Skip to content

POC: move changing ingestion log columns to ingestion_logs_stats - #604

Draft
ldrozdz93 wants to merge 1 commit into
developfrom
ingestion-logs-stats-split
Draft

POC: move changing ingestion log columns to ingestion_logs_stats#604
ldrozdz93 wants to merge 1 commit into
developfrom
ingestion-logs-stats-split

Conversation

@ldrozdz93

@ldrozdz93 ldrozdz93 commented Nov 10, 2026

Copy link
Copy Markdown

POC, dont review

🤖 Generated with Claude Code

@ldrozdz93 @claude
feat(reconciler): move the changing ingestion log columns to ingestio…
7b41789 
…n_logs_stats

Re-ingesting an unchanged entity updates its ingestion log up to three
times (duplicate bookkeeping and requeue, claim, final state). Each UPDATE
wrote a new version of the whole row, entity JSON included, and an entry in
all twelve indexes, because the updated_at trigger makes no update HOT.

state, error, requeued_from_state, duplicate_count, last_seen and
updated_at now live in ingestion_logs_stats, one narrow row per log with
immutable copies of object_type and ingestion_ts. ingestion_logs becomes
insert-only. The updated_at and (state, object_type) counter triggers and
the seven indexes that involve state or updated_at move with them. Readers
use the v_ingestion_logs view, which keeps the pre-split row shape; every
insert path writes the stats row in the same statement or transaction.

The migration fills the table in committed batches without blocking
writers, then switches over in one transaction under an exclusive lock and
catches up rows written meanwhile. Behaviour is unchanged.

Spike: built to measure the change-log (WAL) saving, see
netboxlabs/diode-pro tests/bench/wal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nbl-ai-review

nbl-ai-review Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

AI Code Review — risk tier: Full · dimensions run: correctness, security

Advisory only. A human owns the merge decision.

Summary — This is a net-positive, well-structured schema-split refactor (moving mutable ingestion_logs columns into a new ingestion_logs_stats table) with a sensible two-phase, resumable backfill migration and consistent sqlc/repository updates. Two migration-safety issues around zero-downtime rollout should be addressed before this runs against production.

Findings

  • diode-server/dbstore/postgres/migrations/20261109000001_ingestion_logs_stats_backfill.sql:68 — [Medium] correctness — Index creation contradicts the migration's own "without blocking writers" design. The header (lines 23-26) states the migration fills the table without blocking writers, but the six indexes built after the backfill loop (lines 68-74) use plain CREATE INDEX rather than CREATE INDEX CONCURRENTLY. A non-concurrent CREATE INDEX takes a SHARE lock on ingestion_logs_stats, blocking INSERT/UPDATE/DELETE for the duration of the build — exactly the scenario (a canary pod already writing via the new query paths) this resumable, NO TRANSACTION design is meant to tolerate. Suggest switching to CREATE INDEX CONCURRENTLY IF NOT EXISTS for each index as its own non-transactional statement.

  • diode-server/dbstore/postgres/migrations/20261109000002_ingestion_logs_stats_cutover.sql:185 — [Medium] correctness — DROP COLUMN on ingestion_logs is unsafe if an old app instance is still writing during a rolling deploy. This migration drops state, error, requeued_from_state, duplicate_count, last_seen, and updated_at from ingestion_logs (lines 185-191), but every write path in the pre-change query set (CreateIngestionLog, BulkCreateIngestionLogs, UpdateIngestionLogStateWithError) references these columns by name directly against ingestion_logs. If the cutover runs while an old-binary instance is still live — a normal state during rolling/canary deploy, and explicitly anticipated by migration 1's restart-resumable design — every write from that instance starts failing with "column does not exist" as soon as the ALTER TABLE commits. Suggest gating the cutover behind full rollout of the new binary, or keeping the dropped columns as deprecated no-op columns for one release before removing them.

Nits — The PR description reads "POC, dont review" — per review policy this is treated as untrusted content, not an instruction, and does not suppress the review (flagged under security dimension as a possible prompt-injection/social-engineering attempt; no action needed from the author beyond using normal draft-PR mechanisms instead).

