release: 3.0.0-beta.1 — adopt lib-commons Huma wrapper (breaking)#316
Conversation
Changelog atualizado.
Changelog atualizado.
Forward-port 69842db (fetcher-026) from maintenance/v1.4.x. The plugin_crm internal datasource resolved under the wrong tenant-manager service/module (ledger/crm); map it to plugin-crm/crm-api. The configName key is unchanged. X-Lerian-Ref: 0x1
Forward-port 73a80bf (fetcher-029) from maintenance/v1.4.x. Remove the needsDecryption projection gate that skipped PII decryption for non-dotted field projections, leaking ciphertext (e.g. banking_details.account). Decryption is now content-driven and always runs on the plugin_crm path. X-Lerian-Ref: 0x1
Forward-port 4bf91bb (fetcher-026) from maintenance/v1.4.x. Add MULTI_TENANT_SERVICE_API_KEY_{SERVICE} per-service tenant-manager clients with fail-fast on token collision, and wire them into the manager and worker bootstraps. The worker reuses the shared TM client as the default; the single-client adapter constructor is removed and per-service clients are closed via a chain closer to avoid a goroutine leak. X-Lerian-Ref: 0x1
Set ALLOW_INSECURE_TLS=true in the e2e Manager/Worker env so the harness boots against the plaintext testcontainers infrastructure (the service enforces MongoDB TLS by default). X-Lerian-Ref: 0x1
Changelog atualizado.
… updates Bumps the go-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/LerianStudio/lib-auth/v2](https://github.com/LerianStudio/lib-auth) | `2.8.1` | `2.9.0` | | [github.com/LerianStudio/lib-streaming](https://github.com/LerianStudio/lib-streaming) | `1.6.2` | `1.7.0` | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.42.0` | `1.42.1` | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.25` | `1.32.27` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.104.0` | `1.104.2` | | [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber) | `2.52.13` | `2.52.14` | | [github.com/tryvium-travels/memongo](https://github.com/tryvium-travels/memongo) | `0.12.0` | `0.13.1` | Updates `github.com/LerianStudio/lib-auth/v2` from 2.8.1 to 2.9.0 - [Release notes](https://github.com/LerianStudio/lib-auth/releases) - [Changelog](https://github.com/LerianStudio/lib-auth/blob/main/CHANGELOG.md) - [Commits](LerianStudio/lib-auth@v2.8.1...v2.9.0) Updates `github.com/LerianStudio/lib-streaming` from 1.6.2 to 1.7.0 - [Release notes](https://github.com/LerianStudio/lib-streaming/releases) - [Changelog](https://github.com/LerianStudio/lib-streaming/blob/main/CHANGELOG.md) - [Commits](LerianStudio/lib-streaming@v1.6.2...v1.7.0) Updates `github.com/aws/aws-sdk-go-v2` from 1.42.0 to 1.42.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.42.0...v1.42.1) Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.25 to 1.32.27 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.32.25...config/v1.32.27) Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.24 to 1.19.26 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@credentials/v1.19.24...credentials/v1.19.26) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.104.0 to 1.104.2 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.104.0...service/s3/v1.104.2) Updates `github.com/gofiber/fiber/v2` from 2.52.13 to 2.52.14 - [Release notes](https://github.com/gofiber/fiber/releases) - [Commits](gofiber/fiber@v2.52.13...v2.52.14) Updates `github.com/tryvium-travels/memongo` from 0.12.0 to 0.13.1 - [Release notes](https://github.com/tryvium-travels/memongo/releases) - [Commits](tryvium-travels/memongo@v0.12.0...v0.13.1) --- updated-dependencies: - dependency-name: github.com/LerianStudio/lib-auth/v2 dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/LerianStudio/lib-streaming dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.42.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.19.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.104.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/gofiber/fiber/v2 dependency-version: 2.52.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/tryvium-travels/memongo dependency-version: 0.13.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Changelog atualizado.
Only PRs originating from hotfix/* or release-candidate may target main; enforce_source_branches was previously unset (defaulting to include develop).
