* Move vulnerable dependencies to patched versions
Backend (Cargo.lock): openssl 0.10.55 -> 0.10.81, bytes 1.12.1, h2 0.3.27,
tokio 1.26 -> 1.47.1 (mio 1.x), url 2.3.1 -> 2.5.7 (idna 1.1), rand 0.8.8,
spin 0.9.9, time 0.3.55, ring 0.17.14.
Three alerts needed manifest changes:
- tokio-rustls 0.23 -> 0.26 (rustls 0.20 -> 0.23), which is what moves
ring off 0.16. The ring provider is selected explicitly instead of the
default aws-lc-rs, so the image build needs no cmake/C toolchain; roots
still come from webpki-roots (now 1.0). Checked against live hosts: a
valid certificate connects, an expired one and a name mismatch are
refused.
- maxminddb 0.23 -> 0.27: lookup() now returns a result that is decoded,
and the City model's fields are no longer Options. The existing
locate_random_ip test (12.5.56.25 -> "Gardena") passes.
- structopt (clap 2, which pulled atty) -> clap 4 derive in telemetry_core,
telemetry_shard and the soak tests; criterion 0.4 -> 0.5 for the same
reason. Both binaries' arguments were parsed before and after for the
docker-compose invocations and a set of other cases: identical results,
except that `--feed-timeout` given without a value is now an error where
structopt silently used the default. --denylist keeps taking every value
up to the next flag (num_args = 1..), as its help text describes.
Frontend: npm audit fix within ranges, and webpack-dev-server 4 -> 5.2.6
(no devServer options are configured, so nothing to migrate). Left:
sockjs -> uuid 8 inside webpack-dev-server 5; the fix is 6.0, which needs
Node 22 while CI runs 20, and it is the local dev server only.
Checked: backend cargo test (58 passed), clippy, fmt; frontend lint,
prettier, test and build.
* Reject an invalid byte size instead of panicking
ByteSize::from_str called expect("all ascii digits") on the numeric part,
so a value with no digits ("abc", "k") or one too large for usize
aborted the shard at startup with a panic instead of a usage error, and
the suffix multiplication could overflow silently in release builds.
Parse errors now return Err and the multiplication is checked.
The new test fails on the old code (panic) and passes on this one.
Debian 11 left LTS at the end of August 2026. The runtime stage's
`apt-get install openssl` now fails: the index still names
openssl 1.1.1w-0+deb11u8 but deb.debian.org answers 404 for the file, so the
image cannot be built at all.
Moving only the runtime to bookworm would break the binaries: openssl-sys is in
the lock, so they link the system libssl, and a bullseye build wants libssl1.1,
which bookworm does not ship. Both stages move together: the builder becomes
rust:1.88-bookworm (the same toolchain ci-unified carried) and the runtime
bookworm-slim, so the binaries link the libssl3 they run with.
* fix: typo incrementing instead of decrementing
* Add tests for MostSeen decrement bug
This bug requires a specific set of circumstances to trigger
and become visible:
1. decrement a label that is non-zero but not first
2. repeat the decrement at least best_count()/2 times
3. increment that label
4. check the best count
---------
Co-authored-by: teor <teor@riseup.net>
* [ci] Migrate CI from GitLab to GitHub
* fix docker path
* unite backend jobs into one workflow
* rm files
* add cache-on-failure to tests cache
* add deploy workflow
* change wfl name
* readme
* fix readme
* typo
* added functionality for specifying node details per each node
* Backend done
Added new item in Ranking
node_map, mapping node id to node detail
Co-authored-by: Cyndie Kamau <cyndiekamaa@gmail.com>
* feat: last frontend working version
* chore: Clean up unused code
* fix(frontend): update node details to carry 10 fields
* chore: remove unnecessary code
* chore: run cargo fmt for formatting
* chore: run prettier to format frontend
* fixed e2e tests added missing struct params
* remoted .idea file
* Hide new columns by default, default to - if no data, and remove .idea folder
---------
Co-authored-by: MrishoLukamba <abdulrazzaqlukamba@gmail.com>
Co-authored-by: Cyndie Kamau <cyndiekamaa@gmail.com>
* Adding gitspiegel-trigger workflow
Using a workflow to trigger mirroring instead of a webhook allows us to reuse "Approving workflow runs from public forks" GitHub feature to somewhat protect us from malicious PRs
* Update gitspiegel-trigger.yml
* frontend: Update package lock
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* frontend/stats: Format linux kernel version
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Add [64; 128) RAM bucket
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Parse kernel string to include only version numbers
The linux kernel version string is parsed to include only
the kernel version, major version and minor version.
Ignoring the patch number and kernel specific info leads to
a better aggregation of data.
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Fix typo
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* core: Add CPU vendor to reported chain stats
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* frontend: Propagate CPU vendor to UI
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Parse kernel version by `+`
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Add CPU vendors and ignore ascii case
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* Revert "frontend/stats: Format linux kernel version"
This reverts commit 411b9a4ceef9c664816404eaee1fb64f61fe85b3.
* backend: Fix plus sign test
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Trim kernel versions
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
* backend: Modify cpu_vendor
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
---------
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
dependabot[bot]