Skip to content

Security patches - #2715

Merged
norberttech merged 2 commits into
1.xfrom
security-patches
Nov 1, 2026
Merged

norberttech merged 2 commits into
1.xfrom
security-patches

Conversation

@norberttech

Copy link
Copy Markdown
Member

Resolves: #xxx

Change Log


Added

  • flow-php/etl - infer_schema()->everyRow() and ->everySource()

Fixed

  • flow-php/doctrine-dbal-bulk - table definitions are cached per connection, not shared across connections
  • flow-php/flow-php-ext - an explicit null inference no longer reads as an inferred schema

Changed

  • flow-php/etl - sampleSize() and filesToSniff() refuse values below 1
  • flow-php/etl - a negative sniff row budget is refused; null means every row
  • flow-php/telemetry - AttributeMatchingSampler renamed to AttributeFilteringSampler
  • flow-php/telemetry - ManualDetector renamed to StaticDetector
  • flow-php/postgresql - PaginationModifier/PaginationConfig renamed to OffsetPaginationModifier/OffsetPaginationConfig
  • flow-php/symfony-http-foundation-bridge - StreamClosure renamed to StreamCompletionListener
  • flow-php/monolog-telemetry-bridge - ValueNormalizer renamed to AttributeValueNormalizer
  • flow-php/psr3-telemetry-bridge - ValueNormalizer renamed to AttributeValueNormalizer
  • flow-php/telemetry-otlp-bridge - JSON serializers moved to Serializer\Json
  • flow-php/etl-adapter-excel - the non-local path error explains why and what to do
  • flow-php/etl - comments and docblocks cut to self-descriptive code

Removed

  • flow-php/etl - the -1 "all" sentinel of schema inference

Deprecated

Security

- mago 1.59.0, phpstan 2.3.4, composer/semver 3.6.0, blackfire/php-sdk 3.0.2, rust-cache v2.9.3
- ext-php-rs 0.16.3 in flow-php-ext and arrow-ext, pulling zip 9.2.0 (security)
- web/landing: symfony/http-foundation 7.4.22, symfony/yaml 6.4.49 (security)
- azurite tooling: msal-node 7.1.2, body-parser 2.4.0, follow-redirects 1.16.2, qs 6.17.1 (security)
- fix PHPDoc generics rejected by mago 1.59 (StructureType, DatePeriod)
- ignore the azurite node_modules
- remove narration, multi-sentence comments and engine names from code, tests and docs; parquet fixtures renamed *_external*
- rename types for what they do: StreamCompletionListener, AttributeFilteringSampler, StaticDetector, OffsetPagination*, AttributeValueNormalizer, plus internal renames
- infer_schema()->everyRow()/everySource() replace the -1 sentinel, which is gone internally too; negative row budgets are refused
- LastBatchColumn replaces the column cache copied into Average, Count and Sum
- fix TableDefinitions caching one table definition across connections; assert the full DELTA_BINARY_PACKED round trip
- restore BucketSourceStreamsTest bodies; Excel and Regex refusals say why and what to do
@norberttech norberttech added this to the 0.47.0 milestone Nov 1, 2026
@codecov

codecov Bot commented Nov 1, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 97.18310% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.49%. Comparing base (d90e9b9) to head (9a52b34).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@             Coverage Diff              @@
##                1.x    #2715      +/-   ##
============================================
+ Coverage     89.85%   90.49%   +0.64%     
- Complexity      400    31043   +30643     
============================================
  Files          2179     2178       -1     
  Lines         89824    89791      -33     
============================================
+ Hits          80710    81259     +549     
+ Misses         9114     8532     -582     
Components Coverage Δ
etl 95.88% <98.33%> (+0.14%) ⬆️
cli 87.24% <100.00%> (+2.11%) ⬆️
lib-array-dot 96.52% <ø> (ø)
lib-azure-sdk 64.17% <ø> (+1.02%) ⬆️
lib-doctrine-dbal-bulk 94.25% <ø> (+<0.01%) ⬆️
lib-filesystem 88.96% <ø> (+3.54%) ⬆️
lib-types 94.64% <ø> (+0.04%) ⬆️
lib-parquet 82.68% <ø> (+0.01%) ⬆️
lib-parquet-viewer 83.15% <ø> (ø)
lib-snappy 89.86% <ø> (ø)
lib-dremel 0.00% <ø> (ø)
lib-postgresql 89.44% <ø> (ø)
lib-telemetry 86.85% <ø> (ø)
bridge-filesystem-async-aws 96.12% <100.00%> (+12.17%) ⬆️
bridge-filesystem-azure 94.39% <ø> (+13.90%) ⬆️
bridge-filesystem-sftp 90.29% <ø> (+4.85%) ⬆️
bridge-monolog-http 96.84% <ø> (ø)
bridge-monolog-telemetry 92.85% <0.00%> (-1.94%) ⬇️
bridge-openapi-specification 91.95% <ø> (ø)
symfony-http-foundation 80.76% <100.00%> (ø)
bridge-psr18-telemetry 100.00% <ø> (ø)
bridge-psr3-telemetry 98.95% <100.00%> (ø)
bridge-psr7-telemetry 100.00% <ø> (ø)
bridge-telemetry-otlp 90.11% <ø> (ø)
bridge-symfony-http-foundation-telemetry 92.85% <ø> (ø)
bridge-symfony-filesystem-bundle 90.72% <ø> (ø)
bridge-symfony-filesystem-cache 98.18% <ø> (ø)
bridge-symfony-postgresql-bundle 93.35% <100.00%> (ø)
bridge-symfony-postgresql-cache 94.41% <ø> (ø)
bridge-symfony-postgresql-messenger 98.80% <ø> (ø)
bridge-symfony-postgresql-session 93.65% <ø> (ø)
bridge-symfony-telemetry-bundle 90.76% <100.00%> (-0.01%) ⬇️
adapter-chartjs 82.11% <ø> (ø)
adapter-csv 97.68% <100.00%> (+8.63%) ⬆️
adapter-doctrine 95.13% <ø> (ø)
adapter-google-sheet 97.49% <100.00%> (+27.63%) ⬆️
adapter-http 87.18% <ø> (ø)
adapter-json 90.59% <100.00%> (+3.64%) ⬆️
adapter-logger 47.05% <ø> (ø)
adapter-parquet 96.28% <100.00%> (ø)
adapter-text 97.70% <ø> (ø)
adapter-xml 98.01% <ø> (ø)
adapter-avro 6.25% <ø> (ø)
adapter-excel 96.78% <100.00%> (+8.52%) ⬆️
adapter-postgresql 97.34% <100.00%> (ø)
adapter-seal 89.91% <ø> (ø)
bridge-phpunit-postgresql 75.30% <ø> (ø)
bridge-phpunit-telemetry 87.36% <ø> (ø)
bridge-phpstan-types 0.00% <ø> (ø)
bridge-postgresql-valinor 100.00% <ø> (ø)
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@norberttech
norberttech merged commit cbc0ca9 into 1.x Nov 1, 2026
31 checks passed
@norberttech
norberttech deleted the security-patches branch November 1, 2026 02:43
@github-project-automation github-project-automation Bot moved this from Todo to Done in Roadmap Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant