Conversation
## Summary Upgrades the embedded MongoDB in the Appsmith Docker image from 6.0 (EOL July 2024) to 7.0. - **`base.dockerfile`** — switches apt repo, GPG key, and list file from the MongoDB `6.0` stream to `7.0`. Stays on the jammy (22.04) packages because MongoDB doesn't publish a noble (24.04) apt repo yet — same pattern the 6.0 install already used on Ubuntu 24.04. Local smoke build installs `mongodb-org 7.0.31` and `mongosh 2.8.2`. - **`mongodb-fixer.sh`** — writes a `.appsmith-mongo-fcv-min` marker file into the Mongo data directory once mongod is confirmed running under this release. Contents record the **minimum FCV this release commits to preserve** (constant `6.0`) — a release-level contract, not a live FCV reading. FCV is deliberately **not** raised to 7.0 — keeping it at 6.0 preserves the ability to downgrade back to a 6.x Appsmith release. Raise-FCV scaffolding and a marker-value bump can come back when MongoDB 8 needs it. - **`entrypoint.sh`** — adds `ensure_mongodb_fcv_compatible`, a pre-flight check that runs before supervisord starts mongod. MongoDB 7.0 refuses to start on data with FCV < 6.0; without this check, supervisord would retry mongod three times and give up, leaving the container in a confusing degraded state with no clear signal to the administrator. Reader only — never writes the marker. Only runs when there's existing local-Mongo data (gated on `shouldPerformInitdb=0 && isUriLocal=0` inside the function). ### Decision matrix | Data dir | Marker | Action | |---|---|---| | Fresh install | n/a | Skipped — nothing to check. Fixer writes the marker (constant `6.0`) on first real boot under supervisord. | | Has data | Present | Fast path — proceed, zero overhead. | | Has data | Missing | One-time `mongod --fork` probe. If it starts, proceed (fixer writes the marker on first boot under supervisord). If it fails, hard-fail with an actionable error pointing users to roll back to Appsmith v1.99 first. | Marker presence alone is what's trusted — the fixer writes it only after mongod is confirmed running under this release, so presence is proof this release successfully boots on this data. The value (`6.0`) is diagnostic: future Appsmith releases can inspect it to reason about upgrade safety. Linear: [APP-14867](https://linear.app/appsmith/issue/APP-14867/task-upgrade-mongo-base-image-in-appsmith-to-v7) ## Test plan - [x] **Fresh install**: empty `/appsmith-stacks` → entrypoint skips the FCV check (`shouldPerformInitdb=0` gate is false), `init_replica_set` initializes the data, supervisord starts mongod, fixer writes `.appsmith-mongo-fcv-min` with `6.0`. Second boot: marker present → fast path, skip probe. - [x] **Happy-path upgrade**: boot `appsmith-ce:v1.99` (last 6.x release), let the fixer run (FCV stays at 6.0), stop. Swap to this image and boot — entrypoint runs the probe (marker from prior image is missing), probe succeeds, fixer writes the marker. Subsequent boots are fast. - [x] **Failed + remediated upgrade**: boot `appsmith-ce:v1.69` (last mongo-5 release, pre-v1.70 cutover) to seed FCV 5.0 data. Swap to this image → expected **hard fail** with error block pointing to v1.99 rollback. Swap to `appsmith-ce:v1.99` → fixer raises FCV 5.0 → 6.0. Swap back to this image → probe succeeds, marker written. Verifies the error path *and* that the remediation instructions actually work end-to-end. - [x] **Marker-missing transitional path**: with the marker present, `rm /appsmith-stacks/data/mongodb/.appsmith-mongo-fcv-min`, reboot. Entrypoint should log `running one-time compatibility probe`, probe succeeds, fixer re-writes the marker. - [x] **Base image smoke build**: `docker build -f deploy/docker/base.dockerfile .` succeeds on linux/arm64. Image contains `mongodb-org 7.0.31` and `mongosh 2.8.2`. - [x] **CE→EE sync**: cherry-pick onto `community/release` and merge into EE `release` both apply cleanly (verified locally). - [x] **Fresh install** smoke-tested locally with the current DP image — probe skipped on `shouldPerformInitdb=0` gate, marker written by fixer after supervisord starts mongod. ## Out of scope - `deploy/helm/` chart still references Bitnami MongoDB 6.0.27 in `Chart.yaml` / `values.yaml`. That's tracked under a separate effort. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Upgraded bundled MongoDB from 6.0 to 7.0. * **New Features** * Added a startup compatibility probe that detects incompatible local/embedded MongoDB feature versions and halts startup with operator guidance when needed. * Added a persistent marker to record confirmed DB compatibility and skip repeated probes on subsequent startups. * Improved post-startup DB feature-version handling to record and persist the committed minimum FCV. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD af34f2d yet > <hr>Tue, 05 May 2026 22:44:32 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This PR has two coordinated parts: (1) a complete rewrite of the chart's `values.schema.json` (auto-generated from `values.yaml`), and (2) a publish-workflow restructure to add a release channel, PR pre-flight checks, and schema URL hosting. They're together because the workflow surfaces and validates the new schema, and would conflict on `helm-release.yml` if split into separate PRs. --- ## Part 1: values.schema.json — full coverage, auto-generated ### What changed - Annotates `deploy/helm/values.yaml` with `# @schema` comments so the [helm-values-schema-json](https://github.com/losisin/helm-values-schema-json) plugin can generate `values.schema.json` with full top-level coverage (43/43 keys vs. 4/43 previously). - Dependency pass-throughs (`redis`, `mongodb`, `postgresql`, `prometheus`, `mongodbOperator`) use `additionalProperties: true` with their internals hidden — only the chart-owned `enabled` condition flag is typed (boolean). - `applicationConfig` accepts any scalar type (`string`, `boolean`, `integer`, `number`) for any key, since Helm/K8s stringify env-var values when rendering. Earlier draft enforced string-only, which rejected natural YAML like `APPSMITH_DISABLE_TELEMETRY: true`. - New CI workflow `.github/workflows/helm-schema.yml` regenerates the schema on PR and fails on drift between `values.yaml` and `values.schema.json`. Pinned to Helm 4.1.4. - New `tests/values_schema_test.yaml` helm-unittest suite (14 cases) exercises rejection of invalid input and acceptance of pass-through values. Picked up automatically by the existing `Helm Unit Tests` workflow. - Cursor rule (`.cursor/rules/regen-helm-schema.mdc`) auto-attaches when editing `values.yaml` or `values.schema.json` to remind contributors how to regenerate. ### Behavior changes worth flagging 1. **`mongodbOperator.enabled`** was previously the only validated key under `mongodbOperator`. It still is — the rest of the block stays opaque (any subchart values pass through unvalidated). Same model now applied uniformly to all five dependency pass-throughs. 2. **`persistence.existingClaim.{enabled,name,claimName}` and `persistence.efs.{enabled,driver,volumeHandle}`** had bare `null` defaults in `values.yaml` (e.g. `enabled:` with no value). The auto-generated schema initially typed these as `null`-only, which would have rejected real-world overrides like `persistence.existingClaim.enabled: true`. They are now annotated as multi-type (`[boolean, \"null\"]` or `[string, \"null\"]`) so they accept both the empty default and a concrete override. Tightening of a previously-empty schema, not a loosening. 3. **`applicationConfig`**: enumerated `APPSMITH_*` keys are no longer typed individually (they're hidden from the schema and serve as in-file documentation). The block validates via `additionalProperties` only, accepting any scalar value for any key. Trade-off: IDEs no longer auto-complete the specific known keys, but the block is now permissive for the real-world shapes that Helm renders fine. ### How to regenerate the schema locally ``` cd deploy/helm && helm schema \ --schema-root.title 'Appsmith Helm chart values' \ --schema-root.id 'https://helm.appsmith.com/values.schema.json' \ -o values.schema.json ``` Plugin install (one-time): ``` helm plugin install --verify=false https://github.com/losisin/helm-values-schema-json.git ``` The Cursor rule provides this as on-demand context when editing the relevant files. --- ## Part 2: helm-release.yml — release channel + PR pre-flight + schema hosting ### What changed - **Adds a release channel.** Pushes to the `release` branch publish as `<chart-yaml-version>-release.<short-sha>` (e.g. `3.8.0-release.abc1234`). SemVer treats the `-release.SHA` suffix as a pre-release, so default `helm install yourrepo/appsmith` skips these — clients must pass `--devel` to opt in. Master keeps publishing the on-disk version verbatim as stable. - **PR pre-flight version check.** PRs touching `deploy/helm/**` now run a `curl HEAD` against the public chart URL for the on-disk version. If a tarball at that version already exists, CI fails with an actionable message: ``` Error: Chart version 3.7.0 is already published at https://helm.appsmith.com/appsmith-3.7.0.tgz. Error: Bump 'version:' in deploy/helm/Chart.yaml before merging. ``` Catches \"I forgot to bump the version\" before the PR lands. No AWS creds needed — works on fork PRs. - **Single combined job** (was two): version-collision check is shared between PR and push paths. Same code, same logic, same failure mode. - **`index.yaml` regenerated from bucket state** on every publish rather than `--merge` appended. This decouples cleanup from publish: any S3 lifecycle rule that expires `-release.