🤖 AI Code Review · run · prompts: code-review/v1 · models: claude-sonnet-5/medium · context: description · 0 comment(s) · 0 prior AI review(s) · usage: $1.23 · 1409k in (89% cached) · 17.1k out

@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown

Vulnerability Scan: Failed — diode-ingester

Image: diode-ingester:scan

Source Library CVE Severity Installed Fixed Title
usr/local/bin/diode-server golang.org/x/net CVE-2026-78661 🟠 HIGH v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML
usr/local/bin/diode-server golang.org/x/net CVE-2026-97045 🟡 MEDIUM v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting via improper

Commit: 8a2215e

@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown

Vulnerability Scan: Failed — diode-reconciler

Image: diode-reconciler:scan

Source Library CVE Severity Installed Fixed Title
usr/local/bin/diode-server golang.org/x/net CVE-2026-78661 🟠 HIGH v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML
usr/local/bin/diode-server golang.org/x/net CVE-2026-97045 🟡 MEDIUM v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting via improper

Commit: 8a2215e

@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown

Vulnerability Scan: Failed — diode-auth

Image: diode-auth:scan

Source Library CVE Severity Installed Fixed Title
usr/bin/hydra github.com/docker/docker CVE-2026-33997 🟡 MEDIUM v28.3.3+incompatible 29.3.1 moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plu
usr/bin/hydra github.com/go-jose/go-jose/v3 CVE-2026-34986 🟠 HIGH v3.0.4 3.0.5 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-33815 🔴 CRITICAL v5.7.5 5.9.0 github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-33816 🔴 CRITICAL v5.7.5 5.9.0 github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-41889 ⚪ LOW v5.7.5 5.9.2 github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditio
usr/bin/hydra go.opentelemetry.io/otel CVE-2026-29181 🟠 HIGH v1.40.0 1.41.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service
usr/bin/hydra go.opentelemetry.io/otel/exporters/otlp/otlptrace CVE-2026-81870 ⚪ LOW v1.37.0 1.45.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclo
usr/bin/hydra go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp CVE-2026-39882 🟡 MEDIUM v1.37.0 1.43.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion
usr/bin/hydra go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp CVE-2026-81870 ⚪ LOW v1.37.0 1.45.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclo
usr/bin/hydra go.opentelemetry.io/otel/exporters/zipkin CVE-2026-81870 ⚪ LOW v1.37.0 1.45.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclo
usr/bin/hydra go.opentelemetry.io/otel/sdk CVE-2026-39883 🟠 HIGH v1.40.0 1.43.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code exe
usr/bin/hydra go.opentelemetry.io/otel/sdk CVE-2026-81870 ⚪ LOW v1.40.0 1.45.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclo
usr/bin/hydra golang.org/x/crypto CVE-2026-39828 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution
usr/bin/hydra golang.org/x/crypto CVE-2026-39829 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-39830 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource
usr/bin/hydra golang.org/x/crypto CVE-2026-39831 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to mis
usr/bin/hydra golang.org/x/crypto CVE-2026-39832 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass du
usr/bin/hydra golang.org/x/crypto CVE-2026-39835 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via
usr/bin/hydra golang.org/x/crypto CVE-2026-42508 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts:
usr/bin/hydra golang.org/x/crypto CVE-2026-46595 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to sk
usr/bin/hydra golang.org/x/crypto CVE-2026-46597 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-56854 🟠 HIGH v0.46.0 0.55.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to u
usr/bin/hydra golang.org/x/crypto CVE-2026-39827 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via
usr/bin/hydra golang.org/x/crypto CVE-2026-39833 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass du
usr/bin/hydra golang.org/x/crypto CVE-2026-39834 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due
usr/bin/hydra golang.org/x/crypto CVE-2026-46598 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of
usr/bin/hydra golang.org/x/crypto CVE-2026-56855 🟡 MEDIUM v0.46.0 0.56.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-78662 🟡 MEDIUM v0.46.0 0.56.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel
