DoDiODev opened a new pull request, #9198: URL: https://github.com/apache/devlake/pull/9198
### Summary Dependabot (#9099) already moved `backend/test/e2e/remote/docker-compose.test.yml` to `postgres:18.6-alpine`, but it cannot see the remaining pins: the `docker-compose-dev-*.yml` file names do not match its compose filename pattern, and the `github-actions` ecosystem only reads `uses:`, not `services:` images. This PR brings those remaining pins in line. ### Changes | File | Image | From | To | |---|---|---|---| | `docker-compose-dev-postgresql.yml` | `postgres` | `18.4` | `18.6` | | `.github/workflows/test-e2e.yml` (`e2e-postgres` service) | `postgres` | `18.4` | `18.6` | | `docker-compose-dev-mysql.yml`, `docker-compose-dev-postgresql.yml` | `quay.io/oauth2-proxy/oauth2-proxy` | `v7.15.3-amd64` | `v7.15.5-amd64` | oauth2-proxy [v7.15.5](https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.5) fixes two critical authentication bypasses ([GHSA-63jm-59jj-478j](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-63jm-59jj-478j), [GHSA-wr5q-7wxw-x568](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-wr5q-7wxw-x568)) and a moderate credential disclosure ([GHSA-hhqp-vx7f-5c6m](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-hhqp-vx7f-5c6m)), plus the CVE fixes of v7.15.4. Its stricter handling of `--skip-auth-route`/`--skip-auth-regex` and `X-Forwarded-Uri` only matters for deployments that configure those options; the dev compose files configure the proxy solely via `.env` and set none of them. PostgreSQL 18.6 is a minor (bug-fix/security) release within 18.x, so no dump/restore is needed. No Go/Python/TypeScript source, lock file or `devops/releases/**` change. ### Verification | Check | Result | |---|---| | `docker compose -f docker-compose-dev-{mysql,postgresql}.yml config -q` | ✅ | | `docker manifest inspect` for both new tags | ✅ | | Unmodified upstream workflows in the fork on top of current `main` | ✅ all 9 green, incl. [`e2e-postgres`](https://github.com/DoDiODev/devlake/actions/runs/37469229037/job/112288038977) (log shows `postgres:18.6`), [`e2e-mysql`](https://github.com/DoDiODev/devlake/actions/runs/37469229037/job/112288039514) and [`test`](https://github.com/DoDiODev/devlake/actions/runs/37469229013/job/112288038810) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