*` tarballs is automatically reflected in the next published index, with no separate cleanup workflow needed. - **`values.schema.json` is now uploaded alongside the chart on stable publishes.** Enables IDE schema validation via `# yaml-language-server: $schema=https://helm.appsmith.com/values.schema.json` in any values.yaml file. - **`Cache-Control: public, max-age=60`** on `index.yaml` and `values.schema.json` so `helm repo update` and IDE schema fetches pick up new versions promptly even if the bucket is fronted by a CDN. Tarballs (content-addressed via digest in index) keep default caching. - **Helm 4.1.4** (was v3.6.3) via `setup-helm@v4` (was v1). - **`HELM_S3_BUCKET` and `HELM_REPO_URL` are now repository variables, not secrets.** Both values are public (bucket name and chart URL). Variables are accessible to fork PRs (unlike secrets), which is required for the version-check path. Naming matches what each value represents: - `vars.HELM_S3_BUCKET` — bucket name for `aws s3 …` operations - `vars.HELM_REPO_URL` — full URL (incl. scheme) clients fetch charts from - **Drops `workflow_dispatch`** (Actions UI re-runs cover the rare manual case) and the unused `helm repo add bitnami` step (`helm dep build` resolves all dependencies from Chart.yaml URLs without needing repos pre-registered). ### Behavior matrix | Trigger | ref | Version check | Publish | |---|---|---|---| | PR (any target) | `refs/pull/N/merge` | yes | no | | push to master | `refs/heads/master` | yes | yes (publishes base version as stable) | | push to release | `refs/heads/release` | no (release channel) | yes (publishes `base-release.SHA`) | --- ## Test plan - [x] CI: `Helm Values Schema` workflow passes (regenerates schema, finds no drift) — passing on most recent run - [x] CI: `Helm Unit Tests` workflow passes (existing 53 tests + new 14 schema cases = 67 total) - [x] Local: `helm lint deploy/helm/` succeeds - [x] Manual smoke test: chart deployed via ArgoCD against a homelab cluster from a personal S3 bucket, including the `applicationConfig` boolean/integer regressions that drove the multi-type fix - [x] Pre-merge: confirm `vars.HELM_S3_BUCKET` and `vars.HELM_REPO_URL` are set in the repo Actions settings - [x] Pre-merge: confirm AWS publish role has `s3:PutObjectTagging` permission (needed for the channel tag on release-channel uploads) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a comprehensive, stricter Helm values schema with richer annotations and a chart version bump. * **Tests** * Added a test suite validating schema enforcement with passing and failing value sets. * **Chores** * CI: added automated schema-check workflow, refined chart publish workflow (stable/release channel handling, immutability check, packaging and index update), renamed Helm unit-test job, and adjusted publish triggers. * **Documentation** * Added a rule documenting how to regenerate and validate the values schema. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD f2fc338 yet > <hr>Fri, 08 May 2026 17:01:09 UTC <!-- end of auto-generated comment: Cypress test results -->
## Summary - WarpBuild provisions runners across both AWS and Azure. Ubuntu cloud-init auto-configures the apt mirror based on the host cloud, so Azure-hosted runners use `azure.archive.ubuntu.com` (configured in `/etc/apt/apt-mirrors.txt` as priority 1) — which has been hanging connections (not erroring) due to ongoing Canonical mirror flakiness. Affected matrix shards stall on `apt-get update` for hours instead of failing fast. - Skip `apt-get update` entirely. `apt-get install ./chrome.deb` uses the runner image's existing apt cache (populated at image-provision time) to resolve Chrome's stable transitive deps (libnss3, libgbm1, libxkbcommon0, etc.). ## Verification Verified on the EE counterpart ([appsmithorg/appsmith-ee#9034](appsmithorg/appsmith-ee#9034)): all 60 matrix shards completed Chrome install in 12–42s (avg 16s) with zero hangs. The 4 test failures in that run were unrelated Cypress flakes (Chrome installed cleanly on every shard). Touches the 4 Cypress CI workflows that install Chrome 129: - `ci-test-custom-script.yml` - `ci-test-hosted.yml` - `ci-test-limited.yml` - `ci-test-limited-with-count.yml` ## Test plan - [ ] Trigger a `ci-test` run and confirm matrix shards complete Chrome install in well under a minute, regardless of cloud provider - [ ] Verify `google-chrome --version` still prints `129.0.6668.100` post-install - [ ] Confirm no `apt-get update` errors (since we no longer run it) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated CI Chrome installation