From 4be67828ba747427d097009af4d2beb393b04019 Mon Sep 17 00:00:00 2001 From: Ajit Pratap Singh Date: Wed, 21 Oct 2026 16:52:00 +0530 Subject: [PATCH 1/2] chore(deps,test): patch certifi and markdown-it; bound testcontainer startup by test deadline - certifi 2026.7.22 -> 2026.10.19 (critical: bundled emSign roots with compromised intermediate keys) in the hash-pinned Sentry script deps. - markdown-it 14.3.2 -> 14.3.3 in the VS Code extension lockfile (two quadratic-time DoS advisories). - MySQL/MariaDB/Postgres loader tests start containers under a context that ends 30s before the test binary deadline, so a slow CI image pull or init skips the integration test instead of panicking the whole package. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01RkzVu3JY9Y6BRWfjesWts9 --- .github/scripts/requirements-sentry.txt | 6 +++--- pkg/schema/mysql/loader_test.go | 11 ++++++++++- pkg/schema/postgres/loader_test.go | 10 +++++++++- vscode-extension/package-lock.json | 6 +++--- 4 files changed, 25 insertions(+), 8 deletions(-) diff --git a/.github/scripts/requirements-sentry.txt b/.github/scripts/requirements-sentry.txt index 4ee80825..d9a073c4 100644 --- a/.github/scripts/requirements-sentry.txt +++ b/.github/scripts/requirements-sentry.txt @@ -2,9 +2,9 @@ # (used by .github/workflows/sentry-to-github.yml with pip --require-hashes). # Regenerate with: # echo requests > req.in && uv pip compile req.in --generate-hashes --python-version 3.12 --no-header -o .github/scripts/requirements-sentry.txt -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b # via requests charset-normalizer==3.5.1 \ --hash=sha256:00668ebb0609751758682eb0b5857e7c35b9f00e84dfdef062e103244ec94d45 \ diff --git a/pkg/schema/mysql/loader_test.go b/pkg/schema/mysql/loader_test.go index 81d37515..a4558c61 100644 --- a/pkg/schema/mysql/loader_test.go +++ b/pkg/schema/mysql/loader_test.go @@ -76,6 +76,15 @@ func startMySQLImage(t *testing.T, image string, env map[string]string, waitFor t.Skip("Docker not available, skipping integration test") } ctx := context.Background() + // Bound the container start by the test binary's deadline. A slow image + // pull or server init on CI otherwise runs into the -timeout panic, which + // fails the whole package instead of skipping this integration test. + startCtx := ctx + if deadline, ok := t.Deadline(); ok { + var cancel context.CancelFunc + startCtx, cancel = context.WithDeadline(ctx, deadline.Add(-30*time.Second)) + defer cancel() + } req := testcontainers.ContainerRequest{ Image: image, ExposedPorts: []string{"3306/tcp"}, @@ -92,7 +101,7 @@ func startMySQLImage(t *testing.T, image string, env map[string]string, waitFor t.Skipf("testcontainers panicked: %v", r) } }() - c, err = testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{ + c, err = testcontainers.GenericContainer(startCtx, testcontainers.GenericContainerRequest{ ContainerRequest: req, Started: true, }) diff --git a/pkg/schema/postgres/loader_test.go b/pkg/schema/postgres/loader_test.go index 12fb9fde..5e4cf938 100644 --- a/pkg/schema/postgres/loader_test.go +++ b/pkg/schema/postgres/loader_test.go @@ -63,6 +63,14 @@ func startPostgresServer(t *testing.T) (db *sql.DB, host, port string) { t.Skip("Docker not available, skipping integration test") } ctx := context.Background() + // Bound the container start by the test binary's deadline so a slow CI + // pull or init skips this integration test instead of panicking the package. + startCtx := ctx + if deadline, ok := t.Deadline(); ok { + var cancel context.CancelFunc + startCtx, cancel = context.WithDeadline(ctx, deadline.Add(-30*time.Second)) + defer cancel() + } req := testcontainers.ContainerRequest{ Image: "postgres:16-alpine", ExposedPorts: []string{"5432/tcp"}, @@ -83,7 +91,7 @@ func startPostgresServer(t *testing.T) (db *sql.DB, host, port string) { t.Skipf("testcontainers panicked: %v", r) } }() - c, err = testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{ + c, err = testcontainers.GenericContainer(startCtx, testcontainers.GenericContainerRequest{ ContainerRequest: req, Started: true, }) diff --git a/vscode-extension/package-lock.json b/vscode-extension/package-lock.json index 4e0bdd52..2b87d74d 100644 --- a/vscode-extension/package-lock.json +++ b/vscode-extension/package-lock.json @@ -3811,9 +3811,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.2", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.2.tgz", - "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==", + "version": "14.3.3", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz", + "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==", "dev": true, "funding": [ { From 5a8f6f40f30001d7281fcd969a3e00ba61c6c424 Mon Sep 17 00:00:00 2001 From: Ajit Pratap Singh Date: Wed, 21 Oct 2026 20:08:11 +0530 Subject: [PATCH 2/2] test(schema): cap each container start at 75s and report deadline skips Addresses review on #837: all tests in a package share one binary deadline, so one slow start could consume the budget of the next. Each start now gets at most 75s (still ending 30s before the deadline), and a skip caused by the budget says so. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01RkzVu3JY9Y6BRWfjesWts9 --- pkg/schema/mysql/loader_test.go | 24 ++++++++++++++++++------ pkg/schema/postgres/loader_test.go | 24 ++++++++++++++++++------ 2 files changed, 36 insertions(+), 12 deletions(-) diff --git a/pkg/schema/mysql/loader_test.go b/pkg/schema/mysql/loader_test.go index a4558c61..a6bba3f5 100644 --- a/pkg/schema/mysql/loader_test.go +++ b/pkg/schema/mysql/loader_test.go @@ -79,12 +79,8 @@ func startMySQLImage(t *testing.T, image string, env map[string]string, waitFor // Bound the container start by the test binary's deadline. A slow image // pull or server init on CI otherwise runs into the -timeout panic, which // fails the whole package instead of skipping this integration test. - startCtx := ctx - if deadline, ok := t.Deadline(); ok { - var cancel context.CancelFunc - startCtx, cancel = context.WithDeadline(ctx, deadline.Add(-30*time.Second)) - defer cancel() - } + startCtx, cancel := containerStartContext(ctx, t) + defer cancel() req := testcontainers.ContainerRequest{ Image: image, ExposedPorts: []string{"3306/tcp"}, @@ -107,6 +103,9 @@ func startMySQLImage(t *testing.T, image string, env map[string]string, waitFor }) }() if err != nil { + if startCtx.Err() != nil { + t.Skipf("container start exceeded its time budget (%v): %v", startCtx.Err(), err) + } t.Skipf("testcontainers unavailable: %v", err) } t.Cleanup(func() { _ = c.Terminate(ctx) }) @@ -410,3 +409,16 @@ func TestMySQLLoader_LoadTable_EmptyName(t *testing.T) { t.Fatal("expected error for empty table name") } } + +// containerStartContext bounds one container start. Each start gets at most +// 75s and always ends 30s before the test binary's deadline, which all tests +// in the package share. A slow start therefore cannot consume the whole +// package budget, and a skip caused by it is reported as such. +func containerStartContext(ctx context.Context, t *testing.T) (context.Context, context.CancelFunc) { + t.Helper() + end := time.Now().Add(75 * time.Second) + if deadline, ok := t.Deadline(); ok && deadline.Add(-30*time.Second).Before(end) { + end = deadline.Add(-30 * time.Second) + } + return context.WithDeadline(ctx, end) +} diff --git a/pkg/schema/postgres/loader_test.go b/pkg/schema/postgres/loader_test.go index 5e4cf938..60496fc1 100644 --- a/pkg/schema/postgres/loader_test.go +++ b/pkg/schema/postgres/loader_test.go @@ -65,12 +65,8 @@ func startPostgresServer(t *testing.T) (db *sql.DB, host, port string) { ctx := context.Background() // Bound the container start by the test binary's deadline so a slow CI // pull or init skips this integration test instead of panicking the package. - startCtx := ctx - if deadline, ok := t.Deadline(); ok { - var cancel context.CancelFunc - startCtx, cancel = context.WithDeadline(ctx, deadline.Add(-30*time.Second)) - defer cancel() - } + startCtx, cancel := containerStartContext(ctx, t) + defer cancel() req := testcontainers.ContainerRequest{ Image: "postgres:16-alpine", ExposedPorts: []string{"5432/tcp"}, @@ -97,6 +93,9 @@ func startPostgresServer(t *testing.T) (db *sql.DB, host, port string) { }) }() if err != nil { + if startCtx.Err() != nil { + t.Skipf("container start exceeded its time budget (%v): %v", startCtx.Err(), err) + } t.Skipf("testcontainers unavailable: %v", err) } t.Cleanup(func() { _ = c.Terminate(ctx) }) @@ -648,3 +647,16 @@ func TestPostgresLoader_LoadTable_EmptyName(t *testing.T) { t.Fatal("expected error for empty table name") } } + +// containerStartContext bounds one container start. Each start gets at most +// 75s and always ends 30s before the test binary's deadline, which all tests +// in the package share. A slow start therefore cannot consume the whole +// package budget, and a skip caused by it is reported as such. +func containerStartContext(ctx context.Context, t *testing.T) (context.Context, context.CancelFunc) { + t.Helper() + end := time.Now().Add(75 * time.Second) + if deadline, ok := t.Deadline(); ok && deadline.Add(-30*time.Second).Before(end) { + end = deadline.Add(-30 * time.Second) + } + return context.WithDeadline(ctx, end) +}