Merge branch 'main' into codex/security-opt-841

cristianrgreco · web-flow · commit 13b586d7069c · 2026-02-17T13:06:38.000Z
diff --git a/AGENTS.md b/AGENTS.md
@@ -8,6 +8,8 @@ It captures practical rules that prevent avoidable CI and PR churn.
 ## Development Expectations
 
 - If a public API changes, update the relevant docs in the same PR.
+- If new types are made part of the public API, export them from the package's `index.ts` in the same PR.
+- If new learnings or misunderstandings are discovered, propose an `AGENTS.md` update in the same PR.
 - Tests should verify observable behavior changes, not only internal/config state.
   - Example: for a security option, assert a real secure/insecure behavior difference.
 
@@ -28,7 +30,7 @@ It captures practical rules that prevent avoidable CI and PR churn.
 3. Implement scoped changes only.
 4. Run required checks: `npm run format`, `npm run lint`, and targeted tests.
 5. Verify git diff only contains intended files.
-6. Commit with focused message(s).
+6. Commit with focused message(s), using `git commit --no-verify`.
 7. Push branch.
 8. Open PR against `main` using a human-readable title (no `feat(...)` / `fix(...)` prefixes).
 9. Add labels for both change type and semantic version impact.
diff --git a/packages/modules/azureservicebus/Dockerfile b/packages/modules/azureservicebus/Dockerfile
@@ -1,2 +1,2 @@
-FROM mcr.microsoft.com/azure-messaging/servicebus-emulator:1.1.2
+FROM mcr.microsoft.com/azure-messaging/servicebus-emulator:2.0.0
 FROM mcr.microsoft.com/mssql/server:2025-latest
diff --git a/packages/modules/chromadb/Dockerfile b/packages/modules/chromadb/Dockerfile
@@ -1,2 +1,2 @@
-FROM chromadb/chroma:1.4.0
-FROM ollama/ollama:0.13.5
+FROM chromadb/chroma:1.5.0
+FROM ollama/ollama:0.16.1
diff --git a/packages/modules/clickhouse/Dockerfile b/packages/modules/clickhouse/Dockerfile
@@ -1 +1 @@
-FROM clickhouse/clickhouse-server:25.12-alpine
+FROM clickhouse/clickhouse-server:26.1-alpine
diff --git a/packages/modules/cockroachdb/Dockerfile b/packages/modules/cockroachdb/Dockerfile
@@ -1 +1 @@
-FROM cockroachdb/cockroach:v25.4.2
+FROM cockroachdb/cockroach:v25.4.4
diff --git a/packages/modules/couchbase/Dockerfile b/packages/modules/couchbase/Dockerfile
@@ -1,2 +1,2 @@
-FROM couchbase/server:enterprise-7.0.2
-FROM couchbase/server:community-7.0.2
+FROM couchbase/server:enterprise-8.0.0
+FROM couchbase/server:community-8.0.0
diff --git a/packages/modules/couchbase/src/couchbase-container.ts b/packages/modules/couchbase/src/couchbase-container.ts
@@ -301,33 +301,46 @@ export class CouchbaseContainer extends GenericContainer {
 
     body.set("hostname", container.getHost());
     body.set("mgmt", container.getMappedPort(PORTS.MGMT_PORT).toString());
-    body.set("mgmtSSL", container.getMappedPort(PORTS.MGMT_SSL_PORT).toString());
+    if (this.isEnterprise) {
+      body.set("mgmtSSL", container.getMappedPort(PORTS.MGMT_SSL_PORT).toString());
+    }
 
     if (this.enabledServices.has(CouchbaseService.KV)) {
       body.set("kv", container.getMappedPort(PORTS.KV_PORT).toString());
-      body.set("kvSSL", container.getMappedPort(PORTS.KV_SSL_PORT).toString());
       body.set("capi", container.getMappedPort(PORTS.VIEW_PORT).toString());
-      body.set("capiSSL", container.getMappedPort(PORTS.VIEW_SSL_PORT).toString());
+
+      if (this.isEnterprise) {
+        body.set("kvSSL", container.getMappedPort(PORTS.KV_SSL_PORT).toString());
+        body.set("capiSSL", container.getMappedPort(PORTS.VIEW_SSL_PORT).toString());
+      }
     }
 
     if (this.enabledServices.has(CouchbaseService.QUERY)) {
       body.set("n1ql", container.getMappedPort(PORTS.QUERY_PORT).toString());
-      body.set("n1qlSSL", container.getMappedPort(PORTS.QUERY_SSL_PORT).toString());
+      if (this.isEnterprise) {
+        body.set("n1qlSSL", container.getMappedPort(PORTS.QUERY_SSL_PORT).toString());
+      }
     }
 
     if (this.enabledServices.has(CouchbaseService.SEARCH)) {
       body.set("fts", container.getMappedPort(PORTS.SEARCH_PORT).toString());
-      body.set("ftsSSL", container.getMappedPort(PORTS.SEARCH_SSL_PORT).toString());
+      if (this.isEnterprise) {
+        body.set("ftsSSL", container.getMappedPort(PORTS.SEARCH_SSL_PORT).toString());
+      }
     }
 
