📝 docs(freshness): correct stale auth/SSRF/WS/UI copy for the v1.6.1 delta - #569
Merged
Conversation
…delta Findings came from the adversarially-verified delta-docs-freshness workflow (30 findings against the security batch merged in 82d2b07/#567, plus the UI vocabulary changes staged on feat/v1.6-display-honesty for the same rc.3 train). - A1: rewrite the anonymous-auth "upgrade grace period" story everywhere it was documented (authentications page callout/matrix/upgrading section, security guide, README banner + quickstart line, DEPRECATIONS.md) — auth now fails closed on upgrades exactly like fresh installs, no more warn-and-serve grandfather path. - A2: document that the HTTP trigger never follows redirects, independent of the ALLOWMETADATA guard. - A3: document that WebSocket origin checks now validate scheme too, only trusting forwarded headers with DD_SERVER_TRUSTPROXY, across DEPRECATIONS.md, server config, FAQ, api/log.mdx, api/container.mdx, and quickstart. - A4: document the connect.sid -> drydock.sid session cookie rename and its one-time forced sign-out in DEPRECATIONS.md, the authentications upgrading section, and the README banner. - B3/B4/B5: update UI vocabulary docs (watchers, faq, api/container, update-eligibility, configuration/ui) for the pin-glyph/Current relabel, the maturity blocker's clockSource/clockStartAt fields, and the column-picker auto-hidden annotation. - apps/web: give the shared DockerRunSnippet (all 7 comparison pages) and the FAQ quickstart answer an auth flag so the one-liner actually starts a dashboard instead of throwing on the new fail-closed auth check. Skipped: content/docs/current/updates/index.mdx (strictly per-release curated notes, no Unreleased convention — rc.3 highlights land at the cut) and UPGRADE-NOTES.md (version-gated to the 1.4.6-1.5.x line only by scripts/append-upgrade-notes.mjs; adding v1.6 content there would leak into 1.5.x release notes).
Third fresh advisory today (GHSA-j3f2-48v5-ccww): protobufjs 7.5.0-7.6.4 vulnerable, fixed 7.6.5. app gets it transitively via dockerode→@grpc/proto-loader (new override), e2e via the existing artillery override pin (7.6.3 → 7.6.5).
The current docs now describe the v1.6 fail-closed upgrade behavior while the frozen v1.5 archive keeps the warn-and-serve copy that line shipped with; one shared regex can no longer pin both.
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
July 20, 2026 22:46
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 11 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe PR documents fail-closed authentication upgrades, anonymous-auth confirmation, and the Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@content/docs/current/configuration/authentications/index.mdx`:
- Around line 56-58: Verify the actual fail-closed runtime behavior from the
Anonymous initialization and authentication flow, then unify all descriptions to
match it. Update content/docs/current/configuration/authentications/index.mdx
lines 56-58 and 12, content/docs/current/guides/security/index.mdx line 108, and
README.md lines 35-39 and 168; preserve the documented behavior for
authenticated and explicitly confirmed anonymous access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8fcc8967-b81b-447b-8273-e5f3a736c9f5
⛔ Files ignored due to path filters (2)
app/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.jsone2e/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (18)
DEPRECATIONS.mdREADME.mdapp/package.jsonapps/web/src/app/data/faq.tsapps/web/src/components/docker-run-snippet.tsxcontent/docs/current/api/container.mdxcontent/docs/current/api/log.mdxcontent/docs/current/configuration/actions/update-eligibility.mdxcontent/docs/current/configuration/authentications/index.mdxcontent/docs/current/configuration/server/index.mdxcontent/docs/current/configuration/triggers/http/index.mdxcontent/docs/current/configuration/ui/index.mdxcontent/docs/current/configuration/watchers/index.mdxcontent/docs/current/faq/index.mdxcontent/docs/current/guides/security/index.mdxcontent/docs/current/quickstart/index.mdxe2e/package.jsonscripts/release-docs-identity.test.mjs
CodeRabbit caught the inconsistency: the behavior matrix said fresh installs return 401 while the new upgrade copy said drydock refuses to start. Verified against the code — Anonymous's registration throw is caught by the registry fallback (app/registry/index.ts) and the API serves every request a 401 via passport with zero strategies (app/api/auth.ts); /health reports 503. Unified all six sites on the 401-serving description and pinned it in the copy test.
