/9732) Speed up some queries with small `LIMIT` by switching to row-by-row query execution pipeline - [#​9917](https://redirect.github.com/timescale/timescaledb/pull/9917) Decompress less data in `DML` on compressed hypertables by accounting for prepared statement parameters - [#​9957](https://redirect.github.com/timescale/timescaledb/pull/9957) Add `compact_chunk()` function - [#​10048](https://redirect.github.com/timescale/timescaledb/pull/10048) Support concurrent refresh policies on hierarchical continuous aggregates - [#​10081](https://redirect.github.com/timescale/timescaledb/pull/10081) Add `samplerate` argument to `_timescaledb_functions.estimate_uncompressed_size()` - [#​10100](https://redirect.github.com/timescale/timescaledb/pull/10100) Skip classifying compressed relations to speed up planning - [#​10118](https://redirect.github.com/timescale/timescaledb/pull/10118) Don't track compressed relations as separate chunk - [#​10119](https://redirect.github.com/timescale/timescaledb/pull/10119) Reduce memory usage of `INSERT` queries using direct compress and spanning multiple chunks - [#​10163](https://redirect.github.com/timescale/timescaledb/pull/10163) Add a compaction policy for unordered chunks - [#​10204](https://redirect.github.com/timescale/timescaledb/pull/10204) Don't create separate hypertable catalog entry for hypertables with compression - [#​10217](https://redirect.github.com/timescale/timescaledb/pull/10217) Initial placeholder version of granular refresh API - [#​10225](https://redirect.github.com/timescale/timescaledb/pull/10225) Add `config_merge` parameter to `alter_job()` for merging `jsonb` into the existing job configuration - [#​10226](https://redirect.github.com/timescale/timescaledb/pull/10226) Add `recompress_unordered` columnstore policy option - [#​10231](https://redirect.github.com/timescale/timescaledb/pull/10231) Use `regclass` for storing relation reference in chunk table - [#​10237](https://redirect.github.com/timescale/timescaledb/pull/10237) Add helper functions for decoding hypertable status - [#​10240](https://redirect.github.com/timescale/timescaledb/pull/10240) Add the `tsdb.direct_compress` storage parameter that allows enabling direct compress for a given hypertable independent of global settings - [#​10266](https://redirect.github.com/timescale/timescaledb/pull/10266) Add `max_batches` to `compact_chunk()` - [#​10299](https://redirect.github.com/timescale/timescaledb/pull/10299) Add `continuous_aggs_tenant_tracking` and `hypertable_cagg_settings` catalogs **Bugfixes** - [#​10013](https://redirect.github.com/timescale/timescaledb/pull/10013) Make ownership error messages on continuous aggregates consistent - [#​10052](https://redirect.github.com/timescale/timescaledb/pull/10052) Result of `MIN` / `MAX` aggregate functions in columnar aggregation pipeline possibly inconsistent with plain PostgreSQL result - [#​10071](https://redirect.github.com/timescale/timescaledb/pull/10071) Prune the real-time branch of hierarchical continuous aggregates at any nesting depth - [#​10143](https://redirect.github.com/timescale/timescaledb/pull/10143) Fix division by zero when planning `time_bucket` with zero width - [#​10199](https://redirect.github.com/timescale/timescaledb/pull/10199) Fix `initial_start` handling in `build_job_info` - [#​10213](https://redirect.github.com/timescale/timescaledb/pull/10213) Cache sort pathkeys per hypertable - [#​10221](https://redirect.github.com/timescale/timescaledb/pull/10221) Fix incremental refresh skipping the last bucket - [#​10278](https://redirect.github.com/timescale/timescaledb/pull/10278) Drop `job_errors` view in `bgw_job_stat_history` migration - [#​10280](https://redirect.github.com/timescale/timescaledb/pull/10280) `RETURNING` clause returned no rows for `INSERT` using direct compress - [#​10281](https://redirect.github.com/timescale/timescaledb/pull/10281) Disable direct compress when the destination table has an exclusion constraint so the constraint is still enforced - [#​10282](https://redirect.github.com/timescale/timescaledb/pull/10282) Only count directly compressed rows toward the command tag when the `INSERT` sets it - [#​10286](https://redirect.github.com/timescale/timescaledb/pull/10286) Propagate `VACUUM` on a chunk to the compressed relation when running on the chunk directly - [#​10302](https://redirect.github.com/timescale/timescaledb/pull/10302) Fix useless-join removal and self-join elimination for hypertables - [#​10313](https://redirect.github.com/timescale/timescaledb/pull/10313) Allow running `ALTER EXTENSION timescaledb UPDATE` inside a transaction block - [#​10315](https://redirect.github.com/timescale/timescaledb/pull/10315) Fix overlap detection with running max - [#​10324](https://redirect.github.com/timescale/timescaledb/pull/10324) Fix stale index entries after `rebuild_sparse_index()` on compressed chunks **GUCs** - `timescaledb.enable_hypertable_expansion_for_dml`: allow using the optimized TimescaleDB hypertable expansion code for `UPDATE` and `DELETE` instead of the generic PostgreSQL inheritance hierarchy expansion. On by default. **Thanks** - [@​FrancescEthon](https://redirect.github.com/FrancescEthon) and [@​ManuelEthon](https://redirect.github.com/ManuelEthon) for reporting an issue with incremental refresh skipping the last bucket - [@​h0rn3t](https://redirect.github.com/h0rn3t) for reporting a problem with `VACUUM` not propagating to the compressed relation - [@​igor2x](https://redirect.github.com/igor2x) for reporting an issue with locking during DML statements on hypertables - [@​MaximeEthon](https://redirect.github.com/MaximeEthon) for reporting an issue with prepared statement parameters in DML decompression - [@​proddata](https://redirect.github.com/proddata) for reporting a problem when upgrading from 2.15.3 to 2.28.2 - [@​tureba](https://redirect.github.com/tureba) for reporting and fixing stale sparse-index entries after rebuild - [@​viniciusrsouza](https://redirect.github.com/viniciusrsouza) for reporting an issue with hierarchical continuous aggregates
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index 53b780da..d4cc793a 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.28.3-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.29.0-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.28.3' + version: '2.29.0' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index 9d7a6661..f945ab8d 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.28.3+dfsg-1.pgdg13+1" + package = "2.29.0+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.3" + sql = "2.29.0" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.28.3+dfsg-1.pgdg12+1" + package = "2.29.0+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.28.3" + sql = "2.29.0" } } } From 0417dc00a970876b8cd11450b96c78792051ce9f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 09:56:12 +0200 Subject: [PATCH 52/76] chore(deps): update all github action (#301) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 4 ++-- .github/workflows/test.yml | 2 +- .github/workflows/update-catalogs.yml | 2 +- .github/workflows/update_os_libraries.yml | 6 +++--- Taskfile.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 8e98fbac..4c3684b7 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -33,7 +33,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.7 + DAGGER_VERSION: 0.21.8 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index 6f1c622e..af8cdf3f 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Log in to the GitHub Container registry - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -152,7 +152,7 @@ jobs: - name: Install Dagger env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.7 + DAGGER_VERSION: 0.21.8 run: | curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 619b897c..d75af657 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -37,7 +37,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.7 + DAGGER_VERSION: 0.21.8 with: version: ${{ env.DAGGER_VERSION }} verb: develop diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index ed4ce694..8312210f 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -39,7 +39,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.7 + DAGGER_VERSION: 0.21.8 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 956f907f..9785ce7e 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -28,7 +28,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.7 + DAGGER_VERSION: 0.21.8 with: version: ${{ env.DAGGER_VERSION }} verb: call @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to the GitHub Container registry - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -66,7 +66,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.7 + DAGGER_VERSION: 0.21.8 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/Taskfile.yml b/Taskfile.yml index dbf46ccf..1bef734b 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -209,7 +209,7 @@ tasks: run: once vars: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_ENGINE_VERSION: v0.21.7 + DAGGER_ENGINE_VERSION: v0.21.8 cmds: - > docker run -d -v /var/lib/dagger --name {{ .DAGGER_ENGINE_NAME }} --restart always --network {{ .E2E_NETWORK }} From eea4a2fc6bd40efe28ff3511b389fc98ea372491 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 10:58:00 +0200 Subject: [PATCH 53/76] chore(deps): update dependency postgresql-18-pgvector (#305) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pgvector/README.md | 4 ++-- pgvector/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pgvector/README.md b/pgvector/README.md index 93281d80..f4397196 100644 --- a/pgvector/README.md +++ b/pgvector/README.md @@ -30,7 +30,7 @@ spec: - name: pgvector image: # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - reference: ghcr.io/cloudnative-pg/pgvector:0.8.5-18-trixie + reference: ghcr.io/cloudnative-pg/pgvector:0.8.6-18-trixie ``` ### 2. Enable the extension in a database @@ -51,7 +51,7 @@ spec: extensions: - name: vector # renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - version: '0.8.5' + version: '0.8.6' ``` ### 3. Verify installation diff --git a/pgvector/metadata.hcl b/pgvector/metadata.hcl index 76c73dae..ce0e919a 100644 --- a/pgvector/metadata.hcl +++ b/pgvector/metadata.hcl @@ -18,17 +18,17 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector - package = "0.8.5-1.pgdg12+1" + package = "0.8.6-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.5" + sql = "0.8.6" } } trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector - package = "0.8.5-1.pgdg13+1" + package = "0.8.6-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-pgvector extractVersion=^(?\d+\.\d+\.\d+) - sql = "0.8.5" + sql = "0.8.6" } } } From da5cb66d515c7d264cf7b4b5de8e4ad7dc55af42 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 13:04:41 +0200 Subject: [PATCH 54/76] chore(deps): update alpine/kubectl:1.36.3 docker digest to 1f0c863 (#304) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 1bef734b..3d62063c 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.3@sha256:d6821cb31037908ce603928165aa85177b098a0eaa434b3101e497a624a896b5 + KUBECTL_VERSION: 1.36.3@sha256:1f0c86385ebec294558b450956a390116c098d04166bb279b7c9776082b339eb DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From f06c545b3f85dbe25c3bd24a73f6c05830c54b4b Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Wed, 5 Aug 2026 06:46:04 +1000 Subject: [PATCH 55/76] chore: sync CODEOWNERS with cnpg-infra policy (#306) Regenerates this repo's CODEOWNERS from cloudnative-pg/cnpg-infra's `componentowners-policy.yaml`, the org's tracked desired state for CODEOWNERS content. - Routes ownership through this repo's dedicated GitHub owners team instead of hardcoded usernames, so membership changes are picked up automatically. - Any path-scoped rule now also includes the repo's general owners, so a path rule adds reviewers rather than silently replacing the `*` rule's owners for that subtree (CODEOWNERS only honors the last matching pattern, it does not merge). See cloudnative-pg/cnpg-infra for the policy this is generated from. Assisted-by: Claude --- CODEOWNERS | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/CODEOWNERS b/CODEOWNERS index f73810e6..9c28922a 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,14 +1,12 @@ -# The CODEOWNERS file is used to define individuals or teams that are -# responsible for code in a repository. For details, please refer to -# https://docs.github.com/en/free-pro-team@latest/github/creating-cloning-and-archiving-repositories/about-code-owners - -* @leonardoce @mnencia @gbartolini @fcanovai @armru @NiccoloFei @GabriFedi97 - -# TimescaleDB (OSS version) -/timescaledb-oss/ @shusaan - -# wal2json -/wal2json/ @solidDoWant - -# pg-ivm -/pg-ivm/ @shusaan +# This file is generated from componentowners-policy.yaml in +# cloudnative-pg/cnpg-infra — do not hand-edit, propose changes there instead. +# +# Path-scoped rules below always include the repo's own general owners +# (the "*" line) in addition to their own specific teams/users, since +# CODEOWNERS only honors the LAST matching pattern for a given path — +# it does not merge an earlier, less-specific rule into a later one. + +* @cloudnative-pg/postgres-extensions-containers-owners +/timescaledb-oss/ @cloudnative-pg/postgres-extensions-containers-owners @shusaan +/wal2json/ @cloudnative-pg/postgres-extensions-containers-owners @solidDoWant +/pg-ivm/ @cloudnative-pg/postgres-extensions-containers-owners @shusaan From b5c3312f7c600750117d5126c155008ff26dd022 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 14:40:38 +0200 Subject: [PATCH 56/76] chore(deps): update alpine/psql:18.4 docker digest to 96cfdbb (#296) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pg-ivm/test/check-extension.yaml | 2 +- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml index ede2d7c2..b267321d 100644 --- a/pg-ivm/test/check-extension.yaml +++ b/pg-ivm/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 command: ['sh', '-c'] args: - | diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index 1340f63a..e00699cb 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index fafa3c71..b530c1a4 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index 811bdf7d..343c86b2 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index a768e5b2..19ea8342 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 command: ['sh', '-c'] args: - | From 927984a3381901990611294628b8cfa212b03c66 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 6 Aug 2026 17:56:01 +0200 Subject: [PATCH 57/76] chore(deps): update dorny/paths-filter action to v4.0.3 (#308) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 4c3684b7..ca5e1089 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -66,7 +66,7 @@ jobs: } >> "$GITHUB_ENV" - name: Check for changes - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: filter with: filters: | From 6548da50c8c99462c328442d608f796ea2586e1f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 17:42:04 +0000 Subject: [PATCH 58/76] chore(deps): update dependency postgresql-18-timescaledb (#309) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.0` → `2.29.1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.0+dfsg-1.pgdg12+1` → `2.29.1+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.0+dfsg-1.pgdg13+1` → `2.29.1+dfsg-1.pgdg13+1` | --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.29.1`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2291-2026-08-04) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.29.0...2.29.1) This release contains performance improvements and bug fixes since the 2.29.0 release and fixes for security vulnerabilities ([#​10360](https://redirect.github.com/timescale/timescaledb/issues/10360), [#​10379](https://redirect.github.com/timescale/timescaledb/issues/10379), [#​10386](https://redirect.github.com/timescale/timescaledb/issues/10386)). You can check the [security advisory](https://redirect.github.com/timescale/timescaledb/security/advisories/GHSA-hcfx-29v5-2rcw) for more information on the vulnerability and the platforms that are affected. We recommend that you upgrade at the next available opportunity. **Bugfixes** - [#​10327](https://redirect.github.com/timescale/timescaledb/pull/10327) Assertion failure in `add_dimension()` when the hypertable argument is `NULL` - [#​10339](https://redirect.github.com/timescale/timescaledb/pull/10339) Fix crash when deleting from a compressed continuous aggregate source - [#​10340](https://redirect.github.com/timescale/timescaledb/pull/10340) Validate `max_batches` in `compact_chunk()` - [#​10352](https://redirect.github.com/timescale/timescaledb/pull/10352) Reset inherited column and constraint flags on chunks during `attach_chunk()` - [#​10360](https://redirect.github.com/timescale/timescaledb/pull/10360) Fix decompressor crashes with malformed compressed data - [#​10369](https://redirect.github.com/timescale/timescaledb/pull/10369) Fix typo in error message about `MERGE` support on compressed hypertables - [#​10379](https://redirect.github.com/timescale/timescaledb/pull/10379) Read hypertable max time value with an ordered scan - [#​10386](https://redirect.github.com/timescale/timescaledb/pull/10386) Add missing permission checks to internal chunk functions **Thanks** - [@​JoongHyuk-Shin](https://redirect.github.com/JoongHyuk-Shin) for reporting and fixing `NULL` handling in `add_dimension()` - [@​igor2x](https://redirect.github.com/igor2x) for reporting a typo in a `MERGE` support error message - [@​mdisec](https://redirect.github.com/mdisec) for reporting issues with compressed data validation during decompression
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index d4cc793a..f6bf3a78 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.29.0-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.29.1-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.29.0' + version: '2.29.1' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index f945ab8d..619cbe8f 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.29.0+dfsg-1.pgdg13+1" + package = "2.29.1+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.29.0" + sql = "2.29.1" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.29.0+dfsg-1.pgdg12+1" + package = "2.29.1+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.29.0" + sql = "2.29.1" } } } From 3c8cce8053d54a049ef677b4505815e72c4d2eef Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 08:07:38 +1000 Subject: [PATCH 59/76] chore(deps): update alpine/psql:18.4 docker digest to f4c295e (#311) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | alpine/psql | digest | `96cfdbb` → `f4c295e` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pg-ivm/test/check-extension.yaml | 2 +- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml index b267321d..117457d2 100644 --- a/pg-ivm/test/check-extension.yaml +++ b/pg-ivm/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 + image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa command: ['sh', '-c'] args: - | diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index e00699cb..e5021d23 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 + image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index b530c1a4..cb2faac5 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 + image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index 343c86b2..00deaba5 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 + image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 19ea8342..116cf796 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:96cfdbb0b96bfb742c0a7eaefd4f41ed95965ef9f6857b95bb09342ff23e7189 + image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa command: ['sh', '-c'] args: - | From a8321605268e1e2d665df1437530069694fa3c76 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 00:40:49 +0000 Subject: [PATCH 60/76] chore(deps): update alpine/kubectl:1.36.3 docker digest to 5d380d1 (#310) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | alpine/kubectl | digest | `1f0c863` → `5d380d1` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 3d62063c..f10de84e 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.3@sha256:1f0c86385ebec294558b450956a390116c098d04166bb279b7c9776082b339eb + KUBECTL_VERSION: 1.36.3@sha256:5d380d18d2509483aef3df54d676c767d798d55ec9f3e02dabfa4c88fe6559bd DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 48a65aee224463233c41da9cbf9b9c2e73c6c351 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 16 Aug 2026 09:00:42 +1000 Subject: [PATCH 61/76] chore(deps): update dependency postgresql-18-wal2json (#315) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-wal2json](https://redirect.github.com/eulerto/wal2json) | patch | `2.6-3.pgdg13+1` → `2.6-4.pgdg13+1` | | [postgresql-18-wal2json](https://redirect.github.com/eulerto/wal2json) | patch | `2.6-3.pgdg12+1` → `2.6-4.pgdg12+1` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- wal2json/metadata.hcl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/wal2json/metadata.hcl b/wal2json/metadata.hcl index 3675cd1b..26c3443a 100644 --- a/wal2json/metadata.hcl +++ b/wal2json/metadata.hcl @@ -20,13 +20,13 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-wal2json - package = "2.6-3.pgdg12+1" + package = "2.6-4.pgdg12+1" } } trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-wal2json - package = "2.6-3.pgdg13+1" + package = "2.6-4.pgdg13+1" } } } From c8a992f553d7f69d1eb338cb021eccf2edffe1e4 Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Tue, 18 Aug 2026 07:44:56 +1000 Subject: [PATCH 62/76] fix: add `wal2json` to `output_plugin_libraries` for PG 18.6+ (#319) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PostgreSQL 18.6 introduced `output_plugin_libraries`, an allow-list restricting which libraries may be used as logical decoding output plugins (`CVE-2026-6471`). Without `wal2json` explicitly listed, `pg_create_logical_replication_slot(..., 'wal2json')` fails with: ERROR: library "wal2json" may not be used as an output plugin This is what broke the `wal2json` smoke test once the floating `postgresql:18-minimal-*` base images moved from 18.4 to 18.6: the Job that exercises dlopen of `wal2json.so` via slot creation kept failing and retrying (`CrashLoopBackOff`) until the chainsaw assert timeout, which is why CI showed an empty Job status rather than a clear error. Set `postgresql_parameters.output_plugin_libraries` in `metadata.hcl` so the extension's own test Cluster allow-lists `wal2json` (re-listing the built-in pgoutput/test_decoding defaults too, since setting this GUC replaces PostgreSQL's default rather than extending it). Update the README's example Cluster manifest accordingly, with a note that this parameter does not exist before 18.6 and setting it there is fatal (verified: postmaster refuses to start). Closes #318 Signed-off-by: Gabriele Bartolini Signed-off-by: Niccolò Fei Co-authored-by: Niccolò Fei --- wal2json/README.md | 15 ++++++++++++++- wal2json/metadata.hcl | 4 +++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/wal2json/README.md