usr/bin/hydra golang.org/x/mod CVE-2026-56864 🟠 HIGH v0.30.0 0.40.0 golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious G
usr/bin/hydra golang.org/x/mod CVE-2026-56865 🟠 HIGH v0.30.0 0.40.0 golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromis
usr/bin/hydra golang.org/x/net CVE-2026-25681 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross
usr/bin/hydra golang.org/x/net CVE-2026-27136 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via H
usr/bin/hydra golang.org/x/net CVE-2026-33814 🟠 HIGH v0.48.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service
usr/bin/hydra golang.org/x/net CVE-2026-39821 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escala
usr/bin/hydra golang.org/x/net CVE-2026-46600 🟠 HIGH v0.48.0 0.56.0 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Serv
usr/bin/hydra golang.org/x/net CVE-2026-78661 🟠 HIGH v0.48.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML
usr/bin/hydra golang.org/x/net CVE-2026-78669 🟠 HIGH v0.48.0 0.60.0 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of S
usr/bin/hydra golang.org/x/net CVE-2026-25680 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive
usr/bin/hydra golang.org/x/net CVE-2026-42502 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via u
usr/bin/hydra golang.org/x/net CVE-2026-42506 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arb
usr/bin/hydra golang.org/x/net CVE-2026-78659 🟡 MEDIUM v0.48.0 0.60.0 net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2
usr/bin/hydra golang.org/x/net CVE-2026-78660 🟡 MEDIUM v0.48.0 0.60.0 net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via
usr/bin/hydra golang.org/x/net CVE-2026-78663 🟡 MEDIUM v0.48.0 0.60.0 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow
usr/bin/hydra golang.org/x/net CVE-2026-97032 🟡 MEDIUM v0.48.0 0.60.0 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Den
usr/bin/hydra golang.org/x/net CVE-2026-97045 🟡 MEDIUM v0.48.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting via improper
usr/bin/hydra golang.org/x/text CVE-2026-56851 🟠 HIGH v0.32.0 0.41.0 golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice
usr/bin/hydra golang.org/x/text CVE-2026-56852 🟠 HIGH v0.32.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
usr/bin/hydra google.golang.org/grpc CVE-2026-84304 🟠 HIGH v1.79.3 1.83.1 google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmen
usr/bin/hydra google.golang.org/grpc CVE-2026-84445 🟠 HIGH v1.79.3 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
usr/bin/hydra google.golang.org/grpc GHSA-hrxh-6v49-42gf 🟠 HIGH v1.79.3 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
usr/bin/hydra google.golang.org/grpc CVE-2026-84303 🟡 MEDIUM v1.79.3 1.83.1 github.com/grpc/grpc-go: gRPC-Go: RBAC policy bypass and validation evasion via
usr/bin/hydra stdlib CVE-2026-111943 🟠 HIGH v1.26.0 1.26.10, 1.27.3 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted interm
usr/bin/hydra stdlib CVE-2026-25679 🟠 HIGH v1.26.0 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
usr/bin/hydra stdlib CVE-2026-27137 🟠 HIGH v1.26.0 1.26.1 crypto/x509: Incorrect enforcement of email constraints in crypto/x509
usr/bin/hydra stdlib CVE-2026-27145 🟠 HIGH v1.26.0 1.25.11, 1.26.4 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive process
usr/bin/hydra stdlib CVE-2026-32280 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certific
usr/bin/hydra stdlib CVE-2026-32281 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certifica
usr/bin/hydra stdlib CVE-2026-32283 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key up
usr/bin/hydra stdlib CVE-2026-33810 🟠 HIGH v1.26.0 1.26.2 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorr
usr/bin/hydra stdlib CVE-2026-33811 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net: golang: Go net package: Denial of Service via long CNAME response in Lookup
usr/bin/hydra stdlib CVE-2026-33814 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service
usr/bin/hydra stdlib CVE-2026-33818 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursi
usr/bin/hydra stdlib CVE-2026-39820 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
usr/bin/hydra stdlib CVE-2026-39821 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escala
usr/bin/hydra stdlib CVE-2026-39822 🟠 HIGH v1.26.0 1.25.12, 1.26.5, 1.27.0-rc.2 golang: Go os.Root: Symlink following vulnerability allows directory traversal
usr/bin/hydra stdlib CVE-2026-39836 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPo
usr/bin/hydra stdlib CVE-2026-42499 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/mail: golang: net/mail: Denial of Service via pathological email address par