steps across workflows: removed apt index refresh, made Chrome removal tolerant of failures, standardized a fixed Chrome version download, and added timeout/retry options. * Switched some download sources to hosted/artifact mirrors and added minor workflow comments; overall CI logic and other steps remain unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD e666968 yet > <hr>Wed, 06 May 2026 19:08:49 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR. <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No
## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Git" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/25729896761> > Commit: 8c19245 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=25729896761&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Tue, 12 May 2026 11:15:49 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Discard-changes now runs asynchronously in the background for faster responses. * New option to skip validation and publishing during discard operations. * **Behavior Change** * Post-branch creation cleanup is best-effort async so branch creation completes without waiting. * **Tests** * Added unit tests covering async discard-changes event publication and handling. [](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41785) <!-- end of auto-generated comment: release notes by coderabbit.ai -->
](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41785){kind=link}
…E-2025-52999 (#41789) ## Summary Remediates **CVE-2025-52999** (jackson-core deeply-nested-JSON DoS, **CVSS 8.7 High**) in the arangoDBPlugin runtime by upgrading the parent library that bundles the vulnerable jackson-core, rather than overriding the transitive dependency. ## Root cause (verified) `arangodb-java-driver:6.12.3` (June 2021, EOL) transitively pulls `com.arangodb:velocypack:2.5.3`, which **shades a relocated copy of `com.fasterxml.jackson.core:jackson-core:2.11.3`** at the package path `com.arangodb.velocypack.deps.com.fasterxml.jackson` inside the velocypack jar. The relocated `META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.properties` declares `version=2.11.3` — that is what Docker Scout detects at `/opt/appsmith/server/mongo/plugins/arangodbPlugin-1.0-SNAPSHOT/lib/`. velocypack uses these shaded classes to convert ArangoDB responses on the parsing path, so a deeply-nested JSON payload from a user-configured ArangoDB server can trigger `StackOverflowError` per the original customer justification. ## Fix approach (industry-standard, no transitive override) Upgrade the parent library: `arangodb-java-driver` `6.12.3` → `7.25.0` (Jan 2026, latest stable). Driver 7.x: - Removes `velocypack` from the default transitive set (only used when HTTP_VPACK content type is selected, which we no longer use after switching to the v7 default `HTTP2_JSON`). The shaded vulnerable jar disappears entirely. - Ships plain `jackson-core:2.20.0` via the `com.arangodb:jackson-serde-json` module, resolved to `2.17.0` after parent-managed `jackson-bom.version`. Both are well above the 2.15.0 fix threshold. - Auto-configures Jackson `StreamReadConstraints` (added in driver 7.5.0) as defense-in-depth, directly hardening the per-request DoS vector named in the customer justification. No `<dependencyManagement>` overrides, no transitive pinning, no shading workarounds. Fixes https://linear.app/appsmith/issue/APP-15211/resolve-cve-2025-52999-jackson-core-deeply-nested-json-dos-in ## Changes - **[`pom.xml`](app/server/appsmith-plugins/arangoDBPlugin/pom.xml)** — bump driver `6.12.3` → `7.25.0`; drop now-unused `org.apache.httpcomponents:httpclient` (v7 uses Vert.x WebClient internally; verified zero direct usages in plugin source via `rg "org\.apache\.http"`). - **[`ArangoDBPlugin.java`](app/server/appsmith-plugins/arangoDBPlugin/src/main/java/com/external/plugins/ArangoDBPlugin.java)** — migrate to v7 API: - `db.query(query, null, null, Map.class)` → `db.query(query, Map.class, null, null)` (parameter order changed in v7) - `useProtocol(...)` → `protocol(...)` (renamed in v7) - `Protocol.HTTP_VPACK` → `Protocol.HTTP2_JSON` (the v7 default; avoids needing the `jackson-serde-vpack` extra module) - Register a custom `JacksonSerde` with `USE_LONG_FOR_INTS` so query results preserve `Long` for integer values, matching v6 VPACK behavior. This keeps the structure-tree column types stable for users (e.g., a small integer like `age=20` still surfaces as `Long`, not `Integer`). - **[`ArangoDBErrorUtils.java`](app/server/appsmith-plugins/arangoDBPlugin/src/main/java/com/external/utils/ArangoDBErrorUtils.java)** — walk the cause chain for `UnknownHostException` and also detect the v7 `Cannot contact any host` message, so the user-visible bad-host error message stays the same as v6. - **[`ArangoDBPluginTest.java`](app/server/appsmith-plugins/arangoDBPlugin/src/test/java/com/external/plugins/ArangoDBPluginTest.java)** — align fixture with the protocol/serde change; replace test-fixture `LocalDate.of(...)` with a `Map` matching the test's own JSON Schema, and `BigDecimal(...)` with a `String` for the currency field (more realistic; doesn't depend on driver wire-format quirks). No production impact. ## Validation ### `mvn dependency:tree` — vulnerable deps absent ``` +- com.arangodb:arangodb-java-driver:jar:7.25.0:compile | +- com.arangodb:core:jar:7.25.0:compile | | +- com.fasterxml.jackson.core:jackson-core:jar:2.17.0:compile | +- com.arangodb:http-protocol:jar:7.25.0:compile | \- com.arangodb:jackson-serde-json:jar:7.25.0:compile ``` `velocypack` is no longer present. `jackson-core:2.17.0` (above the 2.15.0 fix threshold). ### Runtime `lib/` jar scan — vulnerable shaded copy gone ``` $ for j in target/lib/*.jar; do unzip -p "$j" META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.properties 2>/dev/null done | grep -c version=2.11.3 0 # zero jars contain shaded jackson-core 2.11.3 ``` The only `jackson-core/pom.properties` in `lib/` now belongs to the un-shaded `jackson-core-2.17.0.jar` itself. ### Tests — all green - `mvn -pl appsmith-plugins/arangoDBPlugin -am test`: **207/207 passing** (181 from interfaces parent + 26 from the plugin module, including the 4 testcontainer-backed end-to-end ArangoDB integration tests against `arangodb/arangodb:3.7.12` — connect, read AQL, write AQL with `writesExecuted/Ignored`, and structure discovery). - Live smoke test against `arangodb/arangodb:3.11.14`: all four production code paths exercised; numeric values come back as `Long` as before; string values remain `String`. ### CE→EE sync simulation Cherry-pick simulation shows a small mechanical conflict in the import block of `ArangoDBPlugin.java` (EE has additional Jackson imports for its EE-only `getConfigurationContent` method). Resolution is a union of imports. A pre-staged shadow EE PR with the resolved version will be opened immediately after this CE PR. ## Test plan - [ ] CI passes on this PR (server build + spotless + unit/integration tests). - [ ] Docker Scout rescan after the official EE image build no longer flags CVE-2025-52999. - [ ] Manual: configure an ArangoDB datasource in a deployed Appsmith, run an AQL `RETURN` query, verify result shape and structure-tree column types match pre-fix (numeric → `Long`). - [ ] Manual: trigger a bad host configuration and confirm the friendly "Could not find host address..." error still appears. Refs: CVE-2025-52999, customer-shared "Affected, fix planned" justification. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved detection and user-facing messaging for unreachable ArangoDB hosts. * **Chores** * Upgraded ArangoDB Java driver to a newer major version for compatibility and stability. * Updated client protocol/serialization and query/result handling for more consistent behavior. * **Tests** * Updated test setup and test data to align with the driver and client changes. [](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41789) <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Automation /ok-to-test tags="@tag.Datasource" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/25663120581> > Commit: c5622aa > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=25663120581&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Datasource` > Spec: > <hr>Mon, 11 May 2026 10:43:49 UTC <!-- end of auto-generated comment: Cypress test results -->
](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41789){kind=link}
## Description fix(security): Path Traversal in git file read/delete operations (GHSA-m4hv-9p7g-56vm) - **Primary fix:** Extended `validatePathIsWithinGitRoot()` coverage from write-only to all file operations (reads + deletes) via validated wrapper methods in `FileUtilsCEImpl`. All 31 direct `fileOperations.readFile/readFiles/readFileAsString` call sites now go through path validation. - **Defense-in-depth:** Widened `validatePathIsWithinGitRoot` visibility from `private` to `protected` so EE subclasses can reuse it. Added validated wrappers for `deleteFile` and `deleteDirectory` as well. - **Test coverage:** Added 2 regression tests: one verifying path traversal is blocked, one ensuring valid paths within git root still work. Fixes https://linear.app/appsmith/issue/APP-15180/security-path-traversal-in-file-operations-fileoperationscev2impl-ghsa ### Vulnerability | Field | Value | |-------|-------| | **GHSA** | [GHSA-m4hv-9p7g-56vm](GHSA-m4hv-9p7g-56vm) | | **CVE** | Not assigned | | **CVSS** | 7.7 (high) | | **CWE** | CWE-35 | | **Affected component** | `FileOperationsCEv2Impl` — git file operations | ### Exposure Analysis - **Who can exploit this?