This release is primary to expose new client-side features, as server-side changes are available in the rolling release of the Helm chart.
Client Changes
The new provider_trait functionality allows rule authors to indicate which provider capabilities are needed to evaluate a rule. This allows a repository rule (for example) to be conditioned on GitHub's branch protection API, and ignore (not be executed or skipped) repositories provider by GitLab or other providers with different branch protection APIs. As this is a new field in the RuleType, it requires a new client to parse and send the content to the server. There were also a number of improvements to mindev test based on implementation experience, including reporting of rules which are not tested, and json.encode and json.decode Starlark built-ins.
- Add provider_trait field to RuleType.Definition by @intelligent-ears in https://github.com/mindersec/minder/pull/6669
- Simplify spacing requirements for rego format by @evankanderson in https://github.com/mindersec/minder/pull/6730
- feat(mindev): add --junit-file flag to test command and add Starlark testing docs by @krrish175-byte in https://github.com/mindersec/minder/pull/6690
- Add Starlark JSON module by @evankanderson in https://github.com/mindersec/minder/pull/6755
- Add coverage tracking for
mindev testby @evankanderson in https://github.com/mindersec/minder/pull/6749
Server Changes
New Features
Major new features include the provider_trait evaluation support and OCI artifact support for both Quay.io and additional information to support additional OCI artifact ruletypes. There were also additional improvements in REST data sources and quota reporting to operators.
- Gate rule type engine construction on provider_traits by @intelligent-ears in https://github.com/mindersec/minder/pull/6702
- docs: document provider_traits for rule type authors by @intelligent-ears in https://github.com/mindersec/minder/pull/6728
-
Add gitlab to the provider_type enum and report it in SupportedProviderTypes by @intelligent-ears in https://github.com/mindersec/minder/pull/6748
-
Fix DockerHub provider-class manager missing OAuthManager by @shreyaabaranwal in https://github.com/mindersec/minder/pull/6756
- Add Quay.io provider (first slice of [#6436]) by @shreyaabaranwal in https://github.com/mindersec/minder/pull/6753
-
Expose OCI image identity in artifact ingester by @shreyaabaranwal in https://github.com/mindersec/minder/pull/6775
-
Make REST data source limits configurable by @maxi-maxima in https://github.com/mindersec/minder/pull/6700
- feat(github): record remaining API quota gauges by @jeremychoi in https://github.com/mindersec/minder/pull/6703
- Add fallback support for REST data source handler by @shreyaabaranwal in https://github.com/mindersec/minder/pull/6729
Bug Fixes
- Retry remediations after transient errors by @maxi-maxima in https://github.com/mindersec/minder/pull/6684
- fix(gitlab): request project license from the API by @YAshhh29 in https://github.com/mindersec/minder/pull/6724
- Fix panic recovery logging and OAuth callback race by @NAME-ASHWANIYADAV in https://github.com/mindersec/minder/pull/6733
- Surface the HTTP status when REST remediation fails by @NAME-ASHWANIYADAV in https://github.com/mindersec/minder/pull/6747
- Fix timing attack in GitLab webhook secret verification by @th3Gli4ch in https://github.com/mindersec/minder/pull/6772
- fix: apply repository filter in ListArtifacts by @th3Gli4ch in https://github.com/mindersec/minder/pull/6769
Dependency Updates
- build(deps-dev): bump globals from 17.8.0 to 17.9.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6692
- build(deps): bump the buf group with 2 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6695
- build(deps): bump the otel group with 11 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6694
- build(deps): bump styled-components from 6.4.4 to 6.5.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6693
- build(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6698
- build(deps): bump chainguard-dev/actions/boilerplate from 1.6.29 to 1.6.30 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6699
- build(deps): bump github.com/openfga/openfga from 1.18.1 to 1.18.3 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6697
- build(deps): bump github.com/go-openapi/loads from 0.23.3 to 0.25.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6696
- build(deps): bump mobx from 6.16.1 to 7.0.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6691
- build(deps): bump github.com/lestrrat-go/httprc/v3 from 3.0.5 to 3.0.6 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6708
- build(deps-dev): bump globals from 17.9.0 to 17.10.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6707
- build(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6710
- build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.3 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6709
- build(deps): bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6706
- build(deps): bump styled-components from 6.5.0 to 6.5.2 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6705
- build(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.3.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6704
- build(deps): bump chainguard-dev/actions/boilerplate from 1.6.30 to 1.6.31 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6711
- build(deps): bump the tools group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6657
- build(deps): bump github.com/moby/buildkit from 0.28.1 to 0.31.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6712
- build(deps): bump github.com/stacklok/frizbee from 0.1.7 to 0.1.11 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6720
- build(deps): bump chainguard-dev/actions/boilerplate from 1.6.31 to 1.6.32 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6723
- build(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6722
- build(deps): bump github.com/open-feature/go-sdk from 1.17.2 to 1.18.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6721
- build(deps): bump github.com/zitadel/oidc/v3 from 3.47.5 to 3.49.2 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6719
- build(deps): bump styled-components from 6.5.2 to 6.5.3 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6716
- build(deps-dev): bump globals from 17.10.0 to 17.11.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6717
- build(deps): bump github.com/mikefarah/yq/v4 from 4.48.1 to 4.53.6 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6718
- build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6743
- build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /tools by @dependabot[bot] in https://github.com/mindersec/minder/pull/6742
- build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6744
- build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.2 to 2.14.6 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6738
- build(deps): bump github.com/rs/zerolog from 1.34.0 to 1.35.1 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6737
- build(deps): bump mobx from 7.0.0 to 7.0.3 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6734
- build(deps-dev): bump @humanfs/node from 0.16.6 to 0.16.8 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6745
- build(deps): bump the otel group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6735
- build(deps): bump buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go from 1.36.12-20260709200747-435963d16310.1 to 1.36.12-20260825204119-511051f7f437.1 in the buf group across 1 directory by @dependabot[bot] in https://github.com/mindersec/minder/pull/6736
- build(deps): bump the codeql group with 3 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6739
- build(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6740
- build(deps): bump chainguard-dev/actions/boilerplate from 1.6.32 to 1.6.33 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6741
- build(deps): bump the tools group in /tools with 6 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6731
- build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /tools by @dependabot[bot] in https://github.com/mindersec/minder/pull/6757
- build(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6760
- build(deps): bump chainguard-dev/actions/boilerplate from 1.6.33 to 1.6.34 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6767
- build(deps): bump the buf group with 2 updates by @dependabot[bot] in https://github.com/mindersec/minder/pull/6763
- build(deps): bump github.com/charmbracelet/glamour from 0.10.0 to 1.0.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6764
- build(deps-dev): bump globals from 17.11.0 to 17.12.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6762
- build(deps): bump golang.org/x/oauth2 from 0.36.0 to 0.37.0 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6765
- build(deps): bump github.com/grpc-ecosystem/go-grpc-middleware/v2 from 2.3.3 to 2.3.4 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6766
- build(deps): bump svgo from 2.8.3 to 2.8.4 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6758
- build(deps): bump colord from 2.9.3 to 2.10.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6759
- build(deps): bump github.com/containerd/containerd from 1.7.33 to 1.7.35 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6770
- build(deps): bump joi from 17.12.2 to 17.13.7 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6761
- build(deps): bump glob from 10.4.5 to 10.5.0 in /docs by @dependabot[bot] in https://github.com/mindersec/minder/pull/6771
- build(deps): bump github.com/google/osv-scalibr from 0.3.4 to 0.5.2 by @dependabot[bot] in https://github.com/mindersec/minder/pull/6179
New Contributors
- @jeremychoi made their first contribution in https://github.com/mindersec/minder/pull/6703
- @YAshhh29 made their first contribution in https://github.com/mindersec/minder/pull/6724
- @shreyaabaranwal made their first contribution in https://github.com/mindersec/minder/pull/6729
- @NAME-ASHWANIYADAV made their first contribution in https://github.com/mindersec/minder/pull/6733
- @th3Gli4ch made their first contribution in https://github.com/mindersec/minder/pull/6772
Full Changelog: https://github.com/mindersec/minder/compare/v0.3.1...v0.3.2