b/wal2json/README.md index f3db26fc..677a02d7 100644 --- a/wal2json/README.md +++ b/wal2json/README.md @@ -24,7 +24,12 @@ This image provides a convenient way to deploy and manage `wal2json` with Define the `wal2json` extension under the `postgresql.extensions` section of your `Cluster` resource. Logical decoding requires `wal_level` to be set to -`logical`: +`logical`. On PostgreSQL 18.6+, the server also restricts which libraries may +be used as logical decoding output plugins via the `output_plugin_libraries` +allow-list ([CVE-2026-6471](https://www.postgresql.org/support/security/CVE-2026-6471/)); +`wal2json` must be added to it explicitly, alongside the built-in defaults +(`pgoutput`, `test_decoding`), since setting this parameter replaces +PostgreSQL's default rather than extending it: ```yaml apiVersion: postgresql.cnpg.io/v1 @@ -41,6 +46,7 @@ spec: postgresql: parameters: wal_level: logical + output_plugin_libraries: "pgoutput, test_decoding, wal2json" extensions: - name: wal2json image: @@ -53,6 +59,13 @@ spec: > does not require a `Database` resource with `CREATE EXTENSION`. The plugin > is referenced directly when a logical replication slot is created. +> [!IMPORTANT] +> `output_plugin_libraries` does not exist before PostgreSQL 18.6. Setting it +> on an older 18.x image is **not** harmless: PostgreSQL treats the unknown +> parameter as a configuration error and the instance **fails to start** +> (`FATAL: configuration file "postgresql.conf" contains errors`). Only set +> this parameter if your image is pinned to PostgreSQL 18.6 or later. + ### 2. Create a logical replication slot using `wal2json` Once the cluster is ready, connect to the database with `psql` and create a diff --git a/wal2json/metadata.hcl b/wal2json/metadata.hcl index 26c3443a..d5229743 100644 --- a/wal2json/metadata.hcl +++ b/wal2json/metadata.hcl @@ -6,7 +6,9 @@ metadata = { image_name = "wal2json" licenses = ["BSD-3-Clause"] shared_preload_libraries = [] - postgresql_parameters = {} + postgresql_parameters = { + output_plugin_libraries = "pgoutput, test_decoding, wal2json" + } extension_control_path = [] dynamic_library_path = [] ld_library_path = [] From 7b55756c27cb0a2063d098a7ecb4cde42cdac289 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 11:57:56 +1000 Subject: [PATCH 63/76] chore(deps): update dependency postgresql-18-timescaledb (#320) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.1+dfsg-1.pgdg12+1` → `2.29.1+dfsg-2.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.1+dfsg-1.pgdg13+1` → `2.29.1+dfsg-2.pgdg13+1` | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/metadata.hcl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index 619cbe8f..f31f8ce7 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,7 +20,7 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.29.1+dfsg-1.pgdg13+1" + package = "2.29.1+dfsg-2.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) sql = "2.29.1" } @@ -28,7 +28,7 @@ metadata = { bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.29.1+dfsg-1.pgdg12+1" + package = "2.29.1+dfsg-2.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) sql = "2.29.1" } From 4cb1bd8cb47a8f028ba720ceedd46c7860613c32 Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Tue, 18 Aug 2026 18:38:00 +1000 Subject: [PATCH 64/76] chore: add SECURITY-INSIGHTS.yml (#307) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a `SECURITY-INSIGHTS.yml` for this repo, modeled on [cloudnative-pg/postgres-containers's file](https://github.com/cloudnative-pg/postgres-containers/blob/main/SECURITY-INSIGHTS.yml): repository-scoped, pointing back to the main project's file via `header.project-si-source`, with this repo's own core-team (matching `cloudnative-pg/cnpg-infra`'s `repo-tiers.yaml` owners), license, release distribution points, and security tooling — verified against this repo's actual CI workflows and repo settings rather than copied from another repo. Part of extending `SECURITY-INSIGHTS.yml` coverage to every Class A repo (see `cnpg-infra/repo-tiers.yaml`), starting with this one. Assisted-by: Claude Signed-off-by: Niccolò Fei Co-authored-by: Niccolò Fei --- .../PULL_REQUEST_TEMPLATE/new_extension.md | 5 + CONTRIBUTING_NEW_EXTENSION.md | 4 + SECURITY-INSIGHTS.yml | 125 ++++++++++++++++++ 3 files changed, 134 insertions(+) create mode 100644 SECURITY-INSIGHTS.yml diff --git a/.github/PULL_REQUEST_TEMPLATE/new_extension.md b/.github/PULL_REQUEST_TEMPLATE/new_extension.md index 44c86004..26e886a0 100644 --- a/.github/PULL_REQUEST_TEMPLATE/new_extension.md +++ b/.github/PULL_REQUEST_TEMPLATE/new_extension.md @@ -52,6 +52,9 @@ Closes # - [ ] An entry for the new extension folder was added to [`CODEOWNERS`](https://github.com/cloudnative-pg/postgres-extensions-containers/blob/main/CODEOWNERS) with the component owner's GitHub handle(s). +- [ ] A `distribution-points` entry for the new image was added under + `repository.release` in + [`SECURITY-INSIGHTS.yml`](https://github.com/cloudnative-pg/postgres-extensions-containers/blob/main/SECURITY-INSIGHTS.yml). - [ ] I confirm my commitment to maintain this extension on behalf of the CloudNativePG community. @@ -84,4 +87,6 @@ Closes # when `create_extension = true`) are valid. - [ ] `CODEOWNERS` entry is present and the component owner(s) accept the long-term maintenance commitment. +- [ ] `SECURITY-INSIGHTS.yml` has a matching `distribution-points` entry for + the new image. - [ ] PR targets `main` and is ready to merge. diff --git a/CONTRIBUTING_NEW_EXTENSION.md b/CONTRIBUTING_NEW_EXTENSION.md index 9b767696..0b20959c 100644 --- a/CONTRIBUTING_NEW_EXTENSION.md +++ b/CONTRIBUTING_NEW_EXTENSION.md @@ -301,6 +301,10 @@ Submission Requirements: - **CODEOWNERS**: The PR must add an entry to the [`CODEOWNERS`](./CODEOWNERS) file listing the GitHub handles of the component owner(s) for the new extension folder. +- **SECURITY-INSIGHTS.yml**: The PR must add a `distribution-points` entry for + the new image under `repository.release` in + [`SECURITY-INSIGHTS.yml`](./SECURITY-INSIGHTS.yml), pointing to its GitHub + Packages page (using the `image_name` from `metadata.hcl`). > [!IMPORTANT] > When opening the Pull Request, use the **new extension** template, which diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml new file mode 100644 index 00000000..e6481445 --- /dev/null +++ b/SECURITY-INSIGHTS.yml @@ -0,0 +1,125 @@ +header: + schema-version: 2.2.0 + last-updated: '2026-08-04' + last-reviewed: '2026-08-04' + url: https://raw.githubusercontent.com/cloudnative-pg/postgres-extensions-containers/main/SECURITY-INSIGHTS.yml + # reference the main SECURITY-INSIGHTS file from CNPG repo + project-si-source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/SECURITY-INSIGHTS.yml + +repository: + url: https://github.com/cloudnative-pg/postgres-extensions-containers + status: active + accepts-change-request: true + accepts-automated-change-request: true + no-third-party-packages: false + core-team: + - name: Gabriele Bartolini + email: gabriele.bartolini@enterprisedb.com + primary: true + - name: Leonardo Cecchi + email: leonardo.cecchi@enterprisedb.com + primary: false + - name: Marco Nenciarini + email: marco.nenciarini@enterprisedb.com + primary: false + - name: Francesco Canovai + email: francesco.canovai@enterprisedb.com + primary: false + - name: Armando Ruocco + email: armando.ruocco@enterprisedb.com + primary: false + - name: Niccolò Fei + email: niccolo.fei@enterprisedb.com + primary: false + - name: Gabriele Fedi + email: gabriele.fedi@enterprisedb.com + primary: false + license: + url: https://www.apache.org/licenses/LICENSE-2.0 + expression: Apache-2.0 + + release: + automated-pipeline: true + distribution-points: + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgvector + comment: GitHub packages for the pgvector extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/postgis-extension + comment: GitHub packages for the PostGIS extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgaudit + comment: GitHub packages for the pgaudit extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-ivm + comment: GitHub packages for the pg_ivm extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-crash + comment: GitHub packages for the pg_crash extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/timescaledb-oss + comment: GitHub packages for the TimescaleDB (OSS) extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/wal2json + comment: GitHub packages for the wal2json extension image + + security: + tools: + - name: Dependabot + type: SCA + rulesets: ["default"] + results: {} + integration: + adhoc: true + ci: false + release: false + - name: Renovate + type: SCA + rulesets: ["default"] + results: {} + integration: + adhoc: true + ci: true + release: false + - name: Snyk + type: container + rulesets: ["default"] + results: {} + comment: Scans container images for known vulnerabilities. + integration: + adhoc: false + ci: true + release: true + - name: Cosign + type: container + rulesets: ["default"] + results: {} + comment: Used to cryptographically sign container images. + integration: + adhoc: false + ci: true + release: true + - name: CodeQL + type: SAST + rulesets: ["default"] + results: {} + comment: GitHub's default CodeQL setup; analyzes Go and GitHub Actions workflow code on pull requests and pushes to main. + integration: + adhoc: false + ci: true + release: false + - name: GitHub Code Scanning + type: SAST + rulesets: ["default"] + results: {} + comment: Ingests SARIF results from Snyk for integrated GitHub security alerts. + integration: + adhoc: false + ci: true + release: true + - name: Dockle + type: container + rulesets: ["default"] + results: {} + comment: Container image linter enforcing CIS Docker Benchmark best practices; fails the build on any warning. + integration: + adhoc: false + ci: true + release: true + + assessments: + self: + comment: Refer to the main project. From 819f0d77b19ea94616e90b21f4e83e4bd1db31ec Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 11:30:10 +0200 Subject: [PATCH 65/76] chore(deps): update alpine/psql:18.4 docker digest to 0ab0d12 (#317) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pg-ivm/test/check-extension.yaml | 2 +- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml index 117457d2..794dc57c 100644 --- a/pg-ivm/test/check-extension.yaml +++ b/pg-ivm/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa + image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae command: ['sh', '-c'] args: - | diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index e5021d23..b7c9ec0b 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa + image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index cb2faac5..13451595 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa + image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index 00deaba5..a0e76fee 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa + image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 116cf796..7f5d78b0 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:f4c295e0bc50a0502265839db49f4b05f2c8005209c22e6337cf8822cebe73aa + image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae command: ['sh', '-c'] args: - | From da3e4f66173a0e9e23a43dda8bdf648743707e69 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 11:44:11 +0200 Subject: [PATCH 66/76] chore(deps): update alpine/kubectl:1.36.3 docker digest to dae2611 (#316) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index f10de84e..05bf4b38 