** An authenticated user with git connect/import permissions (Developer role or higher). The attacker needs to create or import a malicious git repository with crafted directory/file names containing path traversal sequences. - **What can an attacker achieve?** Read arbitrary files from the server filesystem, including sensitive configuration files, secrets, or user data. The vulnerability is read-only (writes were already protected). - **Evidence of exploitation in the wild?** No evidence of active exploitation. - **Blast radius:** Any self-hosted or cloud Appsmith instance with git features enabled. The attacker can read files accessible to the Appsmith server process, potentially affecting all workspaces on the instance. ### Fix - **Root cause:** Asymmetric path validation — `FileUtilsCEImpl` had `validatePathIsWithinGitRoot()` applied to all write operations (`saveResource`, `saveActions`, etc.) but not to any read operations (`readFile`, `readFiles`, `readFileAsString`) or delete operations (`deleteFile`, `deleteDirectory`). - **Fix strategy:** Created `protected` validated wrapper methods (`readFileValidated`, `readFilesValidated`, `readFileAsStringValidated`, `deleteFileValidated`, `deleteDirectoryValidated`) in `FileUtilsCEImpl` that validate path containment before delegating to `fileOperations`. Replaced all 31 direct read call sites and 8 delete call sites with the validated wrappers. - **Intentionally not changed:** `FileOperationsCEv2Impl` — this is the raw I/O layer that doesn't know about git root paths. Validation belongs in `FileUtilsCEImpl` which owns the path policy. `scanAndDelete*` methods are also unchanged since they operate on bounded `Files.walk()` results within an already-validated base directory. - **Defense-in-depth:** The validation method is now `protected` so EE's `FileUtilsImpl` (which has its own direct read calls) can inherit and use the same wrappers. ### CE/EE sync Shadow EE PR needed. `FileUtilsCEImpl.java` change syncs automatically via hourly CE→EE sync. EE's `FileUtilsImpl.java` has ~8 additional direct `fileOperations.readFile()` calls that need to be updated to use the inherited validated wrappers in a separate EE PR. ### Disclosure > **Do not merge until advisory is ready for disclosure coordination.** > > After merge: > 1. Confirm fix is in release branch > 2. Coordinate with security team on disclosure timeline > 3. Update advisory with patched version and publish > 4. Notify reporter ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/25638434147> > Commit: 809c50f > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=25638434147&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Sun, 10 May 2026 21:09:23 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No ## Follow-ups - Shadow EE PR for `FileUtilsImpl.java` to update EE-specific read/delete calls to use inherited validated wrappers - `FileOperationsCEv2Impl.saveMetadataResource()` calls its own `saveResource()` bypassing `FileUtilsCEImpl` validation — pre-existing gap, separate follow-up <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced security for Git repository file operations by enforcing path boundary validation on all read and delete operations to prevent unauthorized file access outside the configured repository. * **Tests** * Added regression tests validating path traversal attack prevention in Git repository operations. [](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41790) <!-- end of auto-generated comment: release notes by coderabbit.ai -->
](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41790){kind=link}
## Summary - Bumps the default Redis image tag in the Helm chart from `7.0.15` to `7.4.9` to address accumulated CVEs in the 7.0.x line - Also updates the example comment in the `initContainer` section to match ## Test plan - [x] Test on non-prod deployments and verify cluster status 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated Redis dependency to version 7.4.9. [](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41792) <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD 1cf4fdb yet > <hr>Mon, 11 May 2026 18:40:36 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41792){kind=link}
## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Git, @tag.ImportExport" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/25795345580> > Commit: d33b2b6 > Workflow: `PR Automation test suite` > Tags: `@tag.Git, @tag.ImportExport` > Spec: `` > <hr>Wed, 13 May 2026 11:09:50 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved import handling for actions and action collections in git-connected repositories to better detect and manage existing resources across multiple branches * Enhanced how the system identifies and retrieves resources during imports for more consistent and reliable behavior in multi-branch git workflows * Streamlined resource detection to ensure accurate handling of existing artifacts when importing in git-connected environments <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41806) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41806){kind=link}