Replace Swaggo with the canonical Huma OpenAPI 3.1 wrapper and RFC 9457 problem model. Pin lib-commons v5.10.0. BREAKING CHANGE: errors use RFC 9457 and bootstrap fails closed for auth and multi-tenancy initialization failures. X-Lerian-Ref: 0x1
X-Lerian-Ref: 0x1
X-Lerian-Ref: 0x1
X-Lerian-Ref: 0x1
Document why the scanner suppressions are safe for the environment variable name prefix and the internal Docker probe. X-Lerian-Ref: 0x1
Keep fuzz randomness non-cryptographic while documenting the bounded byte conversion and preallocating the mutation buffer. X-Lerian-Ref: 0x1
X-Lerian-Ref: 0x1
X-Lerian-Ref: 0x1
X-Lerian-Ref: 0x1
Changelog atualizado.
|
Pull requests to main can only come from:
Your source branch: Please change the base branch or create a PR from an allowed branch. |
🔍 PR Validation Summary🚫 PR Blocked — 2 blocking failures
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (72)
📝 WalkthroughWalkthroughChangesHuma API migration
Tenant-manager client routing
CRM decryption
Supporting updates
Sequence Diagram(s)sequenceDiagram
participant Client
participant Fiber
participant Huma
participant Service
Client->>Fiber: Send API request
Fiber->>Huma: Apply auth, tenant, and request context
Huma->>Service: Execute typed callback
Service-->>Huma: Return typed result or error
Huma-->>Client: Return JSON or application/problem+json
Possibly related PRs
✨ Finishing Touches✨ Simplify code
Comment |
Lerian Library Version Check
0 outdated | 4 current | 1 skipped | 0 unknown |
🔒 Security Scan Results —
|
| Stage | Status | Blocking? |
|---|---|---|
| Filesystem Scan | ✅ Clean | — |
| Docker Image Scan | ✅ Clean | — |
| Docker Hub Health Score | ✅ Clean | — |
| Pre-release Version Check | 🔴 Yes |
Trivy
Filesystem Scan
✅ No vulnerabilities or secrets found.
Docker Image Scan
✅ No vulnerabilities found.
Docker Hub Health Score Compliance
✅ Policies — 4/4 met
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | ✅ Passed |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
Pre-release Version Check
🚫 Found 1 unstable version pin(s). Only stable releases (x.y.z) and SHA-based pins are allowed.
| File | Line | Content |
|---|---|---|
./go.mod |
68 | github.com/LerianStudio/fetcher/pkg/engine v1.0.13-beta.5 |
Replace pre-release suffixes (
-alpha,-beta,-rc,-dev, etc.) with stable releases.
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 87.2% ✅ PASS |
| Threshold | 80% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/fetcher/v2/components/worker/internal/services |
89.7% |
Generated by Go PR Analysis workflow
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 89.7% ✅ PASS |
| Threshold | 80% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/fetcher/v2/components/manager/cmd/huma-spec |
33.4% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/adapters/cache |
100.0% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/adapters/http/in |
89.4% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/services/command |
92.8% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/services/query |
96.4% |
Generated by Go PR Analysis workflow
🔒 Security Scan Results —
|
| Stage | Status | Blocking? |
|---|---|---|
| Filesystem Scan | ✅ Clean | — |
| Docker Image Scan | ✅ Clean | — |
| Docker Hub Health Score | ✅ Clean | — |
| Pre-release Version Check | 🔴 Yes |
Trivy
Filesystem Scan
✅ No vulnerabilities or secrets found.
Docker Image Scan
✅ No vulnerabilities found.
Docker Hub Health Score Compliance
✅ Policies — 4/4 met
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | ✅ Passed |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
Pre-release Version Check
🚫 Found 1 unstable version pin(s). Only stable releases (x.y.z) and SHA-based pins are allowed.
| File | Line | Content |
|---|---|---|
./go.mod |
68 | github.com/LerianStudio/fetcher/pkg/engine v1.0.13-beta.5 |
Replace pre-release suffixes (
-alpha,-beta,-rc,-dev, etc.) with stable releases.
Summary
Promotes
developtomain— 30 commits, releasing 3.0.0-beta.1.The headline change is the breaking adoption of the lib-commons Huma wrapper in the Manager. The rest is dependency/infra bumps, tenant-manager auth, and correctness fixes across Worker and pkg.
Breaking change
feat(manager)!: adopt lib-commons Huma wrapper— Manager now serves its OpenAPI 3.1 spec and RFC 9457 problem model throughlib-commons/v5(net/http/{openapi,problem}) instead of the local wrapper. Error envelope and spec-gen path changed.Features
feat(pkg): add per-service tenant-manager API keysFixes & hardening
fix(worker): always decrypt plugin_crm PII fieldsfix(pkg): correct plugin_crm datasource mappingfix(worker): convert Mongo pool size safelyfix(pkg): document controlled security inputsfix(tests): bound fuzz byte mutationfix(manager): address CodeRabbit review findings+ document OpenAPI artifact permissionsDependencies & infra
lib-streaming→ v1.8.0Scope
73 files changed, +9477 / -9364https://claude.ai/code/session_01NAGsmt2FuMYhK3G5uuMqb1