-
Notifications
You must be signed in to change notification settings - Fork 1.2k
[StepSecurity] Apply security best practices #3697
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
27 commits
Select commit
Hold shift + click to select a range
df4cf2a
[docs] : google model armor as guardrail provider docs (#3660)
Madhuvod 05a673d
fix: removes manual setting of type custom for anthropic tools (#3652)
roroghost17 9ff81fb
fix: fix ListModels for keyless providers (#3655)
roroghost17 6c9db72
feat: preserve time filter params when navigating between sidebar ite…
impoiler ed3c5f0
refactor: move auth check from login component to route loader with r…
impoiler 6c3f6e5
feat: add team and bu filter support for dashboard and logs (#3650)
impoiler 97b3a70
fix: map vertex trrafic type to bifrost service tier (#3662)
TejasGhatte 63643a3
fix: fixes the start time setting for correct ttft metric value (#3668)
roroghost17 ec4b057
fix: preserve tool call stop reason in Anthropic streaming fallback (…
dicnunz 045a3e8
feat(governance): add virtual key blocked models (#3653)
Vaibhav701161 86ad3a4
table updates (#3665)
akshaydeo 874a614
Revert "feat: add `access_profile_id` to virtual keys for direct acce…
BearTS 2d7ede2
chore: drop `access_profile_id` column from `governance_virtual_keys`…
BearTS 3596c55
test: add v1.5.3 migration test coverage for feature flags, temp toke…
BearTS fb79c18
adds created_by for virtual keys (#3672)
akshaydeo 685130d
fix: ensure toasts remain clickable above modal overlays (#3674)
impoiler 4e985bb
fix: remove save/cancel icons and fix sheet layout growth in routing …
impoiler 6dd1478
fix: make virtual keys table fill available height with sticky header…
impoiler 249cc51
v1.5.4 cut (#3680)
akshaydeo d66143d
fix idle timeout panic (#3677)
akshaydeo d898390
mcp log fingerprinting (#3678)
akshaydeo 78376b2
Merge branch 'main' into dev
akshaydeo d710c21
Merge branch 'main' into dev
akshaydeo 5f1e60f
fix: update e2e ui tests (#3687)
sammaji f59c88c
fix: updates mcp oauth api tests (#3693)
sammaji e1fbd8d
[StepSecurity] Apply security best practices
stepsecurity-app[bot] 28db58c
Merge branch 'dev' into chore/GHA-221424-stepsecurity-remediation
akshaydeo File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,7 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - fix: idle timeout panic in the streaming idle-timeout reader | ||
| - fix: short-circuit `IdleTimeoutReader` reads when the connection is already closed (#3672) | ||
| - fix: preserve tool call stop reason in Anthropic streaming fallback (#3640) (thanks [@dicnunz](https://github.com/dicnunz)!) | ||
| - fix: correct start-time setting for accurate TTFT metric value (#3668) | ||
| - fix: map Vertex traffic type to Bifrost service tier (#3662) | ||
| - fix: ListModels for keyless providers (#3655) | ||
| - fix: remove manual `type: custom` for Anthropic tools (#3652) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,5 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - feat: `created_by` user attribution column for virtual keys (#3672) | ||
| - feat: `blacklisted_models` column for virtual key provider configs (#3653) | ||
| - fix: add monotonic `inc_number` log cursor so node usage reconciliation does not skip late async log writes (#3664) | ||
| - revert: `access_profile_id` direct access profile assignment on virtual keys (#3669) | ||
| - chore: drop the `access_profile_id` column from `governance_virtual_keys` (#3670) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,2 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - feat: virtual key blocked-models enforcement — reject requests when the requested model is blocked at the VK provider-config level (#3653) | ||
| - fix: clear stale `governanceRejectedContextKey` on an allow decision so successful fallback retries count toward budgets and rate limits (#3645) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - feat: stamp MCP tool logs with governance ownership (user, team, customer, and business unit IDs) from the request context |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| - chore: bumped transitive golang.org/x dependencies (crypto, net, sys, text) for Docker Scout CVE remediation (#3900) | ||
