Repository navigation
chore: merge main into develop - #685
Merged
Merged
Conversation
…dates (#650) Bumps the dependencies group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@0f481fc...03ad4de) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Anurag Bandyopadhyay <angbpy@gmail.com>
Bumps the dependencies group with 3 updates: [actions/setup-java](https://github.com/actions/setup-java), [gradle/actions/wrapper-validation](https://github.com/gradle/actions) and [gradle/actions/setup-gradle](https://github.com/gradle/actions). Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@03ad4de...b6effb0) Updates `gradle/actions/wrapper-validation` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f131e8...9c97196) Updates `gradle/actions/setup-gradle` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f131e8...9c97196) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: gradle/actions/wrapper-validation dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: gradle/actions/setup-gradle dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /pkg/js Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): resolve JavaScript audit vulnerabilities (#659) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com>
#664) * feat: support reserved condition name on type restrictions * fix build failure
…he dependencies group (#666) chore(deps): bump docker/setup-buildx-action in the dependencies group Bumps the dependencies group with 1 update: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action). Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...37fe631) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(graph): prevent nil-pointer panic and corruption in parseThis Fix production panic when parseThis encounters degenerate RelationReference with oneof set but empty (relation:"" or wildcard:nil). Such references survive proto validation but fell through all branch conditions, leaving curNode nil. Boxed into graph.Node interface, typed-nil defeated guards and panicked on promoted ID() call. Changes: - Replace non-exclusive ifs with exhaustive switch in parseThis - Move curNode inside loop to prevent stale value leakage across iterations - Add isNilNode() helper to detect typed-nil *AuthorizationModelNode - Check type assertions in upsertEdge/hasEdge (were discarding ok value) - Validate GetType() for special chars that break node label format - Align weighted_graph_builder.go parseThis with same switch structure Tests added covering panic scenarios, stale curNode corruption, and typed-nil guards. Default case degrades empty relation to concrete type, matching transformer/jsontodsl.go parseTypeRestriction behavior. Fixes panic reported in production (trace: graph_builder.go:261 -> <autogenerated>:1). Also prevents silent graph corruption where degenerate entry in non-first position inherits previous iteration's node, merging conditions onto wrong edge. * test(graph): fix expectPanic flags and address review feedback Critical fix: Changed expectPanic from true to false in first two test cases. The flag being true meant graph topology assertions were never running - tests would pass even with completely wrong graphs. Now properly validates nodes, edges, and conditions. Additional improvements: - findEdge: Filter by edgeType and tuplesetRelation for multigraph correctness - DRY: Extract classifyRelationReference() helper to eliminate duplication across graph_builder.go and weighted_graph_builder.go parseThis - Comment brevity: Shorten 15-line comment to 3 lines - Test coverage: Add cases for special chars and nil wildcard All tests pass (14 new malformed-relation tests + 302 existing tests).
* ci: pin the Go version used by the lint job The lint job asked for >=1.25.0 with check-latest, so it moved to Go 1.27 as soon as that showed up in the manifest. golangci-lint v1.64.8 cannot read Go 1.27 export data and reports every antlr symbol in pkg/go/gen as undefined. The build matrix pins 1.25 and 1.26, which is why only lint went red. golangci-lint v2 does not help yet either, it fails parsing 1.27's own stdlib. So pin the toolchain to 1.26 and pin the linter version next to it so the two are raised together. * ci: keep check-latest on the pinned lint toolchain Bounded to 1.26 it cannot pull in 1.27, and it picks up patch releases instead of whatever the runner image happens to have cached.
) Bumps the dependencies group in /pkg/go with 2 updates: [github.com/stretchr/testify](https://github.com/stretchr/testify) and google.golang.org/protobuf. Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com>
…n /pkg/go in the dependencies group (#670) chore(deps): bump github.com/stretchr/testify Bumps the dependencies group in /pkg/go with 1 update: [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/stretchr/testify` from 1.12.0 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.12.0...v1.12.1) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…dencies group (#671) chore(deps): bump actions/setup-java in the dependencies group Bumps the dependencies group with 1 update: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...dd06d9c) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…g/go (#675) chore(deps): bump google.golang.org/grpc in /pkg/go Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…676) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…678) Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8. - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) --- updated-dependencies: - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…g/go (#680) chore(deps): bump google.golang.org/grpc in /pkg/go Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.1...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…dencies group (#683) chore(deps): bump actions/setup-java in the dependencies group Bumps the dependencies group with 1 update: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@dd06d9c...de7274f) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-develop # Conflicts: # .github/workflows/pkg-java-build.yaml # .github/workflows/pkg-java-release.yaml
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
Both reviewed workflows consistently apply the intended setup-java update.
Review effort: Lite
Findings: None
What changed in this PR
Resynchronizes develop with main and updates Java workflow action pins.
Changes:
- Upgrades
actions/setup-javato v6.0.1. - Applies the pin consistently across Java build and release jobs.
| File | Summary |
|---|---|
.github/workflows/pkg-java-release.yaml |
Updates setup-java pins for publishing jobs. |
.github/workflows/pkg-java-build.yaml |
Updates setup-java pins for Java CI jobs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
rhamzeh
approved these changes
Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-syncs develop with the current main.
develop diverged from main because the previous sync (#673) landed as a squash merge, which collapses the merge into a single-parent commit and drops the ancestry link to main. develop already carried nearly all of main's content from that squash, so the only real drift was a handful of files; git just no longer recognised main as merged in.
This brings develop up to main's tip and, because it is a real two-parent merge commit, restores the ancestry link so future syncs are clean.
Conflicts: only the
setup-javapin inpkg-java-build.yamlandpkg-java-release.yaml, resolved to main's v6.0.1. Thepkg/js/.gitignoreandpkg/js/errors.tsdifferences are develop's own intentional changes from #616 (verified against the merge base) and are correctly preserved.Verified:
go build ./...clean, full Go suite passing.Important
Merge this with Create a merge commit — do not squash. Squashing is what broke the ancestry last time and would break it again.