     if (this.enabledServices.has(CouchbaseService.ANALYTICS)) {
       body.set("cbas", container.getMappedPort(PORTS.ANALYTICS_PORT).toString());
-      body.set("cbasSSL", container.getMappedPort(PORTS.ANALYTICS_SSL_PORT).toString());
+      if (this.isEnterprise) {
+        body.set("cbasSSL", container.getMappedPort(PORTS.ANALYTICS_SSL_PORT).toString());
+      }
     }
 
     if (this.enabledServices.has(CouchbaseService.EVENTING)) {
       body.set("eventingAdminPort", container.getMappedPort(PORTS.EVENTING_PORT).toString());
-      body.set("eventingSSL", container.getMappedPort(PORTS.EVENTING_SSL_PORT).toString());
+      if (this.isEnterprise) {
+        body.set("eventingSSL", container.getMappedPort(PORTS.EVENTING_SSL_PORT).toString());
+      }
     }
 
     const response = await this.doHttpRequest(
diff --git a/packages/modules/elasticsearch/Dockerfile b/packages/modules/elasticsearch/Dockerfile
@@ -1 +1 @@
-FROM elasticsearch:9.2.3
+FROM elasticsearch:9.3.0
diff --git a/packages/modules/etcd/Dockerfile b/packages/modules/etcd/Dockerfile
@@ -1 +1 @@
-FROM quay.io/coreos/etcd:v3.6.7
+FROM quay.io/coreos/etcd:v3.6.8
diff --git a/packages/modules/gcloud/Dockerfile b/packages/modules/gcloud/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/google.com/cloudsdktool/google-cloud-cli:555.0.0-emulators
-FROM fsouza/fake-gcs-server:1.53.1
+FROM gcr.io/google.com/cloudsdktool/google-cloud-cli:556.0.0-emulators
+FROM fsouza/fake-gcs-server:1.54.0
 FROM ghcr.io/goccy/bigquery-emulator:0.6.6
-FROM gcr.io/cloud-spanner-emulator/emulator:1.5.48
+FROM gcr.io/cloud-spanner-emulator/emulator:1.5.49
diff --git a/packages/modules/k3s/Dockerfile b/packages/modules/k3s/Dockerfile
@@ -1,2 +1,2 @@
-FROM rancher/k3s:v1.35.0-k3s1
-FROM rancher/kubectl:v1.35.0
+FROM rancher/k3s:v1.35.1-k3s1
+FROM rancher/kubectl:v1.35.1
diff --git a/packages/modules/kurrentdb/Dockerfile b/packages/modules/kurrentdb/Dockerfile
@@ -1 +1 @@
-FROM kurrentplatform/kurrentdb:25.1
+FROM kurrentplatform/kurrentdb:26.0
diff --git a/packages/modules/localstack/Dockerfile b/packages/modules/localstack/Dockerfile
@@ -1,2 +1,2 @@
 FROM localstack/localstack:4.13.1
-FROM amazon/aws-cli:2.33.17
+FROM amazon/aws-cli:2.33.22
diff --git a/packages/modules/mariadb/Dockerfile b/packages/modules/mariadb/Dockerfile
@@ -1 +1 @@
-FROM mariadb:12.1.2
+FROM mariadb:12.2.2
diff --git a/packages/modules/mongodb/Dockerfile b/packages/modules/mongodb/Dockerfile
@@ -1 +1 @@
-FROM mongo:8.2.3
+FROM mongo:8.2.5
diff --git a/packages/modules/mysql/Dockerfile b/packages/modules/mysql/Dockerfile
@@ -1 +1 @@
-FROM mysql:9.5.0
+FROM mysql:9.6.0
diff --git a/packages/modules/nats/Dockerfile b/packages/modules/nats/Dockerfile
@@ -1 +1 @@
-FROM nats:2.12.3-alpine
+FROM nats:2.12.4-alpine
diff --git a/packages/modules/neo4j/Dockerfile b/packages/modules/neo4j/Dockerfile
@@ -1 +1 @@
-FROM neo4j:5.26.19
+FROM neo4j:5.26.21
diff --git a/packages/modules/ollama/Dockerfile b/packages/modules/ollama/Dockerfile
@@ -1 +1 @@
-FROM ollama/ollama:0.13.5
+FROM ollama/ollama:0.16.1
diff --git a/packages/modules/opensearch/Dockerfile b/packages/modules/opensearch/Dockerfile
@@ -1 +1 @@
-FROM opensearchproject/opensearch:3.4.0
+FROM opensearchproject/opensearch:3.5.0
diff --git a/packages/modules/postgresql/Dockerfile b/packages/modules/postgresql/Dockerfile
@@ -1 +1 @@
-FROM postgres:18.1-alpine
+FROM postgres:18.2-alpine
diff --git a/packages/modules/rabbitmq/Dockerfile b/packages/modules/rabbitmq/Dockerfile
@@ -1 +1 @@
-FROM rabbitmq:4.2.2-management-alpine
+FROM rabbitmq:4.2.3-management-alpine
diff --git a/packages/modules/redis/Dockerfile b/packages/modules/redis/Dockerfile
@@ -1,2 +1,2 @@
-FROM redis:8.4
+FROM redis:8.6
 FROM redis/redis-stack-server:7.4.0-v4
diff --git a/packages/modules/redpanda/Dockerfile b/packages/modules/redpanda/Dockerfile
@@ -1 +1 @@
-FROM docker.redpanda.com/redpandadata/redpanda:v25.3.4
+FROM docker.redpanda.com/redpandadata/redpanda:v25.3.7
diff --git a/packages/modules/selenium/Dockerfile b/packages/modules/selenium/Dockerfile
@@ -1,4 +1,4 @@
-FROM selenium/standalone-chrome:143.0
+FROM selenium/standalone-chrome:144.0
 FROM seleniarm/standalone-chromium:124.0
-FROM selenium/standalone-firefox:146.0
+FROM selenium/standalone-firefox:147.0
 FROM seleniarm/standalone-firefox:125.0
diff --git a/packages/modules/weaviate/Dockerfile b/packages/modules/weaviate/Dockerfile
@@ -1 +1 @@
-FROM semitechnologies/weaviate:1.35.2
+FROM semitechnologies/weaviate:1.35.7
diff --git a/packages/testcontainers/src/utils/test-helper.test.ts b/packages/testcontainers/src/utils/test-helper.test.ts
@@ -0,0 +1,31 @@
+import { PassThrough } from "stream";
+import { waitForDockerEvent } from "./test-helper";
+
+describe("waitForDockerEvent", () => {
+  it("should resolve when action matches in ndjson stream", async () => {
+    const eventStream = new PassThrough();
+    const waitPromise = waitForDockerEvent(eventStream, "pull");
+
+    eventStream.write('{"Action":"create"}\n{"Action":"pull"}\n');
+
+    await expect(waitPromise).resolves.toBeUndefined();
+  });
+
+  it("should resolve when status matches in ndjson stream", async () => {
+    const eventStream = new PassThrough();
+    const waitPromise = waitForDockerEvent(eventStream, "pull");
+
+    eventStream.write('{"status":"pull"}\n');
+
+    await expect(waitPromise).resolves.toBeUndefined();
+  });
+
+  it("should resolve when action matches in json-seq stream", async () => {
+    const eventStream = new PassThrough();
+    const waitPromise = waitForDockerEvent(eventStream, "pull");
+
+    eventStream.write('\u001e{"Action":"pull"}\n');
+
+    await expect(waitPromise).resolves.toBeUndefined();
+  });
+});
diff --git a/packages/testcontainers/src/utils/test-helper.ts b/packages/testcontainers/src/utils/test-helper.ts
@@ -125,18 +125,39 @@ export const composeContainerName = async (serviceName: string, index = 1): Prom
 
 export const waitForDockerEvent = async (eventStream: Readable, eventName: string, times = 1) => {
   let currentTimes = 0;
+  let pendingData = "";
+
+  const parseDockerEvent = (eventData: string): { status?: string; Action?: string } | undefined => {
+    try {
+      return JSON.parse(eventData);
+    } catch {
+      return undefined;
+    }
+  };
+
   return new Promise<void>((resolve) => {
-    eventStream.on("data", (data) => {
-      try {
-        if (JSON.parse(data).status === eventName) {
+    const onData = (data: string | Buffer) => {
+      // Docker events can be emitted as ndjson or json-seq; normalize both to line-delimited JSON.
+      pendingData += data.toString().split(String.fromCharCode(30)).join("\n");
+
+      const lines = pendingData.split("\n");
+      pendingData = lines.pop() ?? "";
+
+      for (const line of lines) {
+        const event = parseDockerEvent(line);
+        const action = event?.status ?? event?.Action;
+
+        if (action === eventName) {
           if (++currentTimes === times) {
+            eventStream.off("data", onData);
             resolve();
+            return;
           }
         }
-      } catch (err) {
-        // ignored
       }
-    });
+    };
+
+    eventStream.on("data", onData);
   });
 };
 

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,2 @@`
`1`		`-FROM mcr.microsoft.com/azure-messaging/servicebus-emulator:1.1.2`
	`1`	`+FROM mcr.microsoft.com/azure-messaging/servicebus-emulator:2.0.0`
`2`	`2`	`FROM mcr.microsoft.com/mssql/server:2025-latest`
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-FROM clickhouse/clickhouse-server:25.12-alpine`
	`1`	`+FROM clickhouse/clickhouse-server:26.1-alpine`
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-FROM cockroachdb/cockroach:v25.4.2`
	`1`	`+FROM cockroachdb/cockroach:v25.4.4`
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-FROM elasticsearch:9.2.3`
	`1`	`+FROM elasticsearch:9.3.0`
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-FROM quay.io/coreos/etcd:v3.6.7`
	`1`	`+FROM quay.io/coreos/etcd:v3.6.8`