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.3@sha256:5d380d18d2509483aef3df54d676c767d798d55ec9f3e02dabfa4c88fe6559bd + KUBECTL_VERSION: 1.36.3@sha256:dae261106d5555008acede256b7102c8a6decde7209198434f5999f051460f57 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From c1aaeb8d0373d480e314d52d9b8129fba22b53eb Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 11:54:02 +0200 Subject: [PATCH 67/76] chore(deps): update go-task/setup-task action to v2.2.0 (#313) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index af8cdf3f..dc705da1 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -147,7 +147,7 @@ jobs: persist-credentials: false - name: Install Task - uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 + uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 - name: Install Dagger env: From f111f59c3d57fe2c14eb03e9374da0f38f88c61b Mon Sep 17 00:00:00 2001 From: Oliver Falk Date: Wed, 19 Aug 2026 02:06:37 +0200 Subject: [PATCH 68/76] feat: add `pgrouting` container image (#299) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the `pgrouting` extension container image for CloudNativePG, which supports the pgRouting extension for PostGIS (pgrouting.org). The extension image depends on the `postgis` one. Despite the GNU GPL 2.0 license, the extension has been accepted in this project, as it was already available in the previous PostGIS standalone images (predating the CNCF Sandbox admission). Closes #300 Signed-off-by: Oliver Falk Signed-off-by: Gabriele Fedi Signed-off-by: Niccolò Fei Signed-off-by: Gabriele Bartolini Co-authored-by: Gabriele Fedi Co-authored-by: Niccolò Fei Co-authored-by: Gabriele Bartolini --- README.md | 7 +- SECURITY-INSIGHTS.yml | 2 + pgrouting/Dockerfile | 30 ++++++ pgrouting/README.md | 107 +++++++++++++++++++++ pgrouting/metadata.hcl | 37 +++++++ pgrouting/test/chainsaw-test.yaml | 28 ++++++ pgrouting/test/check-extension-assert.yaml | 6 ++ pgrouting/test/check-extension.yaml | 34 +++++++ pgrouting/test/cluster-assert.yaml | 8 ++ pgrouting/test/cluster.yaml | 15 +++ pgrouting/test/database-assert.yaml | 5 + pgrouting/test/database.yaml | 10 ++ 12 files changed, 286 insertions(+), 3 deletions(-) create mode 100644 pgrouting/Dockerfile create mode 100644 pgrouting/README.md create mode 100644 pgrouting/metadata.hcl create mode 100644 pgrouting/test/chainsaw-test.yaml create mode 100644 pgrouting/test/check-extension-assert.yaml create mode 100644 pgrouting/test/check-extension.yaml create mode 100644 pgrouting/test/cluster-assert.yaml create mode 100644 pgrouting/test/cluster.yaml create mode 100644 pgrouting/test/database-assert.yaml create mode 100644 pgrouting/test/database.yaml diff --git a/README.md b/README.md index 9d47142f..db2b64e1 100644 --- a/README.md +++ b/README.md @@ -39,15 +39,16 @@ from a trusted, auditable repository | **[pgAudit](pgaudit)** | PostgreSQL audit extension | [github.com/pgaudit/pgaudit](https://github.com/pgaudit/pgaudit) | CNPG maintainers | | **[pg_crash](pg-crash)** | **Disruptive** fault injection and chaos engineering extension | [github.com/cybertec-postgresql/pg_crash](https://github.com/cybertec-postgresql/pg_crash) | CNPG maintainers | | **[pg_ivm](pg-ivm)** | Incremental View Maintenance for PostgreSQL | [github.com/sraoss/pg_ivm](https://github.com/sraoss/pg_ivm) | @shusaan | +| **[pgRouting](pgrouting)** | Geospatial routing and network analysis for PostgreSQL/PostGIS | [pgrouting.org](https://pgrouting.org/) | CNPG maintainers | | **[pgvector](pgvector)** | Vector similarity search for PostgreSQL | [github.com/pgvector/pgvector](https://github.com/pgvector/pgvector) | CNPG maintainers | | **[PostGIS](postgis)** | Geospatial database extension for PostgreSQL | [postgis.net/](https://postgis.net/) | CNPG maintainers | | **[TimescaleDB Apache-2 Edition](timescaledb-oss)** | Time-series database for PostgreSQL (open source version) | [github.com/timescale/timescaledb/](https://github.com/timescale/timescaledb/) | @shusaan | | **[wal2json](wal2json)** | Logical decoding output plugin for PostgreSQL | [github.com/eulerto/wal2json](https://github.com/eulerto/wal2json) | @solidDoWant | > [!NOTE] -> PostGIS is licensed under GPL-2.0, which is not on the CNCF Allowlist. It -> predates this policy; the maintainers are filing a CNCF license exception -> for it. PostGIS is not a precedent for accepting further non-Allowlisted +> PostGIS and pgRouting are licensed under GPL-2.0, which is not on the CNCF Allowlist. +> They predate this policy; the maintainers are filing a CNCF license exception +> for them. They are not a precedent for accepting further non-Allowlisted > extensions. Extensions are provided only for the OS versions already built by the diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml index e6481445..2bddb2e7 100644 --- a/SECURITY-INSIGHTS.yml +++ b/SECURITY-INSIGHTS.yml @@ -45,6 +45,8 @@ repository: comment: GitHub packages for the pgvector extension image - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/postgis-extension comment: GitHub packages for the PostGIS extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgrouting + comment: GitHub packages for the pgrouting extension image - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgaudit comment: GitHub packages for the pgaudit extension image - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-ivm diff --git a/pgrouting/Dockerfile b/pgrouting/Dockerfile new file mode 100644 index 00000000..a4be5140 --- /dev/null +++ b/pgrouting/Dockerfile @@ -0,0 +1,30 @@ +# SPDX-FileCopyrightText: Copyright © contributors to CloudNativePG, established as CloudNativePG a Series of LF Projects, LLC. +# SPDX-License-Identifier: Apache-2.0 + +ARG BASE=ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie +FROM $BASE AS builder + +ARG PG_MAJOR +ARG EXT_VERSION + +USER 0 + +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + "postgresql-${PG_MAJOR}-pgrouting=${EXT_VERSION}" \ + "postgresql-${PG_MAJOR}-pgrouting-scripts=${EXT_VERSION}" + +FROM scratch +ARG PG_MAJOR + +# Licenses +COPY --from=builder /usr/share/doc/postgresql-${PG_MAJOR}-pgrouting/copyright /licenses/postgresql-${PG_MAJOR}-pgrouting/ + +# Libraries +COPY --from=builder /usr/lib/postgresql/${PG_MAJOR}/lib/libpgrouting* /lib/ +COPY --from=builder /usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/ /lib/bitcode/ + +# Share +COPY --from=builder /usr/share/postgresql/${PG_MAJOR}/extension/pgrouting* /share/extension/ + +USER 65532:65532 diff --git a/pgrouting/README.md b/pgrouting/README.md new file mode 100644 index 00000000..9be3ca2a --- /dev/null +++ b/pgrouting/README.md @@ -0,0 +1,107 @@ +# pgRouting + + +[pgRouting](https://pgrouting.org/) extends the +[PostGIS](https://postgis.net/)/PostgreSQL geospatial database to provide +geospatial routing and other network analysis functionality. + +This image provides a convenient way to deploy and manage `pgRouting` with +[CloudNativePG](https://cloudnative-pg.io/). + +> [!NOTE] +> `pgRouting` depends on `PostGIS`. When deploying `pgRouting`, you must also +> include the `postgis` extension image in your Cluster definition. + +## Usage + +### 1. Add the pgRouting and PostGIS extension images to your Cluster + +Define the `postgis` and `pgrouting` extensions under the +`postgresql.extensions` section of your `Cluster` resource. For example: + +```yaml +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: cluster-pgrouting +spec: + imageName: ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie + instances: 1 + + storage: + size: 1Gi + + postgresql: + extensions: + - name: postgis + image: + # renovate: suite=trixie-pgdg depName=postgresql-18-postgis-3 + reference: ghcr.io/cloudnative-pg/postgis-extension:3.6.4-18-trixie + ld_library_path: + - system + env: + - name: GDAL_DATA + value: ${image_root}/share/gdal + - name: PROJ_DATA + value: ${image_root}/share/proj + - name: pgrouting + image: + # renovate: suite=trixie-pgdg depName=postgresql-18-pgrouting + reference: ghcr.io/cloudnative-pg/pgrouting:4.0.1-18-trixie +``` + +### 2. Enable the extension in a database + +You can install `pgrouting` in a specific database by creating or updating a +`Database` resource: + +```yaml +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: cluster-pgrouting-app +spec: + name: app + owner: app + cluster: + name: cluster-pgrouting + extensions: + - name: postgis + # renovate: suite=trixie-pgdg depName=postgresql-18-postgis-3 extractVersion=^(?\d+\.\d+\.\d+) + version: '3.6.4' + - name: pgrouting + # renovate: suite=trixie-pgdg depName=postgresql-18-pgrouting extractVersion=^(?\d+\.\d+\.\d+) + version: '4.0.1' +``` + +### 3. Verify installation + +Once the database is ready, connect to it with `psql` and run: + +```sql +\dx +``` + +You should see `postgis` and `pgrouting` listed among the installed extensions. + +--- + +## Licenses and Copyright + +`pgRouting`: + +- **Copyright:** pgRouting Contributors +- **License:** GNU General Public License v2.0 or later (`GPL-2.0-or-later`) + +All relevant license and copyright information for the `pgrouting` extension +and its dependencies are bundled within the image at: + +```text +/licenses/ +``` + +By using this image, you agree to comply with the terms of the licenses +contained therein. diff --git a/pgrouting/metadata.hcl b/pgrouting/metadata.hcl new file mode 100644 index 00000000..fd78d500 --- /dev/null +++ b/pgrouting/metadata.hcl @@ -0,0 +1,37 @@ +# SPDX-FileCopyrightText: Copyright © contributors to CloudNativePG, established as CloudNativePG a Series of LF Projects, LLC. +# SPDX-License-Identifier: Apache-2.0 +metadata = { + name = "pgrouting" + sql_name = "pgrouting" + image_name = "pgrouting" + licenses = ["GPL-2.0-or-later"] + shared_preload_libraries = [] + postgresql_parameters = {} + extension_control_path = [] + dynamic_library_path = [] + ld_library_path = [] + bin_path = [] + env = {} + auto_update_os_libs = false + required_extensions = ["postgis"] + create_extension = true + + versions = { + bookworm = { + "18" = { + // renovate: suite=bookworm-pgdg depName=postgresql-18-pgrouting + package = "4.0.1-1.pgdg12+1" + // renovate: suite=bookworm-pgdg depName=postgresql-18-pgrouting extractVersion=^(?\d+\.\d+\.\d+) + sql = "4.0.1" + } + } + trixie = { + "18" = { + // renovate: suite=trixie-pgdg depName=postgresql-18-pgrouting + package = "4.0.1-1.pgdg13+1" + // renovate: suite=trixie-pgdg depName=postgresql-18-pgrouting extractVersion=^(?\d+\.\d+\.