[zeevmoney]

Linear: PER-15886 · follow-up to #338

What this changes

Dependency updates (Dependabot)

Folds in the open Dependabot PRs, each as Dependabot's own commit:

PR	Update
#349	golang 1.26-bookworm → 1.27-bookworm (OPA build stage)
#352	rust 1.94-alpine → 1.98-alpine
#350	reqwest 0.12 → 0.13.5
#351	nix 0.29 → 0.31.3
#353	utoipa-scalar 0.3 → 0.4
#354	confique 0.3 → 0.4
#355	redis 0.29 → 1.7.1
#356	scalar-fastapi 1.0.3 → 1.8.2 (the OPAL half is reverted, see below)
#357	typer floor → 0.27.2
#359	urllib3 floor → 2.8.0
#361	chart-releaser-action 1.7.0, kind-action 1.15.0
#362	configure-aws-credentials 4.3.1 → 6.3.0
#363	setup-qemu-action 3.7.0 → 4.4.0
#364	slack-github-action 3.0.3 → 4.0.0
#365	setup-buildx-action 3.12.0 → 4.4.1
#367	sha2 0.10 → 0.11
#368	utoipa-axum 0.2 → 0.3
#370	utoipa 5.3 → 6.0
#372	protobuf floor → 7.36.2
#373	uvicorn floor → 0.54.0
#375	aiohttp floor → 3.14.3

#369, #376 and #377 duplicated updates already here and were closed.

Follow-up fixes:

• sha2 0.11: the digest type no longer supports {:x}. A hex_prefix() helper renders the same 16-character cache-key suffix, so existing cache entries still match, and a test pins it.
• redis 1.x: ErrorKind::TypeError was renamed UnexpectedReturnType. redis-test moves to 1.0.4 so the test build has a single redis version.
• OPAL stays at 0.9.6. opal-common and opal-client 0.9.9 declare Requires-Python <3.13, and the image runs 3.13, so the OPAL half of deps: bump the minor-and-patch group with 3 updates #356 is reverted. requirements.txt explains this at the pin.
• scalar-fastapi is held at 1.8.2, because 1.9.0 and later require pydantic 2, which OPAL caps (pydantic<2).

Not included, because OPAL caps them:

• deps: update tenacity requirement from <9,>=8.0.1 to >=9.1.4,<10 #358 tenacity 9 and deps: update pydantic requirement from <2,>=1.9.1 to >=2.13.5,<3 #360 pydantic 2 are left out.
• deps: update fastapi requirement from <1,>=0.124.0 to >=0.141.1,<1 #374 fastapi ≥ 0.141 is left out, because fastapi 0.126 and later require pydantic 2. Dependabot now ignores fastapi>=0.126.0.
• deps: bump the minor-and-patch group with 3 updates #371 repeated the OPAL 0.9.9 and scalar-fastapi 1.9.1 bumps, both handled above.
• dependabot.yml now ignores pydantic>=2, tenacity>=9 and scalar-fastapi>=1.9.0, next to the existing starlette/ddtrace entries.

Scheduled security scan: one report, green on findings

• New Slack report (format_security_report.py), modelled on agent-security's. The message is:

  • a headline count;
  • one line per scanner and tag;
  • one line per advisory, giving the package, advisory link, fixed version and who has to act (a release rebuild, permit-opa, the golang base digest, or an exact pin), and naming every scanner and tag that saw it.

  It reuses the existing Trivy classifier and the Dependabot waiver filter.

• Findings no longer fail the run. A job goes red only when its scan did not complete (a scanner error, an unreadable report or alert feed) or when the report never reached Slack. The report then lists that scanner as "did not complete". The PR gate and the release gate still block.

• notify-slack.yml takes an optional pre-escaped message, sent as-is. The old path escaped the per-tag lines twice, which is where ->gt; came from.

• The report lists the whole unwaived Dependabot backlog every run. The 73-hour window and the all_alerts input are removed.

• security-digest.yml reads the last scan's security-report artifact, because a green run no longer means "no findings".

Releases: Docker Scout as well as Trivy

• scan-pdp-release loads each platform as permitio/pdp-v2:release-scan and runs Docker Scout alongside Trivy, using the same pull-only OIDC login as the PR gate. A finding from either scanner, or a report that is missing or unreadable, blocks the publish.
• The OpenVEX doc gets a @release-scan product on every statement, so the waivers apply there. Doc version is now 18.

Rust: Cargo.lock and cargo audit

• Cargo.lock is committed. It was ignored by both git and Docker, so every build resolved crates.io afresh. The image build (cargo chef cook, cargo zigbuild) and the Rust CI job now run with --locked.
• New cargo audit job in tests.yml. A vulnerable crate fails it, and with it a release. Unmaintained and yanked crates are reported, not failed. It uses cargo-audit 0.22.2, built from crates.io with --locked and cached.
• On PRs, cargo audit keeps one sticky comment (<!-- pdp-cargo-audit -->) in agent-security's layout: severity badges, a table of high/critical advisories, a fold for the rest, plus unmaintained and yanked crates. An unreadable report renders "could not be parsed" and fails the check.
• cargo audit joins the scheduled report. The formatter computes CVSS v3 scores from the vectors, lists advisories with no score under "Unscored" (they trigger the message too), and merges RustSec aliases with Dependabot alerts.

