supabase / etl / 39738927186
81%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 236
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 80.332% (-0.06%) from 80.387%
39738927186

push

github

web-flow 
Upgrade utoipa, docs Next.js, and mermaid (#1146)

* Bump webpki roots to drop emSign root

Update webpki-roots and webpki-root-certs 1.0.7 -> 1.0.10 and
rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0381/0382/0383,
CVE-2026-111943). This removes emSign ECC Root CA - G3 and rejects
the eight compromised eMudhra intermediate keys in rustls paths.

* Drop OpenSSL and move images to Debian 13

Sentry's default native-tls feature switched reqwest's default
backend to OpenSSL, which trusts the image's CA bundle. Debian 12
still ships emSign ECC Root CA - G3 and AAA Certificate Services.
Use Sentry's rustls transport so every client goes through rustls,
where rustls-webpki 0.103.16 rejects the compromised eMudhra keys.

Move the builder, extension, and runtime stages to trixie together.
distroless/cc-debian13 has ca-certificates 20250419+deb13u1, which
drops both roots for the remaining users of /etc/ssl/certs, such as
the DuckDB extensions.

* Upgrade utoipa to 6 and event-listener

etl-api needs utoipa 6 through etl-config to move to
utoipa-swagger-ui 10, which drops the vulnerable zip 3.0.0
(RUSTSEC-2026-0367/0368/0369). event-listener 5.4.2 fixes the
unsound StackSlot advisory RUSTSEC-2026-0221.

* Upgrade docs Next.js, mermaid, and KaTeX

next 16.4.0 -> 16.4.2 picks up the October 14 Next.js security
release (use cache RCE, SVG via sharp, Server Actions DoS). The site is
a static export, so this protects dev servers and builds.
mermaid 11.16.1 -> 12.2.0 lets KaTeX move to 0.18.10, fixing
GHSA-238p-pmpm-9mq7. braces 3.0.3 (GHSA-vfj7-8cjw-p6xm) has no
fixed release yet.

* Trust OS roots in reqwest clients

Dropping native-tls left reqwest with only the bundled webpki
roots, so clients ignored /etc/ssl/certs and SSL_CERT_FILE. Enable
rustls-tls-native-roots so private CAs and TLS-inspecting proxies
keep working. rustls-webpki still rejects the compromised eMudhra
keys, and the Debian 13 bundle no longer carries their roots.

56354 of 70151 relevant lines covered (80.33%)

43104.11 hits per line

Coverage Regressions

Lines Coverage ∆ File
53
86.39
-3.82% crates/etl-destinations/src/ducklake/encoding.rs
1
98.0
0.0% crates/etl-destinations/src/ducklake/schema.rs
Jobs
ID Job ID Ran Files Coverage
1 39738927186.1 236
80.33
GitHub Action Run
Source Files on build 39738927186