…HSA-v6jh-fx3m-7xhw) (#41803) ## Description fix(security): Unauthenticated Access to Full OpenAPI Documentation (GHSA-v6jh-fx3m-7xhw) - **Primary fix:** Remove `/v3/**` from the `permitAll()` block in `SecurityConfig.java` so OpenAPI endpoints require authentication - **Defense-in-depth:** Disable springdoc API docs and Swagger UI by default via `springdoc.api-docs.enabled=false` and `springdoc.swagger-ui.enabled=false` in `application-ce.properties` - **Test coverage:** Added `OpenApiDocsAuthTest` verifying that unauthenticated requests to `/v3/docs` and `/v3/swagger-ui.html` return 401 Fixes APP-15216 ### Vulnerability | Field | Value | |-------|-------| | **GHSA** | [GHSA-v6jh-fx3m-7xhw](GHSA-v6jh-fx3m-7xhw) | | **CVE** | Not assigned | | **CVSS** | 5.3 (medium) | | **CWE** | CWE-200 | | **Affected component** | Unauthenticated Access to Full OpenAPI Documentation | ### Exposure Analysis - **Who can exploit:** Any unauthenticated network user. No credentials or special role required. - **What an attacker achieves:** Full enumeration of every API endpoint, request/response schemas, parameter names, and authentication requirements — significantly accelerating targeted reconnaissance. - **Exploited in the wild:** No evidence. The standard Caddy reverse proxy mitigates this by only routing `/api/*` to the backend, so the endpoints are not reachable through the proxy. However, self-hosted deployments that expose port 8080 directly or use a different reverse proxy are vulnerable. - **Blast radius:** Information disclosure only (API surface topology). No data modification or privilege escalation. ### Fix - **Root cause:** The `springdoc-openapi-starter-webflux-ui` dependency (added in PR #33477 as developer tooling) auto-registers OpenAPI endpoints at `/v3/docs` and `/v3/swagger`. The `/v3/**` path was explicitly added to the `permitAll()` block in `SecurityConfig.java`, bypassing authentication. - **Fix strategy:** Two defense-in-depth layers at the configuration level: (1) disable springdoc endpoint registration via properties, (2) remove the unauthenticated access exception from Spring Security. The pom.xml dependency is intentionally left in place so developers can re-enable springdoc locally. - **Intentionally NOT changed:** The springdoc dependency in `pom.xml` — removing it would break local development workflows. The `enabled=false` toggle is the standard springdoc mechanism for production disablement. ### CE/EE sync CE-only safe: no EE overrides of touched files (`SecurityConfig.java`, `application-ce.properties`). Hourly sync will propagate. ### Disclosure > **Do not merge until advisory is ready for disclosure coordination.** > > After merge: > 1. Confirm fix is in release branch > 2. Coordinate with security team on disclosure timeline > 3. Update advisory with patched version and publish > 4. Notify reporter ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/25784782954> > Commit: 7b1090c > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=25784782954&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 13 May 2026 08:46:29 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No ## Follow-ups - Integration test (`OpenApiDocsAuthTest`) requires full application context (MongoDB, Redis). Verified locally that it follows the same pattern as existing `AuthGuardTest` and `CsrfTest`. Will run in CI. - No additional instances of the vulnerable pattern found in codebase audit. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * API documentation endpoints (OpenAPI/Swagger UI) are no longer publicly accessible and now require authentication. * **Configuration** * API docs and Swagger UI are explicitly disabled by default. * **Tests** * Added tests to verify unauthenticated requests to the API docs and Swagger UI return 401 Unauthorized. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41803) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41803){kind=link}
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
subrata71
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promotion PR
Automation
/ok-to-test tags=""
🔍 Cypress test results
Caution
If you modify the content in this section, you are likely to disrupt the CI result for your PR.