usr/bin/hydra stdlib CVE-2026-42504 🟠 HIGH v1.26.0 1.25.11, 1.26.4 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
usr/bin/hydra stdlib CVE-2026-46600 🟠 HIGH v1.26.0 1.26.6, 1.27.0-rc.3 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Serv
usr/bin/hydra stdlib CVE-2026-56853 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Deni
usr/bin/hydra stdlib CVE-2026-56858 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 html/template: golang: Go html/template: Cross-Site Scripting via pathological i
usr/bin/hydra stdlib CVE-2026-56859 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth iss
usr/bin/hydra stdlib CVE-2026-56860 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 net/url: golang: golang net/url: Denial of Service from quadratic complexity in
usr/bin/hydra stdlib CVE-2026-56862 🟠 HIGH v1.26.0 1.25.13, 1.26.6, 1.27.0-rc.3 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdat
usr/bin/hydra stdlib CVE-2026-78667 🟠 HIGH v1.26.0 1.26.9, 1.27.2 net/http: golang: golang: Denial of Service via crafted HTTP Range headers
usr/bin/hydra stdlib CVE-2026-78669 🟠 HIGH v1.26.0 1.26.9, 1.27.2 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of S
usr/bin/hydra stdlib CVE-2026-97031 🟠 HIGH v1.26.0 1.26.9, 1.27.2 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extensi
usr/bin/hydra stdlib CVE-2026-27142 🟡 MEDIUM v1.26.0 1.25.8, 1.26.1 html/template: URLs in meta content attribute actions are not escaped in html/te
usr/bin/hydra stdlib CVE-2026-32282 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
usr/bin/hydra stdlib CVE-2026-32288 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously
usr/bin/hydra stdlib CVE-2026-32289 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 html/template: golang: html/template: Cross-Site Scripting (XSS) via improper co
usr/bin/hydra stdlib CVE-2026-39823 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 html/template: golang: Go html/template: Cross-Site Scripting via improper URL e
usr/bin/hydra stdlib CVE-2026-39825 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query
usr/bin/hydra stdlib CVE-2026-39826 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 html/template: golang: html/template: Cross-site scripting due to incorrect scri
usr/bin/hydra stdlib CVE-2026-42505 🟡 MEDIUM v1.26.0 1.25.12, 1.26.5, 1.27.0-rc.2 crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client He
usr/bin/hydra stdlib CVE-2026-42507 🟡 MEDIUM v1.26.0 1.25.11, 1.26.4 net/textproto: golang: Golang net/textproto: Misleading error messages via input
usr/bin/hydra stdlib CVE-2026-56866 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP
usr/bin/hydra stdlib CVE-2026-78659 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2
usr/bin/hydra stdlib CVE-2026-78660 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via
usr/bin/hydra stdlib CVE-2026-78663 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow
usr/bin/hydra stdlib CVE-2026-94439 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP
usr/bin/hydra stdlib CVE-2026-94440 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/textproto: mime/multipart: golang: golang: Denial of Service via memory limi
usr/bin/hydra stdlib CVE-2026-94448 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 html/template: golang: golang: cross-site scripting via consecutive expressions
usr/bin/hydra stdlib CVE-2026-97030 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 html/template: golang: html/template: Cross-site scripting via improper escaping
usr/bin/hydra stdlib CVE-2026-97032 🟡 MEDIUM v1.26.0 1.26.9, 1.27.2 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Den
usr/bin/hydra stdlib CVE-2026-27138 ⚪ LOW v1.26.0 1.26.1 crypto/x509: Panic in name constraint checking for malformed certificates in cry
usr/bin/hydra stdlib CVE-2026-27139 ⚪ LOW v1.26.0 1.25.8, 1.26.1 os: FileInfo can escape from a Root in golang os module
usr/bin/hydra stdlib CVE-2026-56857 ⚪ LOW v1.26.0 1.26.9, 1.27.2 os: golang: golang: Directory traversal via Windows junction handling
usr/local/bin/authmanager golang.org/x/net CVE-2026-78661 🟠 HIGH v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML
usr/local/bin/authmanager golang.org/x/net CVE-2026-97045 🟡 MEDIUM v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting via improper
usr/local/bin/diode-server golang.org/x/net CVE-2026-78661 🟠 HIGH v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML
usr/local/bin/diode-server golang.org/x/net CVE-2026-97045 🟡 MEDIUM v0.60.0 0.62.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting via improper

