Merge pull request #984 from Wikid82/nightly

Weekly: Promote nightly to main (2026-04-27)

Author: Wikid82

.docker/docker-entrypoint.sh

@@ -72,8 +72,12 @@ mkdir -p /app/data/caddy 2>/dev/null || true
 mkdir -p /app/data/crowdsec 2>/dev/null || true
 mkdir -p /app/data/geoip 2>/dev/null || true
 
-# Fix ownership for directories created as root
+# Fix ownership for the data volume and required subdirectories when running as root.
+# This handles rootless Docker environments where the host volume may be owned by the
+# host user (mapped to container UID 0), making it inaccessible to the charon user.
 if is_root; then
+    chown charon:charon /app/data 2>/dev/null || true
+    chown charon:charon /config 2>/dev/null || true
     chown -R charon:charon /app/data/caddy 2>/dev/null || true
     chown -R charon:charon /app/data/crowdsec 2>/dev/null || true
     chown -R charon:charon /app/data/geoip 2>/dev/null || true

.github/workflows/release-goreleaser.yml

@@ -75,7 +75,7 @@ jobs:
 
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7
+        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
         with:
           distribution: goreleaser
           version: '~> v2.5'

.vscode/settings.json

@@ -1,4 +1,5 @@
 {
+  "docker.host": "unix:///run/user/1001/docker.sock",
   "gopls": {
     "buildFlags": ["-tags=integration"]
   },

.vscode/tasks.json

@@ -4,21 +4,36 @@
                 {
             "label": "Docker Compose Up",
             "type": "shell",
-            "command": "docker compose -f /root/docker/containers/charon/docker-compose.yml up -d && echo 'Charon running at http://localhost:8787'",
+            "command": "docker compose -f /home/jeremy/docker/containers/charon/docker-compose.yml up -d && echo 'Charon running at http://localhost:8787'",
+            "options": {
+                "env": {
+                    "DOCKER_HOST": "unix:///run/user/1001/docker.sock"
+                }
+            },
             "group": "build",
             "problemMatcher": []
         },
         {
             "label": "Build & Run: Local Docker Image",
             "type": "shell",
-            "command": "docker build -t charon:local . && docker compose -f /root/docker/containers/charon/docker-compose.yml up -d && echo 'Charon running at http://localhost:8787'",
+            "command": "docker build -t charon:local . && docker compose -f /home/jeremy/docker/containers/charon/docker-compose.yml up -d && echo 'Charon running at http://localhost:8787'",
+            "options": {
+                "env": {
+                    "DOCKER_HOST": "unix:///run/user/1001/docker.sock"
+                }
+            },
             "group": "build",
             "problemMatcher": []
         },
         {
             "label": "Build & Run: Local Docker Image No-Cache",
             "type": "shell",
-            "command": "docker build --no-cache -t charon:local . && docker compose -f /root/docker/containers/charon/docker-compose.yml up -d && echo 'Charon running at http://localhost:8787'",
+            "command": "docker build --no-cache -t charon:local . && docker compose -f /home/jeremy/docker/containers/charon/docker-compose.yml up -d && echo 'Charon running at http://localhost:8787'",
+            "options": {
+                "env": {
+                    "DOCKER_HOST": "unix:///run/user/1001/docker.sock"
+                }
+            },
             "group": "build",
             "problemMatcher": []
         },

Dockerfile

@@ -384,6 +384,12 @@ RUN go get github.com/expr-lang/expr@v${EXPR_LANG_VERSION} && \
     # CVE-2026-32286: pgproto3/v2 buffer overflow (no v2 fix exists; bump pgx/v4 to latest patch)
     # renovate: datasource=go depName=github.com/jackc/pgx/v4
     go get github.com/jackc/pgx/v4@v4.18.3 && \
+    # CVE-2026-29181 (GHSA-mh2q-q3fh-2475): OpenTelemetry-Go baggage header multi-value DoS
+    # go.opentelemetry.io/otel >= 1.36.0 and <= 1.40.0 is vulnerable; fix available at v1.41.0.
+    # Pin here so the CrowdSec binary is patched immediately;
+    # remove once CrowdSec ships a release built with go.opentelemetry.io/otel >= v1.41.0.
+    # renovate: datasource=go depName=go.opentelemetry.io/otel
+    go get go.opentelemetry.io/otel@v1.43.0 && \
     # GHSA-xmrv-pmrh-hhx2: AWS SDK v2 event stream injection
     # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
     go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.9 && \
@@ -486,7 +492,7 @@ SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 # Note: In production, users should provide their own MaxMind license key
 # This uses the publicly available GeoLite2 database
 # In CI, timeout quickly rather than retrying to save build time
-ARG GEOLITE2_COUNTRY_SHA256=62049119bd084e19fff4689bebe258f18a5f27a386e6d26ba5180941b613fc2b
+ARG GEOLITE2_COUNTRY_SHA256=c880cbc7e6b1a9b1a96d530c34996480d6d809d2c89a6bd73a5072e4fffbc01c
 RUN mkdir -p /app/data/geoip && \
         if [ "$CI" = "true" ] || [ "$CI" = "1" ]; then \
             echo "⏱️  CI detected - quick download (10s timeout, no retries)"; \