CI hygiene

• prek replaces pre-commit in the pre-commit job, using prek 0.5.4 with a cache. The job name, which is the required check, is unchanged.
• Dependabot now updates the pre-commit hook versions (the pre-commit ecosystem, weekly, 7-day cooldown).
• Pre-commit hooks are pinned by commit SHA, with the tag kept as a # frozen: comment. The commented-out mypy hook is removed.
• docker/build-push-action 5.4.0 → 7.4.0 (Node 24). Build-record artifact upload is off, which keeps v5's behaviour.
• The pre-commit job drops pre-commit/action, which bundled actions/cache@v4 (Node 20). It now uses actions/cache 6.1.0 (Node 24) and Python 3.13.
• All runners are pinned to ubuntu-24.04, ahead of ubuntu-latest moving to Ubuntu 26 on 2026-10-19.

Corrections

• CodeQL set IS_DEBUG_MODE deafult Flase #116 (rust/cleartext-logging): the config tests no longer print the loaded API key or every PDP_* environment variable.
• CVE-2026-50271 waiver: PDP_ENABLE_MONITORING=false is not an independent mitigation, because remote config can enable monitoring. The waivers and the Dockerfile comment now name the extract-style setting as the mitigation.
• The docs and release.yml now state the dockerhub-release approval rule as configured: self-review is allowed.
• The OPA builder is described as Go 1.27.
• Stale "gaps" entries are removed from the vulnerability doc: the backlog-as-count and permit-opa-on-main entries.

Verification

• Rust: cargo fmt --check, cargo clippy --all --all-targets -D warnings and cargo test --all pass locally with --locked (225 tests). cargo audit finds no vulnerable crates, and 1 unmaintained-crate warning.
• Python:
  • 143 CI-script tests pass, including 57 new ones for the Slack report and the cargo audit comment;
  • the new requirements resolve with pip on CPython 3.13;
  • waiver parity is OK.
• actionlint is clean. zizmor (--persona regular, online audits) reports no findings. prek passes on every file.
• The report was rendered locally against real data: a scheduled run's Trivy report, Scout SARIF from code scanning, and the live Dependabot alerts.

Not exercised by this PR's CI:

• the release Scout leg, first run by the next rc;
• configure-aws-credentials v6, first run by the next final release (ECS);
• the scheduled scan and digest, which can be run by hand after merge;
• the Redis integration tests, which are #[ignore] and need a Redis server.

Required tests before promoting 0.9.17

Run these against the 0.9.17-rc2 image (the first release built from this PR) before promoting it.

Runtime behaviour changes

• TLS (reqwest 0.13 now uses rustls with aws-lc-rs instead of OpenSSL). Point PDP_OPA_URL at an https:// OPA endpoint, once with a publicly trusted certificate and once with a private CA installed in the container's system trust store. /allowed should return decisions, with no TLS errors in the pdp-server log. Repeat with the default http://localhost:8181 as the control.
• Redis cache (redis 1.7). Set PDP_CACHE_STORE=redis and PDP_CACHE_REDIS_URL=redis://<host>:6379. Check all of these:
  • the first /allowed call writes an opa:allowed:* key;
  • a repeated call is served from the cache;
  • a missing key falls through to OPA without an error;
  • /health reports the cache healthy;
  • stopping Redis surfaces an error rather than a hang.
• In-memory cache (sha2 0.11). Set PDP_CACHE_STORE=in-memory. Repeated identical queries should hit the cache. Key format is pinned by a unit test, so this is a smoke check.
• Config loading (confique 0.4). Start with a typical env (PDP_API_KEY, PDP_PORT, PDP_CACHE_TTL, PDP_OPA_URL, PDP_OPA_CLIENT_QUERY_TIMEOUT). The values should be applied, with no config parse errors at startup.
• Watchdog (nix 0.31). Send SIGTERM to the container: it should shut down cleanly. Kill the horizon process inside a running container: the watchdog should restart or exit as it does today.
• API docs. Check that /scalar (scalar-fastapi 1.8.2) and the Rust server's OpenAPI document (utoipa 6) render, and that the documented routes and schemas match 0.9.16.

Pipelines

• rc2 release run:
  • scan-pdp-release runs Trivy and Docker Scout on amd64 and arm64;
  • the waived starlette/ddtrace CVEs stay suppressed under @release-scan;
  • the Scout SARIF is in the run's artifact;
  • publish-pdp-release pushes, and the digest check passes.
• Final 0.9.17 release run: update-pdp-api-ecs-service assumes the AWS role through configure-aws-credentials v6 and the ECS rollout completes.
• Scheduled scan, run by hand with gh workflow run scheduled-security-scan.yml:
  • the Slack message uses the new format and lists Trivy, Scout, cargo audit and Dependabot;
  • the run is green even if there are findings;
  • a security-report artifact is uploaded.
• Weekly digest (Monday, or gh workflow run security-digest.yml): the "Published-image scan" line shows the last scan's headline, read from that artifact.

Not covered by any automated test

• pdp-server's two Redis integration tests are #[ignore] and need a Redis server, so the Redis check above is the only coverage for the redis 1.x upgrade.

🤖 Generated with Claude Code

[linear-code]

PER-15886

PER-16903

[github-actions]

✅ Cargo Security Audit

No vulnerable crates in Cargo.lock.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.