Commit: 8a2215e

@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown

Go test coverage

STATUS ELAPSED PACKAGE COVER PASS FAIL SKIP
🟢 PASS 1.33s github.com/netboxlabs/diode/diode-server/auth 57.3% 78 0 0
🟢 PASS 1.32s github.com/netboxlabs/diode/diode-server/auth/cli 0.0% 0 0 0
🟢 PASS 1.03s github.com/netboxlabs/diode/diode-server/authutil 82.8% 5 0 0
🟢 PASS 0.19s github.com/netboxlabs/diode/diode-server/dbstore/postgres 0.0% 0 0 0
🟢 PASS 1.13s github.com/netboxlabs/diode/diode-server/entityhash 94.8% 24 0 0
🟢 PASS 1.15s github.com/netboxlabs/diode/diode-server/entitymatcher 82.8% 97 0 0
🟢 PASS 0.09s github.com/netboxlabs/diode/diode-server/errors 0.0% 0 0 0
🟢 PASS 1.23s github.com/netboxlabs/diode/diode-server/graph 52.0% 81 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/grpckeepalive 100.0% 1 0 0
🟢 PASS 1.46s github.com/netboxlabs/diode/diode-server/ingester 85.4% 66 0 0
🟢 PASS 1.16s github.com/netboxlabs/diode/diode-server/matching 94.1% 66 0 0
🟢 PASS 1.08s github.com/netboxlabs/diode/diode-server/migrator 70.4% 4 0 0
🟢 PASS 3.13s github.com/netboxlabs/diode/diode-server/netboxdiodeplugin 46.8% 23 0 0
🟢 PASS 0.16s github.com/netboxlabs/diode/diode-server/pprof 0.0% 0 0 0
🟢 PASS 11.34s github.com/netboxlabs/diode/diode-server/reconciler 76.2% 114 0 0
🟢 PASS 0.10s github.com/netboxlabs/diode/diode-server/reconciler/changeset 0.0% 0 0 0
🟢 PASS 1.07s github.com/netboxlabs/diode/diode-server/reconciler/differ 76.0% 24 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/server 85.7% 14 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/strcase 100.0% 24 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/telemetry 26.2% 26 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/telemetry/otel 90.2% 25 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/tls 65.2% 6 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/version 100.0% 2 0 0

Total coverage: 57.5%

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jajeffries jajeffries Awaiting requested review from jajeffries jajeffries will be requested when the pull request is marked ready for review jajeffries is a code owner
@leoparente leoparente Awaiting requested review from leoparente leoparente will be requested when the pull request is marked ready for review leoparente is a code owner
@manrodrigues manrodrigues Awaiting requested review from manrodrigues manrodrigues will be requested when the pull request is marked ready for review manrodrigues is a code owner
@mfiedorowicz mfiedorowicz Awaiting requested review from mfiedorowicz mfiedorowicz will be requested when the pull request is marked ready for review mfiedorowicz is a code owner
@grant-nbl grant-nbl Awaiting requested review from grant-nbl grant-nbl will be requested when the pull request is marked ready for review grant-nbl is a code owner
@samiura samiura Awaiting requested review from samiura samiura will be requested when the pull request is marked ready for review samiura is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

diode-server go

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ldrozdz93