backend/.golangci-fast.yml

@@ -31,3 +31,8 @@ linters:
         - G501  # Blacklisted import crypto/md5
         - G502  # Blacklisted import crypto/des
         - G503  # Blacklisted import crypto/rc4
+  exclusions:
+    rules:
+      - path: "_test\\.go"
+        linters:
+          - gosec

backend/cmd/localpatchreport/main.go

@@ -230,20 +230,20 @@ func writeMarkdown(path string, report reportJSON, backendCoveragePath, frontend
 	var builder strings.Builder
 	builder.WriteString("# Local Patch Coverage Report\n\n")
 	builder.WriteString("## Metadata\n\n")
-	builder.WriteString(fmt.Sprintf("- Generated: %s\n", report.GeneratedAt))
-	builder.WriteString(fmt.Sprintf("- Baseline: `%s`\n", report.Baseline))
-	builder.WriteString(fmt.Sprintf("- Mode: `%s`\n\n", report.Mode))
+	fmt.Fprintf(&builder, "- Generated: %s\n", report.GeneratedAt)
+	fmt.Fprintf(&builder, "- Baseline: `%s`\n", report.Baseline)
+	fmt.Fprintf(&builder, "- Mode: `%s`\n\n", report.Mode)
 
 	builder.WriteString("## Inputs\n\n")
-	builder.WriteString(fmt.Sprintf("- Backend coverage: `%s`\n", backendCoveragePath))
-	builder.WriteString(fmt.Sprintf("- Frontend coverage: `%s`\n\n", frontendCoveragePath))
+	fmt.Fprintf(&builder, "- Backend coverage: `%s`\n", backendCoveragePath)
+	fmt.Fprintf(&builder, "- Frontend coverage: `%s`\n\n", frontendCoveragePath)
 
 	builder.WriteString("## Resolved Thresholds\n\n")
 	builder.WriteString("| Scope | Minimum (%) | Source |\n")
 	builder.WriteString("|---|---:|---|\n")
-	builder.WriteString(fmt.Sprintf("| Overall | %.1f | %s |\n", report.Thresholds.Overall, report.ThresholdSources.Overall))
-	builder.WriteString(fmt.Sprintf("| Backend | %.1f | %s |\n", report.Thresholds.Backend, report.ThresholdSources.Backend))
-	builder.WriteString(fmt.Sprintf("| Frontend | %.1f | %s |\n\n", report.Thresholds.Frontend, report.ThresholdSources.Frontend))
+	fmt.Fprintf(&builder, "| Overall | %.1f | %s |\n", report.Thresholds.Overall, report.ThresholdSources.Overall)
+	fmt.Fprintf(&builder, "| Backend | %.1f | %s |\n", report.Thresholds.Backend, report.ThresholdSources.Backend)
+	fmt.Fprintf(&builder, "| Frontend | %.1f | %s |\n\n", report.Thresholds.Frontend, report.ThresholdSources.Frontend)
 
 	builder.WriteString("## Coverage Summary\n\n")
 	builder.WriteString("| Scope | Changed Lines | Covered Lines | Patch Coverage (%) | Status |\n")
@@ -262,22 +262,22 @@ func writeMarkdown(path string, report reportJSON, backendCoveragePath, frontend
 			if len(fileCoverage.UncoveredChangedLineRange) > 0 {
 				ranges = strings.Join(fileCoverage.UncoveredChangedLineRange, ", ")
 			}
-			builder.WriteString(fmt.Sprintf("| `%s` | %.1f | %d | %s |\n", fileCoverage.Path, fileCoverage.PatchCoveragePct, fileCoverage.UncoveredChangedLines, ranges))
+			fmt.Fprintf(&builder, "| `%s` | %.1f | %d | %s |\n", fileCoverage.Path, fileCoverage.PatchCoveragePct, fileCoverage.UncoveredChangedLines, ranges)
 		}
 		builder.WriteString("\n")
 	}
 
