Important: This release fixes several medium server-side security issues (GHSA-9c2x-rm59-4335). Users running minder should upgrade to the ghcr.io/mindersec/minder/helm/minder:0.20260810.5249_ref.f0b736a Helm chart (github.com) or later. The security issues were:
- An information leak in GetRuleById if users could guess or find another project's rule id (a UUID)
- A privilege escalation where editors on a project could delete providers in the project
- Some non-public NAT IP ranges were not blocked during Rego policy evaluation
Client-side changes
Several small changes to support the mindersec/minder-action/test action and mindev test:
- feat(ruletest): Expose rule evaluation output to Starlark tests by @krrish175-byte in https://github.com/mindersec/minder/pull/6666
- feat(ruletest): expose eval output to Starlark tests and fix CWD-sensitive path resolution by @krrish175-byte in https://github.com/mindersec/minder/pull/6682
- fix(ruletest): initialize params map to prevent panic on template rendering by @krrish175-byte in https://github.com/mindersec/minder/pull/6688
Server-side changes
- Fix a few control oversights by @evankanderson in https://github.com/mindersec/minder/pull/6689
Development changes
- Prevent Compose from creating config directory by @maxi-maxima in https://github.com/mindersec/minder/pull/6681
Minor / dependency changes
- Update dependabot for codeql-action by @evankanderson in https://github.com/mindersec/minder/pull/6649
- build(deps): bump chainguard-dev/actions/boilerplate from 1.6.28 to 1.6.29 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6665
- build(deps): bump coverallsapp/github-action from 2.3.7 to 2.3.8 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6664
- build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6662
- build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6663
- build(deps): bump github.com/erikgeiser/promptkit from 0.11.0 to 0.12.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6660
- build(deps): bump github.com/openfga/openfga from 1.18.0 to 1.18.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6658
- build(deps): bump styled-components from 6.4.3 to 6.4.4 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6655
- build(deps): bump the codeql group with 2 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6661
- build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6656
- Upgrade lestrrat-go/jwx to v3 by @evankanderson in https://github.com/mindersec/minder/pull/6668
- Fix lint errors which crept into the codebase by @evankanderson in https://github.com/mindersec/minder/pull/6670
- build(deps): bump brace-expansion in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6671
- build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6680
- build(deps): bump github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6678
- build(deps-dev): bump globals from 17.7.0 to 17.8.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6674
- build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.42.1 to 1.43.3 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6676
- build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6677
- build(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6679
- build(deps-dev): bump markdownlint-cli2 from 0.23.1 to 0.23.2 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6673
- build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6683
- build(deps): bump github.com/cloudevents/sdk-go/observability/opentelemetry/v2 from 2.16.1 to 2.16.2 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6675
- build(deps): bump mermaid from 11.15.0 to 11.16.1 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6685
- build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6687
- build(deps): bump dompurify from 3.4.11 to 3.4.13 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6686
New Contributors
- @maxi-maxima made their first contribution in https://github.com/mindersec/minder/pull/6681
Full Changelog: https://github.com/mindersec/minder/compare/v0.3.0...v0.3.1