| - chore: upgraded core to v1.5.12 and framework to v1.3.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,22 @@ | ||
| ## 🔒 Security | ||
| ## ✨ Features | ||
|
|
||
| - **Go Dependency CVE Remediation** — Updated `golang.org/x` dependencies flagged by Docker Scout, clearing 20 advisories (severity up to 10.0): `crypto` v0.49.0 → v0.52.0, `net` v0.52.0 → v0.55.0, `sys` v0.42.0 → v0.45.0, `text` v0.35.0 → v0.37.0, `term` v0.41.0 → v0.43.0 (cli). Verified with `govulncheck` against the live Go vulnerability database: zero vulnerabilities remain in any module (#3900) | ||
| - **Hardened Container Image** — Removed the standalone GNU `wget` package from the Alpine runtime image, eliminating CVE-2025-69194 (8.8); the `HEALTHCHECK` now uses the built-in busybox `wget` applet, with no functional change | ||
| - **Virtual Key Blocked Models** — Block specific models at the virtual key provider-config level; blocked models take priority over allowed models and are enforced by governance (#3653) | ||
| - **Virtual Key Ownership** — Virtual keys now capture and display a `created_by` user attribution (#3672) | ||
| - **MCP Log Attribution** — MCP tool logs are stamped with user, team, customer, and business unit IDs so MCP usage can be traced like LLM usage | ||
| - **Team & Business Unit Filters** — Added team and business unit filters across the dashboard and logs views (#3650) | ||
| - **Sticky Time Filters** — Time filter selections are preserved when navigating between sidebar items (#3647) | ||
|
|
||
| ## 🐞 Fixed | ||
|
|
||
| - **Ollama Streaming Auth** — Ollama streaming text and chat requests now forward the configured API key as an `Authorization: Bearer` header (#3906) | ||
| - **SGL Streaming Auth** — SGL provider now sends the `Authorization` header on streaming requests (#3307) (thanks [@hensapir](https://github.com/hensapir)!) | ||
| - **Governance & Logging APIs** — Removed the `from_memory` query parameter; virtual key and config list APIs now return consistent DB-backed results, with VK names batch-fetched in a single query (#3903) | ||
| - **Idle Timeout Panic** — Fixed a panic in the streaming idle-timeout reader and added a guard to skip reads once the connection is closed (#3672) | ||
| - **Anthropic Streaming** — Preserve the tool-call stop reason in the Anthropic streaming fallback (#3640) (thanks [@dicnunz](https://github.com/dicnunz)!) | ||
| - **TTFT Metric** — Fixed the request start-time setting so the time-to-first-token metric is accurate (#3668) | ||
| - **Vertex Service Tier** — Map the Vertex traffic type to the correct Bifrost service tier (#3662) | ||
| - **Keyless Providers** — Fixed `ListModels` for providers configured without an API key (#3655) | ||
| - **Anthropic Tools** — Stopped forcing `type: custom` on Anthropic tool definitions (#3652) | ||
| - **Node Usage Reconciliation** — Added a monotonic log cursor so reconciliation no longer skips late async log writes (#3664) | ||
| - **Fallback Budget Tracking** — Clear the stale governance rejection flag on allow so successful fallback retries count toward budgets and rate limits (#3645) | ||
| - **Virtual Keys Table** — Table now fills available height with a sticky header and scrollable body (#3676) | ||
| - **Sheet Layout** — Removed save/cancel icons and fixed sheet layout growth in routing rule and virtual key sheets (#3675) | ||
| - **Toast Click-Through** — Toasts remain clickable above modal overlays (#3674) | ||
| - **Direct Access Control** — Reverted the virtual key `access_profile_id` direct access profile assignment shipped in v1.5.3; the `access_profile_id` column has been dropped (#3669, #3670) |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The original action (
astral-sh/setup-uv) was pinned at v7.6.0, but the replacement (step-security/setup-uv) is at v7.3.0 — three minor versions behind. Any bug fixes or feature additions shipped in v7.4.0–v7.6.0 of the upstream action will be absent here. Both occurrences (lines 50 and 123) are affected. It is worth confirming whetherstep-security/setup-uvhas a SHA that corresponds to ≥ v7.6.0 before merging.