stegololz opened a new pull request, #74647: URL: https://github.com/apache/airflow/pull/74647
This PR updates the chart's default PgBouncer image from 1.23.1 to 1.25.2, and the PgBouncer exporter image from 0.18.0 to 0.21.0. PgBouncer 1.25.2 fixes CVE-2026-6664, CVE-2026-6665 and CVE-2026-6666. CVE-2026-6664 lets an unauthenticated client crash PgBouncer with a malformed SCRAM packet. The chart uses `scram-sha-256` by default, so default installs are affected. The exporter must be updated too. Version 0.18.0 cannot parse the stats columns added in PgBouncer 1.24 and stops exporting metrics. This is why the earlier 1.24 bump (#45542) was rolled back in #47416. Exporter 0.21.0 supports these columns and is built with Go 1.27.2, replacing the EOL Go 1.23.7. Metric names are unchanged. Other changes: - Both images run `apk upgrade` and no longer install unused libressl/openssl packages. - PgBouncer tarballs no longer include man pages, so the Dockerfile builds only the binary. `make install` would otherwise require pandoc. PgBouncer 1.26.0 is not used yet, because exporter 0.21.0 cannot parse its new `SHOW STATS` columns. Testing (amd64, images built locally): - Trivy finds no vulnerabilities in either image. The current images have 5 HIGH (PgBouncer) and 1 CRITICAL / 30 HIGH (exporter). - Smoke test with Postgres, PgBouncer (`scram-sha-256`) and the exporter: queries work, the health check passes, and `/metrics` returns 51 series with no `unexpected column` errors. - prek hooks pass on the changed files. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