 	if len(report.Warnings) > 0 {
 		builder.WriteString("## Warnings\n\n")
 		for _, warning := range report.Warnings {
-			builder.WriteString(fmt.Sprintf("- %s\n", warning))
+			fmt.Fprintf(&builder, "- %s\n", warning)
 		}
 		builder.WriteString("\n")
 	}
 
 	builder.WriteString("## Artifacts\n\n")
-	builder.WriteString(fmt.Sprintf("- Markdown: `%s`\n", report.Artifacts.Markdown))
-	builder.WriteString(fmt.Sprintf("- JSON: `%s`\n", report.Artifacts.JSON))
+	fmt.Fprintf(&builder, "- Markdown: `%s`\n", report.Artifacts.Markdown)
+	fmt.Fprintf(&builder, "- JSON: `%s`\n", report.Artifacts.JSON)
 
 	if err := os.WriteFile(path, []byte(builder.String()), 0o600); err != nil {
 		return fmt.Errorf("write markdown file: %w", err)

backend/go.mod

@@ -90,7 +90,7 @@ require (
 	golang.org/x/sys v0.43.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.72.0 // indirect
+	modernc.org/libc v1.72.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	modernc.org/sqlite v1.49.1 // indirect

backend/go.sum

@@ -213,10 +213,10 @@ gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
 gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=
-modernc.org/cc/v4 v4.27.3/go.mod h1:3YjcbCqhoTTHPycJDRl2WZKKFj0nwcOIPBfEZK0Hdk8=
-modernc.org/ccgo/v4 v4.32.4 h1:L5OB8rpEX4ZsXEQwGozRfJyJSFHbbNVOoQ59DU9/KuU=
-modernc.org/ccgo/v4 v4.32.4/go.mod h1:lY7f+fiTDHfcv6YlRgSkxYfhs+UvOEEzj49jAn2TOx0=
+modernc.org/cc/v4 v4.28.1 h1:XpLbkYVQ24E8tX5u8+yWGvaxerxkR/S4zqxI8ZoSBuc=
+modernc.org/cc/v4 v4.28.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.33.0 h1:dspBCm75jsj8Y/ufwAMVfe375L2iYdMyQ2QG/v3hL54=
+modernc.org/ccgo/v4 v4.33.0/go.mod h1:+RhXBoRYzRwaH21mV/aj6XvQRDtfjcZfAlPMsQo8CR0=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
@@ -225,14 +225,14 @@ modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
 modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.0 h1:IEu559v9a0XWjw0DPoVKtXpO2qt5NVLAnFaBbjq+n8c=
-modernc.org/libc v1.72.0/go.mod h1:tTU8DL8A+XLVkEY3x5E/tO7s2Q/q42EtnNWda/L5QhQ=
+modernc.org/libc v1.72.1 h1:db1xwJ6u1kE3KHTFTTbe2GCrczHPKzlURP0aDC4NGD0=
+modernc.org/libc v1.72.1/go.mod h1:HRMiC/PhPGLIPM7GzAFCbI+oSgE3dhZ8FWftmRrHVlY=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.49.1 h1:dYGHTKcX1sJ+EQDnUzvz4TJ5GbuvhNJa8Fg6ElGx73U=

backend/internal/api/handlers/logs_handler.go

@@ -93,8 +93,9 @@ func (h *LogsHandler) Download(c *gin.Context) {
 		}
 	}()
 
-	// #nosec G304 -- path is validated via LogService.GetLogPath
-	srcFile, err := os.Open(path)
+	// #nosec G304 -- path is validated via LogService.GetLogPath which enforces
+	// filepath.Base equality check and path prefix validation.
+	srcFile, err := os.Open(path) //nolint:gosec // nosemgrep: go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint
 	if err != nil {
 		if err := tmpFile.Close(); err != nil {
 			logger.Log().WithError(err).Warn("failed to close temp file")