\d+) + sql = "4.0.1" + } + } + } +} diff --git a/pgrouting/test/chainsaw-test.yaml b/pgrouting/test/chainsaw-test.yaml new file mode 100644 index 00000000..44d17ee7 --- /dev/null +++ b/pgrouting/test/chainsaw-test.yaml @@ -0,0 +1,28 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: verify-pgrouting-extension +spec: + timeouts: + apply: 5s + assert: 3m + delete: 30s + description: Verify pgrouting extension is properly installed + steps: + - name: Create a Cluster with the extension + try: + - apply: + file: cluster.yaml + - apply: + file: database.yaml + - assert: + file: cluster-assert.yaml + - assert: + file: database-assert.yaml + + - name: Verify extension is installed + try: + - apply: + file: check-extension.yaml + - assert: + file: check-extension-assert.yaml diff --git a/pgrouting/test/check-extension-assert.yaml b/pgrouting/test/check-extension-assert.yaml new file mode 100644 index 00000000..a7971fc7 --- /dev/null +++ b/pgrouting/test/check-extension-assert.yaml @@ -0,0 +1,6 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: extension-installed +status: + succeeded: 1 diff --git a/pgrouting/test/check-extension.yaml b/pgrouting/test/check-extension.yaml new file mode 100644 index 00000000..2ddc0fb0 --- /dev/null +++ b/pgrouting/test/check-extension.yaml @@ -0,0 +1,34 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: extension-installed +spec: + template: + spec: + restartPolicy: OnFailure + containers: + - name: data-test + env: + - name: EXT_VERSION + value: ($values.version) + - name: DB_URI + valueFrom: + secretKeyRef: + name: (join('-', [$values.name, 'app'])) + key: uri + # renovate: datasource=docker depName=alpine/psql versioning=docker + image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + command: ['sh', '-c'] + args: + - | + set -e + DB_URI=$(echo $DB_URI | sed "s|/\*|/|") + test "$(psql "$DB_URI" -tAc "SELECT EXISTS (SELECT FROM pg_catalog.pg_extension WHERE extname = 'postgis')" -q)" = "t" + test "$(psql "$DB_URI" -tAc "SELECT EXISTS (SELECT FROM pg_catalog.pg_extension WHERE extname = 'pgrouting' AND extversion = '${EXT_VERSION}')" -q)" = "t" + psql "$DB_URI" -c "DROP TABLE IF EXISTS pgrouting_edges CASCADE;" + psql "$DB_URI" -c "CREATE TABLE pgrouting_edges (id BIGSERIAL PRIMARY KEY, source BIGINT, target BIGINT, cost DOUBLE PRECISION, reverse_cost DOUBLE PRECISION);" + psql "$DB_URI" -c "INSERT INTO pgrouting_edges (source, target, cost, reverse_cost) VALUES (1, 2, 1, 1), (2, 3, 1, 1), (3, 4, 1, 1), (1, 4, 5, 5);" + # The cheapest route from node 1 to node 4 is 1 -> 2 -> 3 -> 4 (cost 3), + # not the direct edge 1 -> 4 (cost 5). + test "$(psql "$DB_URI" -tAc "SELECT string_agg(node::text, ',' ORDER BY path_seq) FROM pgr_dijkstra('SELECT id, source, target, cost, reverse_cost FROM pgrouting_edges', 1, 4)" -q)" = "1,2,3,4" + test "$(psql "$DB_URI" -tAc "SELECT max(agg_cost) FROM pgr_dijkstra('SELECT id, source, target, cost, reverse_cost FROM pgrouting_edges', 1, 4)" -q)" = "3" diff --git a/pgrouting/test/cluster-assert.yaml b/pgrouting/test/cluster-assert.yaml new file mode 100644 index 00000000..e6420cef --- /dev/null +++ b/pgrouting/test/cluster-assert.yaml @@ -0,0 +1,8 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: ($values.name) +status: + instances: 1 + readyInstances: 1 + phase: Cluster in healthy state diff --git a/pgrouting/test/cluster.yaml b/pgrouting/test/cluster.yaml new file mode 100644 index 00000000..48d6fe06 --- /dev/null +++ b/pgrouting/test/cluster.yaml @@ -0,0 +1,15 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: ($values.name) +spec: + imageName: ($values.pg_image) + instances: 1 + + storage: + size: 1Gi + + postgresql: + parameters: ($values.postgresql_parameters) + shared_preload_libraries: ($values.shared_preload_libraries) + extensions: ($values.extensions) diff --git a/pgrouting/test/database-assert.yaml b/pgrouting/test/database-assert.yaml new file mode 100644 index 00000000..9417b87b --- /dev/null +++ b/pgrouting/test/database-assert.yaml @@ -0,0 +1,5 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: (join('-', [$values.name, 'app'])) +status: ($values.database_assert_status) diff --git a/pgrouting/test/database.yaml b/pgrouting/test/database.yaml new file mode 100644 index 00000000..2d6810c2 --- /dev/null +++ b/pgrouting/test/database.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: (join('-', [$values.name, 'app'])) +spec: + name: app + owner: app + cluster: + name: ($values.name) + extensions: ($values.database_config.extensions_spec) From a8899661e521a056620dfec561dbad45a523daef Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 16:12:38 +0200 Subject: [PATCH 69/76] chore(deps): update docker/setup-buildx-action digest to 37fe631 (#322) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake_targets.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index dc705da1..a787372b 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -44,7 +44,7 @@ jobs: platforms: 'linux/arm64' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Build and push uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7 From 079bc9e7d8fd8b38595499fdf24a46943fe09ca8 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 10:26:57 +0000 Subject: [PATCH 70/76] chore(deps): update dependency postgresql-18-timescaledb (#323) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.1` → `2.29.2` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.1+dfsg-2.pgdg12+1` → `2.29.2+dfsg-1.pgdg12+1` | | [postgresql-18-timescaledb](https://redirect.github.com/timescale/timescaledb) | patch | `2.29.1+dfsg-2.pgdg13+1` → `2.29.2+dfsg-1.pgdg13+1` | --- ### Release Notes
timescale/timescaledb (postgresql-18-timescaledb) ### [`v2.29.2`](https://redirect.github.com/timescale/timescaledb/blob/HEAD/CHANGELOG.md#2292-2026-08-18) [Compare Source](https://redirect.github.com/timescale/timescaledb/compare/2.29.1...2.29.2) This release contains bug fixes since the 2.29.1 release. We recommend that you upgrade at the next available opportunity. **Bugfixes** - [#​10189](https://redirect.github.com/timescale/timescaledb/pull/10189) Fix user-defined functions named `time_bucket` causing SQLSTATE `XX000` - [#​10363](https://redirect.github.com/timescale/timescaledb/pull/10363) Fix `time_bucket_gapfill()` with window aggregates over constants - [#​10416](https://redirect.github.com/timescale/timescaledb/pull/10416) Repair mismatched dimensional `CHECK` constraints - [#​10423](https://redirect.github.com/timescale/timescaledb/pull/10423) Fix compressed `SkipScan` dropping uncompressed rows when sort keys do not match distinct keys - [#​10430](https://redirect.github.com/timescale/timescaledb/pull/10430) Do not attach `SkipScan` to mismatched `IndexScan` paths under `MergeAppend` - [#​9921](https://redirect.github.com/timescale/timescaledb/pull/9921) Fix wrong results for `IS NULL` predicates with min/max sparse-index pushdown **Thanks** - [@​borisborelly](https://redirect.github.com/borisborelly) for reporting incorrect results with `COUNT(DISTINCT)` due to `SkipScan` dropping uncompressed rows.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cloudnative-pg/postgres-extensions-containers). Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- timescaledb-oss/README.md | 4 ++-- timescaledb-oss/metadata.hcl | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/timescaledb-oss/README.md b/timescaledb-oss/README.md index f6bf3a78..a271c3bb 100644 --- a/timescaledb-oss/README.md +++ b/timescaledb-oss/README.md @@ -47,7 +47,7 @@ spec: - name: timescaledb-oss image: # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.29.1-18-trixie + reference: ghcr.io/cloudnative-pg/timescaledb-oss:2.29.2-18-trixie ``` ### 2. Enable the extension in a database @@ -68,7 +68,7 @@ spec: extensions: - name: timescaledb # renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - version: '2.29.1' + version: '2.29.2' ``` ### 3. Verify installation diff --git a/timescaledb-oss/metadata.hcl b/timescaledb-oss/metadata.hcl index f31f8ce7..a2cf76e7 100644 --- a/timescaledb-oss/metadata.hcl +++ b/timescaledb-oss/metadata.hcl @@ -20,17 +20,17 @@ metadata = { trixie = { "18" = { // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb - package = "2.29.1+dfsg-2.pgdg13+1" + package = "2.29.2+dfsg-1.pgdg13+1" // renovate: suite=trixie-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.29.1" + sql = "2.29.2" } } bookworm = { "18" = { // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb - package = "2.29.1+dfsg-2.pgdg12+1" + package = "2.29.2+dfsg-1.pgdg12+1" // renovate: suite=bookworm-pgdg depName=postgresql-18-timescaledb extractVersion=^(?\d+\.\d+\.\d+) - sql = "2.29.1" + sql = "2.29.2" } } } From 7d15ca698cd7d57b1be65972cb37aa3cc50e56f6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:55:34 +0200 Subject: [PATCH 71/76] chore(deps): update alpine/psql docker tag to v18.6 (#325) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- pg-ivm/test/check-extension.yaml | 2 +- pgrouting/test/check-extension.yaml | 2 +- postgis/test/check-extension.yaml | 2 +- test/check-extension.yaml | 2 +- timescaledb-oss/test/check-extension.yaml | 2 +- wal2json/test/check-slot.yaml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pg-ivm/test/check-extension.yaml b/pg-ivm/test/check-extension.yaml index 794dc57c..b5575563 100644 --- a/pg-ivm/test/check-extension.yaml +++ b/pg-ivm/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae + image: alpine/psql:18.6@sha256:6467c8eef6468296b45613cfc31d4b4524d77cdc9cbcf4608fe5a89ebddd83c7 command: ['sh', '-c'] args: - | diff --git a/pgrouting/test/check-extension.yaml b/pgrouting/test/check-extension.yaml index 2ddc0fb0..ab3a3f3c 100644 --- a/pgrouting/test/check-extension.yaml +++ b/pgrouting/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:b3e4fc061da067813ddc5a8844b1992a50d5f1dce72d46be8ee5d0b964a3e894 + image: alpine/psql:18.6@sha256:6467c8eef6468296b45613cfc31d4b4524d77cdc9cbcf4608fe5a89ebddd83c7 command: ['sh', '-c'] args: - | diff --git a/postgis/test/check-extension.yaml b/postgis/test/check-extension.yaml index b7c9ec0b..a06da955 100644 --- a/postgis/test/check-extension.yaml +++ b/postgis/test/check-extension.yaml @@ -20,7 +20,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae + image: alpine/psql:18.6@sha256:6467c8eef6468296b45613cfc31d4b4524d77cdc9cbcf4608fe5a89ebddd83c7 command: ['sh', '-c'] args: - | diff --git a/test/check-extension.yaml b/test/check-extension.yaml index 13451595..06c879f5 100644 --- a/test/check-extension.yaml +++ b/test/check-extension.yaml @@ -24,7 +24,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae + image: alpine/psql:18.6@sha256:6467c8eef6468296b45613cfc31d4b4524d77cdc9cbcf4608fe5a89ebddd83c7 command: ['sh', '-c'] args: - | diff --git a/timescaledb-oss/test/check-extension.yaml b/timescaledb-oss/test/check-extension.yaml index a0e76fee..6eb71fb4 100644 --- a/timescaledb-oss/test/check-extension.yaml +++ b/timescaledb-oss/test/check-extension.yaml @@ -17,7 +17,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae + image: alpine/psql:18.6@sha256:6467c8eef6468296b45613cfc31d4b4524d77cdc9cbcf4608fe5a89ebddd83c7 command: ['sh', '-c'] args: - | diff --git a/wal2json/test/check-slot.yaml b/wal2json/test/check-slot.yaml index 7f5d78b0..3c8877d2 100644 --- a/wal2json/test/check-slot.yaml +++ b/wal2json/test/check-slot.yaml @@ -15,7 +15,7 @@ spec: name: (join('-', [$values.name, 'app'])) key: uri # renovate: datasource=docker depName=alpine/psql versioning=docker - image: alpine/psql:18.4@sha256:0ab0d128bcf0c63c4b022cf34bce59bd77f6d7e52411b3730fa840e2e79415ae + image: alpine/psql:18.6@sha256:6467c8eef6468296b45613cfc31d4b4524d77cdc9cbcf4608fe5a89ebddd83c7 command: ['sh', '-c'] args: - | From c296c5d62c8f0dab0c2a2f4029f4e35b8624946c Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:22:35 +0200 Subject: [PATCH 72/76] chore(deps): update alpine/kubectl docker tag to v1.36.4 (#324) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 05bf4b38..301e5d10 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -284,7 +284,7 @@ tasks: vars: CNPG_RELEASE: '{{ .CNPG_RELEASE | default .CNPG_RELEASE_DEFAULT }}' # renovate: datasource=docker depName=alpine/kubectl versioning=docker - KUBECTL_VERSION: 1.36.3@sha256:dae261106d5555008acede256b7102c8a6decde7209198434f5999f051460f57 + KUBECTL_VERSION: 1.36.4@sha256:a2cd8ee034cbe04d651e565b3373299b31921de5c2af86490559e21b3e197808 DOCKER_SOCKET: sh: docker context inspect -f {{`'{{json .Endpoints.docker.Host}}'`}} $(docker context show) CNPG_MANIFEST: From 89916b06e582a76df58580ccae5bfd41d6cd12ef Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:37:22 +0200 Subject: [PATCH 73/76] chore(deps): update endbug/add-and-commit action to v11 (#312) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/update-catalogs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index 8312210f..4a85ab0c 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -63,7 +63,7 @@ jobs: git status git diff --staged - - uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10 + - uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11 if: github.ref == 'refs/heads/main' with: cwd: 'artifacts' From 1fe50c79116afa459455075a05505b24f83a8791 Mon Sep 17 00:00:00 2001 From: Peggie Date: Mon, 24 Aug 2026 17:38:07 +0200 Subject: [PATCH 74/76] chore: update postgis OS libraries (#302) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: extension-os-libs-updater --- postgis/system-libs/18-bookworm-os-libs.txt | 6 +++--- postgis/system-libs/18-trixie-os-libs.txt | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/postgis/system-libs/18-bookworm-os-libs.txt b/postgis/system-libs/18-bookworm-os-libs.txt index 852501ce..8bd9c356 100644 --- a/postgis/system-libs/18-bookworm-os-libs.txt +++ b/postgis/system-libs/18-bookworm-os-libs.txt @@ -1,3 +1,4 @@ +libproj25_9.8.1-1.pgdg12+1_amd64.deb MD5Sum:f8da9be2155f5a922aabee8c3df0e36d libaec0_1.0.6-1+b1_amd64.deb MD5Sum:42611bf8032dad2d74c26d8dc084d322 libaom3_3.6.0-1+deb12u2_amd64.deb MD5Sum:faae50e521d9a6f39d96953961a2b1f9 libblas3_3.11.0-2_amd64.deb MD5Sum:b39744800600a80ae852251a16c03d09 @@ -34,7 +35,6 @@ libjpeg62-turbo_1%3a2.1.5-2_amd64.deb MD5Sum:c43c12e2144cad5b82c10d63dcc57ecd liblerc4_4.0.0+ds-2_amd64.deb MD5Sum:100ad75d6812ac853407f24c40076b02 libwebp7_1.2.4-0.2+deb12u1_amd64.deb MD5Sum:19f6c9801f036b0615b9bf650c3ee1fa libtiff6_4.5.0-6+deb12u4_amd64.deb MD5Sum:f283ac0d100dc6a749470b06e3908a8a -libproj25_9.1.1-1+b1_amd64.deb MD5Sum:c21fd1eb543b730bbb79ef8d0144b3d1 libgeotiff5_1.7.1-2+b1_amd64.deb MD5Sum:31740ac80f3b6d2fe054ae61de84fb29 libgif7_5.2.1-2.5+deb12u1_amd64.deb MD5Sum:63cf3dd05c8f28e6ab6559567b2e4ff0 libtirpc-common_1.3.3+ds-1_all.deb MD5Sum:e49aca93814724ed80fa8932a1f7523b @@ -60,8 +60,8 @@ libogdi4.1_4.1.0+ds-6_amd64.deb MD5Sum:bca573b90eb2ef8e6fa4c7ab66c77927 libopenjp2-7_2.5.0-2+deb12u3_amd64.deb MD5Sum:bb7b72ae72a38620bed002a063d5dc64 liblcms2-2_2.14-2+deb12u1_amd64.deb MD5Sum:4a701d009079104e62992b219cee5f6e libnspr4_2%3a4.35-1_amd64.deb MD5Sum:1f8e0fda3f2527e0051768abd071c2fe -libnss3_2%3a3.87.1-1+deb12u3_amd64.deb -libpoppler126_22.12.0-2+deb12u2_amd64.deb MD5Sum:23886480fe5be6b0c6fe09059318aba8 +libnss3_2%3a3.87.1-1+deb12u4_amd64.deb +libpoppler126_22.12.0-2+deb12u3_amd64.deb libqhull-r8.0_2020.2-5_amd64.deb MD5Sum:781260a36cd4d65a86fc349f26b68338 librttopo1_1.1.0-3_amd64.deb MD5Sum:901bfdc1a4a806d1c9be972018d65368 libspatialite7_5.0.1-3_amd64.deb MD5Sum:fb95bb6433ea0a15f712372b1afcf3b5 diff --git a/postgis/system-libs/18-trixie-os-libs.txt b/postgis/system-libs/18-trixie-os-libs.txt index 9d2179c7..ab82488a 100644 --- a/postgis/system-libs/18-trixie-os-libs.txt +++ b/postgis/system-libs/18-trixie-os-libs.txt @@ -1,7 +1,10 @@ -libexpat1_2.7.1-2_amd64.deb MD5Sum:f679d79b2aaecfcb335274627a04960c +libgeos3.14.1_3.14.1-2.pgdg13+1_amd64.deb MD5Sum:3c0161d4f18f24da299404f32188a903 +libgeos-c1t64_3.14.1-2.pgdg13+1_amd64.deb MD5Sum:f87ea7eaba21a1838ada9b919ff43b85 +libproj25_9.8.1-1.pgdg13+1_amd64.deb MD5Sum:b05785ac306398548ca253b583cea45e +libexpat1_2.8.3-1~deb13u1_amd64.deb libabsl20240722_20240722.0-4_amd64.deb MD5Sum:5407414647aace5e70314f16ff0aeb99 libaec0_1.1.3-1+b1_amd64.deb MD5Sum:883972a56ece3b4d19cb9c220dbfeafc -libaom3_3.12.1-1_amd64.deb MD5Sum:c7dffeadfdb1999123bdbf14b3e91253 +libaom3_3.12.1-1+deb13u1_amd64.deb libblas3_3.12.1-6_amd64.deb MD5Sum:009269addf607682ff0a0def1acfbafe libgfortran5_14.2.0-19_amd64.deb MD5Sum:4aa25c9245458f20151c1fa228d9209c liblapack3_3.12.1-6_amd64.deb MD5Sum:070d94c9032ed79d6d1a7a3b992ac78c @@ -28,7 +31,7 @@ libssh2-1t64_1.11.1-1+deb13u1_amd64.deb MD5Sum:ebbc03c2f321467d2e0ea0097c14f7fd libcurl3t64-gnutls_8.14.1-2+deb13u4_amd64.deb MD5Sum:9afc089158cea4cbc7cf26c951b600bf libcfitsio10t64_4.6.2-2_amd64.deb MD5Sum:856f7ba809c5e389e30d711356d158d9 libcurl4t64_8.14.1-2+deb13u4_amd64.deb MD5Sum:1ce441ba039d03e1f68100922946691b -libde265-0_1.0.15-1+b3_amd64.deb MD5Sum:0c323aaaf6ea41343412aa9da949ef36 +libde265-0_1.0.15-1+deb13u1_amd64.deb libdeflate0_1.23-2_amd64.deb MD5Sum:7c4b5c0d85726d2d9475d48d3587c775 libpng16-16t64_1.6.48-1+deb13u5_amd64.deb MD5Sum:0cd2789cb2b8855e0a0798c0c5ffb213 libfreetype6_2.13.3+dfsg-1+deb13u1_amd64.deb MD5Sum:0994fdb58c0168b608cd1e285deda3d2 @@ -36,22 +39,19 @@ libfontconfig1_2.15.0-2.3_amd64.deb MD5Sum:51964bf406139551c59047e6cbdd4940 libminizip1t64_1%3a1.3.dfsg+really1.3.1-1+b1_amd64.deb MD5Sum:4fd908eee3d3daac83c9746532996757 libfreexl1_2.0.0-1+b3_amd64.deb MD5Sum:ce2afecace86bac19538fe0d2937fd0b libfyba0t64_4.1.1-11+b1_amd64.deb MD5Sum:6c7b2e808aaa789019f8fec42e3b39a5 -libgeos3.13.1_3.13.1-1_amd64.deb MD5Sum:47aa57bc0672c6f07edf3762a76f46b7 -libgeos-c1t64_3.13.1-1_amd64.deb MD5Sum:2a47e1e868bf7ca4bc20d1c85c34ea90 libjbig0_2.1-6.1+b2_amd64.deb MD5Sum:590134f899b900c7c9f8f87cf750ea63 liblerc4_4.0.0+ds-5_amd64.deb MD5Sum:8c5933a75125eed15b466c16bf201bfa libsharpyuv0_1.5.0-0.1_amd64.deb MD5Sum:438d9fd296a1102dfa7f001641d8857a libwebp7_1.5.0-0.1_amd64.deb MD5Sum:bf682e1e438b4927c3807cad4ca6c1a9 libtiff6_4.7.0-3+deb13u3_amd64.deb -libproj25_9.6.0-1_amd64.deb MD5Sum:cf5a9d654805f47dc18e83f4ef2af4f6 libgeotiff5_1.7.4-1_amd64.deb MD5Sum:cde344178cfd6dd8706a86ba587ec534 libgif7_5.2.2-1+deb13u1_amd64.deb MD5Sum:b32a7f65ceaed3e3ce40abc20d3c3d2b libsz2_1.1.3-1+b1_amd64.deb MD5Sum:1d27983f2f9ef5efd8b47652603560cd libhdf4-0-alt_4.3.0-1+b1_amd64.deb MD5Sum:d55ae40aad48594e1b02fd87f3c6c061 libhdf5-310_1.14.5+repack-3_amd64.deb MD5Sum:b96e3a5656dcd4452dee459ba4ac10e1 -libheif-plugin-dav1d_1.19.8-1_amd64.deb MD5Sum:5cc75db5bb05cbf3c3e03d21620882f7 -libheif-plugin-libde265_1.19.8-1_amd64.deb MD5Sum:351ffb8509c45d7db37628f722d013c0 -libheif1_1.19.8-1_amd64.deb MD5Sum:4e065e74764b4e6e4481f335867973a4 +libheif-plugin-dav1d_1.19.8-1+deb13u1_amd64.deb +libheif-plugin-libde265_1.19.8-1+deb13u1_amd64.deb +libheif1_1.19.8-1+deb13u1_amd64.deb libjson-c5_0.18+ds-1_amd64.deb MD5Sum:2afaa0abf1f11e7f2d5aa1e789148632 liburiparser1_0.9.8+dfsg-2_amd64.deb MD5Sum:235a70c2df22baa76a41c55799f073c6 libkmlbase1t64_1.3.0-12+b2_amd64.deb MD5Sum:d900c2d72fed6fb0b4cb10c1f61a1b54 @@ -71,7 +71,7 @@ libgpgme11t64_1.24.2-3_amd64.deb MD5Sum:0e26d3e34af7581bda9fd6086fd29cc7 libgpgmepp6t64_1.24.2-3_amd64.deb MD5Sum:9b6067de043f9224848364739828216b liblcms2-2_2.16-2+deb13u2_amd64.deb MD5Sum:263113687b91aafa4e934fa16d91291b libnspr4_2%3a4.36-1_amd64.deb MD5Sum:dc825d7a7868119890f38608de1b5e21 -libnss3_2%3a3.110-1+deb13u3_amd64.deb MD5Sum:4b63b2494e8e2e644b0c58d2ad409b07 +libnss3_2%3a3.110-1+deb13u4_amd64.deb libpoppler147_25.03.0-5+deb13u4_amd64.deb MD5Sum:85a124f7fd20122d5eb5f2a30a75a051 libqhull-r8.0_2020.2-6+b2_amd64.deb MD5Sum:3b0b21663513226a208f039abea3ad47 librttopo1_1.1.0-4_amd64.deb MD5Sum:b522568252b7ba63b0c4f87300400be9 From 011b3fc72455574a6b87043f14c220f6b4cca160 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 14:00:42 +0200 Subject: [PATCH 75/76] chore(deps): update dependency dagger/dagger to v0.21.9 (#326) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/bake.yml | 2 +- .github/workflows/bake_targets.yml | 2 +- .github/workflows/test.yml | 2 +- .github/workflows/update-catalogs.yml | 2 +- .github/workflows/update_os_libraries.yml | 4 ++-- Taskfile.yml | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index ca5e1089..92990b16 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -33,7 +33,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.8 + DAGGER_VERSION: 0.21.9 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml index a787372b..db23f754 100644 --- a/.github/workflows/bake_targets.yml +++ b/.github/workflows/bake_targets.yml @@ -152,7 +152,7 @@ jobs: - name: Install Dagger env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.8 + DAGGER_VERSION: 0.21.9 run: | curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d75af657..fea5cce3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -37,7 +37,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.8 + DAGGER_VERSION: 0.21.9 with: version: ${{ env.DAGGER_VERSION }} verb: develop diff --git a/.github/workflows/update-catalogs.yml b/.github/workflows/update-catalogs.yml index 4a85ab0c..023447a4 100644 --- a/.github/workflows/update-catalogs.yml +++ b/.github/workflows/update-catalogs.yml @@ -39,7 +39,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.8 + DAGGER_VERSION: 0.21.9 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/.github/workflows/update_os_libraries.yml b/.github/workflows/update_os_libraries.yml index 9785ce7e..329f906a 100644 --- a/.github/workflows/update_os_libraries.yml +++ b/.github/workflows/update_os_libraries.yml @@ -28,7 +28,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.8 + DAGGER_VERSION: 0.21.9 with: version: ${{ env.DAGGER_VERSION }} verb: call @@ -66,7 +66,7 @@ jobs: uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1 env: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_VERSION: 0.21.8 + DAGGER_VERSION: 0.21.9 with: version: ${{ env.DAGGER_VERSION }} verb: call diff --git a/Taskfile.yml b/Taskfile.yml index 301e5d10..6af72dca 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -209,7 +209,7 @@ tasks: run: once vars: # renovate: datasource=github-tags depName=dagger/dagger versioning=semver - DAGGER_ENGINE_VERSION: v0.21.8 + DAGGER_ENGINE_VERSION: v0.21.9 cmds: - > docker run -d -v /var/lib/dagger --name {{ .DAGGER_ENGINE_NAME }} --restart always --network {{ .E2E_NETWORK }} From 6feb95995a457e19b0f139e197195543c9c55abd Mon Sep 17 00:00:00 2001 From: "ardentperf-agent[bot]" <265149240+ardentperf-agent[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 06:00:42 +0000 Subject: [PATCH 76/76] docs: add downstream upstream-sync documentation --- .../PULL_REQUEST_TEMPLATE/new_extension.md | 2 +- MERGE.md | 131 ++++++++++++++++++ SECURITY-INSIGHTS.yml | 58 +++++--- .../2026-06-11-historical-baseline.md | 15 ++ merge-records/2026-09-02-upstream-sync.md | 96 +++++++++++++ 5 files changed, 283 insertions(+), 19 deletions(-) create mode 100644 MERGE.md create mode 100644 merge-records/2026-06-11-historical-baseline.md create mode 100644 merge-records/2026-09-02-upstream-sync.md diff --git a/.github/PULL_REQUEST_TEMPLATE/new_extension.md b/.github/PULL_REQUEST_TEMPLATE/new_extension.md index 26e886a0..fccf9f52 100644 --- a/.github/PULL_REQUEST_TEMPLATE/new_extension.md +++ b/.github/PULL_REQUEST_TEMPLATE/new_extension.md @@ -54,7 +54,7 @@ Closes # with the component owner's GitHub handle(s). - [ ] A `distribution-points` entry for the new image was added under `repository.release` in - [`SECURITY-INSIGHTS.yml`](https://github.com/cloudnative-pg/postgres-extensions-containers/blob/main/SECURITY-INSIGHTS.yml). + [`SECURITY-INSIGHTS.yml`](https://github.com/cnpg-extensions/postgres-extensions-containers/blob/main/SECURITY-INSIGHTS.yml). - [ ] I confirm my commitment to maintain this extension on behalf of the CloudNativePG community. diff --git a/MERGE.md b/MERGE.md new file mode 100644 index 00000000..29e00628 --- /dev/null +++ b/MERGE.md @@ -0,0 +1,131 @@ +# Upstream Merge Instructions + +This file gives agents a repeatable process for synchronizing the CNPG +Extensions repository with its upstream template while preserving the +downstream extension set and the complete upstream history. + +## Repositories + +- Downstream: `https://github.com/cnpg-extensions/postgres-extensions-containers` +- Upstream: `https://github.com/cloudnative-pg/postgres-extensions-containers` + +The downstream repository is the source of truth for the extensions it +publishes. Upstream changes to individual extension directories and extension +versions are intentionally not mirrored unless a maintainer explicitly asks +for them. Shared build infrastructure, maintenance code, workflows, security +metadata, and generally applicable documentation should be reviewed for each +upstream sync. + +## Merge records + +The append-only [merge-records/](./merge-records/) directory is the source of +truth for upstream syncs. The newest ISO-date-named record is the latest sync. +Each record contains the exact upstream and downstream commit SHAs. Future +merges must not require an edit to this file. + +## Merge record directory + +Store one detailed review record per upstream sync under `merge-records/`. +Use an immutable date-based filename such as +`merge-records/2026-09-02-upstream-sync.md`; never overwrite an earlier +record. + +Each record must include the exact mirror ref, upstream ref, last upstream +commit already merged, every substantive upstream commit reviewed, the +consolidated dependency note, planned adoptions, intentional exclusions, +conflict decisions, and validation results. + +The directory also contains an inherited historical baseline marker. Future +records should begin from the upstream commit recorded by the newest record. + +Keep the records append-only in normal use. If a historical correction is +needed, preserve the original text and add a dated correction note. + +## Procedure for a future sync + +1. Start from an up-to-date downstream `main` or a working branch based on + it. Keep the worktree clean, fetch both remotes, and record the exact + upstream tip before resolving anything: + + ```sh + git fetch origin main + git fetch upstream main + git status --short + git rev-parse upstream/main + git show -s --format='%H%n%aI%n%s' upstream/main + ``` + +2. Compare the upstream tip with the commit recorded in the newest dated + record under `merge-records/`. Review upstream commits and use a non-mutating + merge preview when practical: + + ```sh + git merge-base downstream/main upstream/main + git log --oneline --left-right downstream/main...upstream/main + git merge-tree --write-tree downstream/main upstream/main + ``` + + Create a new dated record under `merge-records/` before changing code; + use normal Git inspection commands and the first record as the format + reference. For each commit in the range, inspect its summary and changed + paths, then check whether each path exists at the mirror ref: + + ```sh + git show --stat --summary + git diff-tree --no-commit-id --name-status -r + git cat-file -e "origin/main:" 2>/dev/null + ``` + + Keep pure `chore(deps):` commits out of the two detailed tables and + summarize them once by dependency area, using final cumulative versions + relevant to the mirror. The detailed record must have separate + **Planned adoption** and **Not relevant** tables. Every non-dependency row + must include the full 40-character SHA, date, subject, whether any exact + changed path exists in the mirror, relevant paths, and a short adoption or + exclusion comment. + +3. Create a real merge commit with `upstream/main` as its second parent. Do + not rebase the downstream work onto upstream and do not replace the merge + with a collection of cherry-picks. Preserving ancestry makes the exact + upstream sync point auditable and keeps later merges manageable. + + When the upstream-sync branch is submitted as a pull request, merge it + with GitHub's **Create a merge commit** option. Do not squash or rebase an + upstream-sync pull request, because either strategy can flatten the + upstream ancestry needed for future syncs. Squashing remains acceptable + for unrelated documentation-only pull requests that do not incorporate + upstream history. + +4. Resolve conflicts by intent: + + - Keep downstream versions of extension directories and their metadata; + do not pull in upstream extension additions or version bumps. + - Review and normally port upstream changes to shared workflows, Dagger + maintenance code, `docker-bake.hcl`, `Taskfile.yml`, tests, and general + documentation. + - Manually merge `README.md` and security metadata. `CODEOWNERS` is + downstream-owned: CNPG Extensions has its own ownership model, so never + copy upstream `CODEOWNERS` changes or component-owner assignments. Keep + downstream branding, custom image locations, and policy links. + - Check repository and image identity values for accidental + `cloudnative-pg` references before finalizing the merge. + +5. Before creating the merge commit, create a new dated detailed record in + `merge-records/` using the exact SHA captured in step 1. After the merge + commit is created, add its exact downstream SHA to the new record. Do not + edit `MERGE.md`; the newest dated record becomes the latest sync + automatically. The recorded upstream SHA must be the commit actually + merged, not merely the newest commit observed during review. + +6. Run the relevant validation. At minimum, review the merge diff for + extension-directory changes and run the repository checks affected by the + sync. For maintenance-code changes, run the Dagger Go tests; for workflow + or build changes, run the applicable Task/build checks and CI validation. + +7. In the pull request description, include: + + - the full upstream SHA merged; + - the downstream base and merge commit once available; + - the intentional extension-directory exclusions; + - conflicts requiring manual adaptation; and + - validation performed. diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml index 2bddb2e7..1a07104c 100644 --- a/SECURITY-INSIGHTS.yml +++ b/SECURITY-INSIGHTS.yml @@ -2,12 +2,12 @@ header: schema-version: 2.2.0 last-updated: '2026-08-04' last-reviewed: '2026-08-04' - url: https://raw.githubusercontent.com/cloudnative-pg/postgres-extensions-containers/main/SECURITY-INSIGHTS.yml - # reference the main SECURITY-INSIGHTS file from CNPG repo + url: https://raw.githubusercontent.com/cnpg-extensions/postgres-extensions-containers/main/SECURITY-INSIGHTS.yml + # Reference the main SECURITY-INSIGHTS file from the CNPG project. project-si-source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/SECURITY-INSIGHTS.yml repository: - url: https://github.com/cloudnative-pg/postgres-extensions-containers + url: https://github.com/cnpg-extensions/postgres-extensions-containers status: active accepts-change-request: true accepts-automated-change-request: true @@ -41,22 +41,44 @@ repository: release: automated-pipeline: true distribution-points: - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgvector - comment: GitHub packages for the pgvector extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/postgis-extension + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/age + comment: GitHub packages for the age extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/debversion + comment: GitHub packages for the debversion extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/h3 + comment: GitHub packages for the h3 extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/mobilitydb + comment: GitHub packages for the MobilityDB extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/mysql-fdw + comment: GitHub packages for the mysql_fdw extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pg-cron + comment: GitHub packages for the pg_cron extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pg-rrule + comment: GitHub packages for the pg_rrule extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pg-uuidv7 + comment: GitHub packages for the pg_uuidv7 extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pgagent + comment: GitHub packages for the pgagent extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pgmemcache + comment: GitHub packages for the pgmemcache extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pgmp + comment: GitHub packages for the pgmp extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pgsphere + comment: GitHub packages for the pgsphere extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/pldebugger + comment: GitHub packages for the pldebugger extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/plprofiler + comment: GitHub packages for the plprofiler extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/plr + comment: GitHub packages for the plr extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/postgis-extension comment: GitHub packages for the PostGIS extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgrouting - comment: GitHub packages for the pgrouting extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgaudit - comment: GitHub packages for the pgaudit extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-ivm - comment: GitHub packages for the pg_ivm extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-crash - comment: GitHub packages for the pg_crash extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/timescaledb-oss - comment: GitHub packages for the TimescaleDB (OSS) extension image - - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/wal2json - comment: GitHub packages for the wal2json extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/q3c + comment: GitHub packages for the q3c extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/snakeoil + comment: GitHub packages for the pg_snakeoil extension image + - uri: https://github.com/cnpg-extensions/postgres-extensions-containers/pkgs/container/tds-fdw + comment: GitHub packages for the tds_fdw extension image security: tools: diff --git a/merge-records/2026-06-11-historical-baseline.md b/merge-records/2026-06-11-historical-baseline.md new file mode 100644 index 00000000..2c3a38f0 --- /dev/null +++ b/merge-records/2026-06-11-historical-baseline.md @@ -0,0 +1,15 @@ +# Historical Upstream Sync Baseline + +This is an inherited historical record for the mirror's upstream baseline. +No detailed review artifact for this sync was present when the append-only +merge-record process was introduced. + +- Date: `2026-06-11` +- Upstream repository: `cloudnative-pg/postgres-extensions-containers` +- Upstream commit merged: `7b6ba6a07f45e559f232e70b542e82123ec875d9` +- Downstream merge commit: `d0471ab57ca2770d43451a896e2ad9081fc293d7` +- Note: Existing historical sync inherited from the mirror's prior history. + +This record is the predecessor of +`merge-records/2026-09-02-upstream-sync.md`; it is not a newly recreated +merge. diff --git a/merge-records/2026-09-02-upstream-sync.md b/merge-records/2026-09-02-upstream-sync.md new file mode 100644 index 00000000..3619eade --- /dev/null +++ b/merge-records/2026-09-02-upstream-sync.md @@ -0,0 +1,96 @@ +# Upstream Sync Commit Review + +Generated and reviewed locally on 2026-09-02. This is the first checked-in sync review record. The comparison tip is the second parent of the downstream merge. + +- Mirror checked: `origin/main` at `4a2d94443c59626884bde23c6dc700448500c6f1` (`cnpg-extensions/postgres-extensions-containers`) +- Upstream checked: `upstream/main` at `011b3fc72455574a6b87043f14c220f6b4cca160` +- Last recorded upstream merge: `7b6ba6a07f45e559f232e70b542e82123ec875d9` +- Downstream merge commit: `324a6b7a9392060baf2c5c8c10d0a2ae66a0f0e0` +- Upstream commits reviewed: 75 +- Detailed non-dependency commits: 18 +- Pure dependency chore commits consolidated below: 57 + +## Review rules + +`Touches mirror files?