Skip to content

Track changes from upstream#5

Draft
AlekSi wants to merge 114 commits into
mainfrom
ferretdb
Draft

Track changes from upstream#5
AlekSi wants to merge 114 commits into
mainfrom
ferretdb

Prepare v0.107.0-ferretdb-2.7.0 release

e638354
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL completed Nov 9, 2025 in 4s

Error when processing the SARIF file

New alerts in code changed by this pull request

Security Alerts:

  • 10 critical
  • 1 high
  • 1 medium

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 135 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Cache Poisoning via execution of untrusted code High

Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code. (
pull_request_target
Loading
).

Check failure on line 231 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
pull_request_target
Loading
)

Check failure on line 229 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Artifact poisoning Critical

Potential artifact poisoning in
make -C packaging docker-init
Loading
, which may be controlled by an external user (
pull_request_target
Loading
).

Check failure on line 241 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
pull_request_target
Loading
)

Check failure on line 239 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Artifact poisoning Critical

Potential artifact poisoning in
make -C packaging docker-build POSTGRES_VERSION=${ matrix.pg } DOCUMENTDB_VERSION=${ steps.version.outputs.package_version } FILE=development OUTPUT='type=image' TAGS='${ steps.version.outputs.docker_development_tag_flags }'
Loading
, which may be controlled by an external user (
pull_request_target
Loading
).

Check failure on line 251 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
pull_request_target
Loading
)

Check failure on line 249 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Artifact poisoning Critical

Potential artifact poisoning in
make -C packaging docker-build POSTGRES_VERSION=${ matrix.pg } DOCUMENTDB_VERSION=${ steps.version.outputs.package_version } FILE=production OUTPUT='type=image' TAGS='${ steps.version.outputs.docker_production_tag_flags }'
Loading
, which may be controlled by an external user (
pull_request_target
Loading
).

Check failure on line 281 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
pull_request_target
Loading
)

Check failure on line 279 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Artifact poisoning Critical

Potential artifact poisoning in
make -C packaging docker-build POSTGRES_VERSION=${ matrix.pg } DOCUMENTDB_VERSION=${ steps.version.outputs.package_version } FILE=development OUTPUT='type=image,push=true' TAGS='${ steps.version.outputs.docker_development_tag_flags }'
Loading
, which may be controlled by an external user (
pull_request_target
Loading
).

Check failure on line 291 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
pull_request_target
Loading
)

Check failure on line 289 in .github/workflows/ferretdb_packages.yml

See this annotation in the file changed.

Code scanning / CodeQL

Artifact poisoning Critical

Potential artifact poisoning in
make -C packaging docker-build POSTGRES_VERSION=${ matrix.pg } DOCUMENTDB_VERSION=${ steps.version.outputs.package_version } FILE=production OUTPUT='type=image,push=true' TAGS='${ steps.version.outputs.docker_production_tag_flags }'
Loading
, which may be controlled by an external user (
pull_request_target
Loading
).

Check warning on line 59 in .github/workflows/ferretdb_go_tests.yml

See this annotation in the file changed.

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}