` is `Yes` when at least one exact changed path exists in the mirror at the checked mirror ref. A `No` result means the commit only adds or changes paths absent from the mirror. Extension directories are grouped in the path column. Pure `chore(deps)` commits are omitted from the detailed sections and summarized separately below. + +## Consolidated dependency-only updates + +57 of the 75 upstream commits are pure dependency chores (`chore(deps):`). They are intentionally filtered out of the detailed review sections. Do not replay these bot commits individually; review the final cumulative value in each shared file and take only the pins relevant to the mirror. + +| Dependency area | Commits | Recommendation | +| --- | ---: | --- | +| CI/action pins | 17 | Use the final cumulative action/tool pins in the shared workflows; do not replay intermediate bot updates. | +| kubectl image | 11 | Update the shared Taskfile to the final upstream v1.36.4 pin if adopting the tool updates. | +| psql test image | 11 | Update shared `test/check-extension.yaml` to the final v18.6 pin; skip extension-only test files. | +| registry image | 2 | Update the shared registry pin to the final digest if adopting the CI changes. | +| Dagger | 1 | Update the shared Dagger engine/CLI references to the final v0.21.9 value where applicable. | +| CNPG smoke-test version | 1 | Update the shared smoke-test default to CNPG 1.30 if that test matrix is adopted. | +| TimescaleDB package | 8 | Exclude — extension-specific package updates are intentionally omitted. | +| pgvector package | 4 | Exclude — extension-specific package updates are intentionally omitted. | +| PostGIS package | 1 | Exclude — extension-specific package updates are intentionally omitted. | +| wal2json package | 1 | Exclude — extension-specific package updates are intentionally omitted. | + +Final upstream shared values observed during this review include CNPG `1.30`, kubectl `1.36.4`, psql `18.6`, Dagger `v0.21.9`, registry `3.1.1`, and the corresponding upstream-pinned digests. Take these as review targets, not as an instruction to mirror extension package versions. + +## Detailed review: commits planned for adoption + +These are the substantive upstream commits we plan to adopt or adapt, subject to normal conflict resolution and validation. + +| Audit order | Date | Upstream commit | Subject | Touches mirror files? | Mirror paths / paths absent from mirror | Adoption note | +| ---: | --- | --- | --- | :---: | --- | --- | +| 1 | 2026-06-16 | [552cb96e190b9e25ea16897f4f2b626822bfd026](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/552cb96e190b9e25ea16897f4f2b626822bfd026) | ci: run Go unit tests for the maintenance module (#238) | Yes | mirror: `dagger/maintenance/dagger.json`
`dagger/maintenance/go.mod`
`dagger/maintenance/go.sum`
absent: `.github/workflows/test.yml` | Adopt — add/adapt the maintenance unit-test workflow and Dagger module updates. | +| 3 | 2026-07-02 | [be1c8dd1f8fcc139fd086eda9c571399a76bb787](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/be1c8dd1f8fcc139fd086eda9c571399a76bb787) | fix: set output to cacheonly when running bake --check (#262) | Yes | mirror: `Taskfile.yml` | Adopt — merge the shared `bake --check` fix. | +| 4 | 2026-07-08 | [9755a49bdb19aaef02df236cd8b4a59396e7a925](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/9755a49bdb19aaef02df236cd8b4a59396e7a925) | feat: derive build matrix from distros and PG versions in extension's metadata (#251) | Yes | mirror: `.github/workflows/bake_targets.yml`
`BUILD.md`
`Taskfile.yml`
`dagger/maintenance/dagger.json`
`dagger/maintenance/go.mod`
`dagger/maintenance/go.sum`
`dagger/maintenance/main.go`
`dagger/maintenance/parse.go`
`docker-bake.hcl`
`postgis/* (1)`
absent: `dagger/maintenance/parse_test.go` | Adopt — merge the shared metadata-driven matrix and maintenance refactor; validate downstream metadata pairs. | +| 7 | 2026-07-14 | [72c2850a9e5b977c51d1e5276897f4b1bcbbe952](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/72c2850a9e5b977c51d1e5276897f4b1bcbbe952) | ci: automate smoke-test cnpg matrix (#274) | Yes | mirror: `.github/workflows/bake_targets.yml`
`Taskfile.yml` | Adopt — merge the dynamic CNPG smoke-test matrix. | +| 8 | 2026-07-15 | [3a13c62ada62f4826d26a1b4ab788afc1df31bd7](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/3a13c62ada62f4826d26a1b4ab788afc1df31bd7) | chore: quote CNPG_RELEASE_DEFAULT (#282) | Yes | mirror: `Taskfile.yml` | Adopt — keep the shared Taskfile fix with the current CNPG release pin. | +| 16 | 2026-08-18 | [4cb1bd8cb47a8f028ba720ceedd46c7860613c32](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/4cb1bd8cb47a8f028ba720ceedd46c7860613c32) | chore: add SECURITY-INSIGHTS.yml (#307) | Yes | mirror: `.github/PULL_REQUEST_TEMPLATE/new_extension.md`
`CONTRIBUTING_NEW_EXTENSION.md`
absent: `SECURITY-INSIGHTS.yml` | Adopt/adapt — add the security metadata and contributor checklist while preserving downstream identity and ownership. | + +## Detailed review: commits not relevant to this mirror + +These commits are intentionally excluded. They either update extensions that are not mirrored here, fix extension-specific behavior, add upstream-only extensions, or change upstream ownership policy. + +**CODEOWNERS policy:** CNPG Extensions has its own `CODEOWNERS` file and ownership model. Do not copy upstream `CODEOWNERS` changes or upstream component-owner/account assignments. Preserve and review downstream ownership independently. + +| Audit order | Date | Upstream commit | Subject | Touches mirror files? | Mirror paths / paths absent from mirror | Exclusion note | +| ---: | --- | --- | --- | :---: | --- | --- | +| 2 | 2026-06-17 | [ac3d13a23cdcef5cd27f8d37a50d122d1b528158](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/ac3d13a23cdcef5cd27f8d37a50d122d1b528158) | chore: update postgis OS libraries (#239) | No | absent: `postgis/* (2)` | Exclude — extension-specific PostGIS change; inspect only if the downstream copy has the same issue. | +| 5 | 2026-07-13 | [f47540c10434cb867dde58199ea0d8bf40619ce8](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/f47540c10434cb867dde58199ea0d8bf40619ce8) | chore: update postgis OS libraries (#263) | No | absent: `postgis/* (2)` | Exclude — extension-specific PostGIS change; inspect only if the downstream copy has the same issue. | +| 6 | 2026-07-13 | [38d9417a4dfecdaa716735b2e50da229ed3bb928](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/38d9417a4dfecdaa716735b2e50da229ed3bb928) | feat: add pg_ivm extension (#49) | Yes | mirror: `CODEOWNERS`
`README.md`
absent: `pg-ivm/* (10)` | Exclude — do not add the upstream extension or copy its mixed README/ownership/security changes. | +| 9 | 2026-07-20 | [8b779fff856a2c66c52e4192e6d2c7058a5c1fd9](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/8b779fff856a2c66c52e4192e6d2c7058a5c1fd9) | chore: update postgis OS libraries (#289) | No | absent: `postgis/* (1)` | Exclude — extension-specific PostGIS change; inspect only if the downstream copy has the same issue. | +| 10 | 2026-07-22 | [f0eb97fc5f69048218ea6da670d1a416d306b043](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/f0eb97fc5f69048218ea6da670d1a416d306b043) | chore: add Gabriele Fedi as a component owner (#292) | Yes | mirror: `CODEOWNERS` | Exclude — CNPG Extensions has its own CODEOWNERS; do not copy upstream ownership changes. | +| 11 | 2026-07-23 | [cacac01ea2306d8602ad5a76f71372c54ab115f5](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/cacac01ea2306d8602ad5a76f71372c54ab115f5) | chore: expand account names in CODEOWNERS file (#288) | Yes | mirror: `CODEOWNERS` | Exclude — CNPG Extensions has its own CODEOWNERS; do not copy upstream ownership changes. | +| 12 | 2026-07-24 | [d5709b0362a875e099f672687f011ead1b5f4ae2](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/d5709b0362a875e099f672687f011ead1b5f4ae2) | chore: update postgis OS libraries (#291) | No | absent: `postgis/* (1)` | Exclude — extension-specific PostGIS change; inspect only if the downstream copy has the same issue. | +| 13 | 2026-07-27 | [560a829c4b7f266f55a0e787918d049099fd6116](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/560a829c4b7f266f55a0e787918d049099fd6116) | fix(PostGIS): strip `$libdir/` prefix from extension SQL scripts (#293) | Yes | mirror: `postgis/* (1)` | Exclude — extension-specific PostGIS change; inspect only if the downstream copy has the same issue. | +| 14 | 2026-08-05 | [f06c545b3f85dbe25c3bd24a73f6c05830c54b4b](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/f06c545b3f85dbe25c3bd24a73f6c05830c54b4b) | chore: sync CODEOWNERS with cnpg-infra policy (#306) | Yes | mirror: `CODEOWNERS` | Exclude — CNPG Extensions has its own CODEOWNERS; do not copy upstream ownership changes. | +| 15 | 2026-08-18 | [c8a992f553d7f69d1eb338cb021eccf2edffe1e4](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/c8a992f553d7f69d1eb338cb021eccf2edffe1e4) | fix: add `wal2json` to `output_plugin_libraries` for PG 18.6+ (#319) | No | absent: `wal2json/* (2)` | Exclude — extension-specific metadata fix; intentionally do not mirror it. | +| 17 | 2026-08-19 | [f111f59c3d57fe2c14eb03e9374da0f38f88c61b](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/f111f59c3d57fe2c14eb03e9374da0f38f88c61b) | feat: add `pgrouting` container image (#299) | Yes | mirror: `README.md`
absent: `SECURITY-INSIGHTS.yml`
`pgrouting/* (10)` | Exclude — do not add the upstream extension or copy its mixed README/ownership/security changes. | +| 18 | 2026-08-24 | [1fe50c79116afa459455075a05505b24f83a8791](https://github.com/cloudnative-pg/postgres-extensions-containers/commit/1fe50c79116afa459455075a05505b24f83a8791) | chore: update postgis OS libraries (#302) | No | absent: `postgis/* (2)` | Exclude — extension-specific PostGIS change; inspect only if the downstream copy has the same issue. | + +## Merge resolution + +- Preserved the mirror's complete 19-extension set; no upstream-only + extensions or extension-specific updates were added. +- Kept downstream `CODEOWNERS` and `README.md`, including the mirror's + branding. +- Adapted `SECURITY-INSIGHTS.yml` to the mirror repository and image names. +- Adopted the shared maintenance/build-matrix, workflow, smoke-test, and + contributor/security changes identified in the planned-adoption table. +- Kept `dagger/maintenance/dagger.json` at the upstream module declaration + `v0.21.7`; the shared workflow and Taskfile pins use the reviewed `v0.21.9` + CLI/tool value. + +## Validation + +- `DAGGER_SESSION_PORT=1 DAGGER_SESSION_TOKEN=test go test ./...` passed after + generating the Dagger client with v0.21.9. +- `act -j unit-test -W .github/workflows/test.yml --network bridge + -P ubuntu-24.04=catthehacker/ubuntu:act-latest` passed. +- `BUILDX_BUILDER=cnpg-walreplay-builder PATH=/tmp/dagger-sync-bin:$PATH task checks:all` + passed for all 19 mirror extension targets. The default Docker driver was + unable to process attestations, so the existing Docker-container builder was + used for this lint-only check. + +## Bottom line + +Adopt the shared maintenance/build-matrix refactor, Dagger unit-test workflow, `bake --check` fix, dynamic CNPG smoke matrix, current CNPG Taskfile fix, and adapted security/contributor metadata. Keep extension-specific updates, upstream-only extensions, and all upstream CODEOWNERS changes out of the mirror. Dependency-only chores are consolidated above.