Contributor
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/src/app/data/faq.ts`:
- Line 40: Update the authentication behavior description in the FAQ entry
around the Drydock deployment guidance: distinguish the unauthenticated API
response of 401 from the /health response of 503 when authentication is
unconfigured. Preserve the surrounding authentication options and fail-closed
behavior without claiming every request returns 401.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 021c9faa-27e8-4b77-b618-dbbe91a66a6d
📒 Files selected for processing (5)
README.mdapps/web/src/app/data/faq.tscontent/docs/current/configuration/authentications/index.mdxcontent/docs/current/guides/security/index.mdxscripts/release-docs-identity.test.mjs
🚧 Files skipped from review as they are similar to previous changes (4)
- scripts/release-docs-identity.test.mjs
- content/docs/current/guides/security/index.mdx
- content/docs/current/configuration/authentications/index.mdx
- README.md
scttbnsn
added a commit
that referenced
this pull request
Jul 21, 2026
Release plumbing for the v1.6.0-rc.3 cut — the full identity bump the guard tests enforce. - Dated `[1.6.0-rc.3] — 2026-07-21` CHANGELOG heading, fresh empty `[Unreleased]` section, matching link-reference definitions - rc.3 across README badge/highlights summary, website site-config + timeline, updates page (new rc.3 highlights section), API doc example payloads, quickstart tag matrix, and the demo runtime fixtures - Guard tests updated in lockstep: release-identity, release-docs-identity (compare base now `v1.6.0-rc.2...v1.6.0-rc.3`), changelog-links rc.3 delta over rc.2: #566 display-honesty batch, #567 security hardening, #568 maturity-clock restart fix (#565), #569 docs freshness. Verified: 105/105 script tests, 43/43 web-script tests, full pre-push gate green. Last dev-side change before the release head freeze. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog 🔧 **Changed** - Updated release identity from `v1.6.0-rc.2` to `v1.6.0-rc.3` across README, website metadata, roadmap, docs, API examples, quickstart tags, and demo fixtures. - Added the dated `v1.6.0-rc.3` updates section and refreshed changelog link references. - Updated release identity and documentation guard tests, including rc comparison ranges and candidate fixtures. ✨ **Added** - Documented the rc.3 changes covering issues `#566`, `#567`, `#568/`#565, and `#569`. 🔒 **Security** - Documented the rc.3 security hardening batch. ## Verification - Script tests: 105/105 passed - Web-script tests: 43/43 passed - Full pre-push gate: passed ## Concerns - Verify the release date `July 21, 2026` is correct. - Confirm all remaining `1.6.0-rc.2` references are intentional. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Merged
scttbnsn
added a commit
that referenced
this pull request
Jul 21, 2026
Promotes the v1.6.0-rc.3 content from `dev/v1.6` to `main` for the release cut. rc.3 delta over rc.2: - **#566 display-honesty batch** — update-status vocabulary ("Digest update", Unknown badge, "Security hold"), pin glyph driven by the real pin-gate verdict (`tagPinGated`), insight-only pinned rows read Current everywhere (table + detail panel), one-clock maturity panel, column-picker auto-hide annotations, registries deep-link fix (#556), banner pluralization, tooltip freshness. - **#567 security hardening** — anonymous auth fails closed on upgrades, HTTP trigger SSRF guards, full WebSocket origin validation, `drydock.sid` session cookie, owner-only store perms, pinned icon CDN revisions, CI secret scans. - **#568 maturity-clock restart fix** (#565) — the soak clock restarts only when the update candidate identity changes. - **#569 docs freshness** — auth/SSRF/WS/UI copy corrected to shipped v1.6 behavior. - **#571 release identity bump** — dated CHANGELOG heading, rc.3 across all public version surfaces, guard tests in lockstep. After merge: dispatch `release-cut.yml` from `main` with `release_tag=v1.6.0-rc.3`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Docs/copy freshness pass for the v1.6.1 delta (the #567 security batch, the #566 display batch, and the #568 maturity-clock fix). 30 findings from an adversarially-verified audit workflow (8 surface auditors, every finding independently re-verified against the shipped code before it counted; 1 rejected in verification), applied as one coherent edit per doc region:
DD_ANONYMOUS_AUTH_CONFIRM=trueis the opt-in.connect.sid→drydock.sidone-time sign-out documented in DEPRECATIONS.md, the upgrading section, and the README banner.ALLOWMETADATAescape hatch.api/log.mdx, andapi/container.mdxnow state that origin validation covers scheme/host/port and that forwarded headers are honored only withDD_SERVER_TRUSTPROXY.clockSource/clockStartAtblocker fields; the UI page covers the column-picker auto-hidden annotation. Wording grounded in the actual ✨ feat(ui): display-honesty batch — update-status vocabulary, pin glyph, one-clock maturity panel #566 locale strings, not paraphrased.DockerRunSnippet(all 7 comparison pages) and the FAQ quickstart now include the auth opt-in env var — without it the one-liner produces a container that refuses to start on the v1.6 line.Also rides along:
protobufjspinned to 7.6.5 (CVE-2026-59877 / GHSA-j3f2-48v5-ccww, third fresh advisory today) in app (new override) and e2e (existing override bumped) — it began failing the qlty osv-scanner gate mid-push.Deliberately skipped:
content/docs/current/updates/index.mdx(strictly per-release curated notes; rc.3 highlights belong to the actual cut) andUPGRADE-NOTES.md(version-gated to 1.4.6–1.5.x byscripts/append-upgrade-notes.mjs; v1.6 content there would leak into 1.5.x release notes).Why
The security batch merged with zero docs changes, leaving the auth docs actively contradicting shipped behavior. Docs on
dev/v1.6publish at the GA dev→main merge, so these corrections go live exactly when the behavior does.Tests
Full pre-push gate green. apps/web script tests 43/43; MDX parse validated via sync-docs + fumadocs-mdx; biome clean.
Changelog
DD_ANONYMOUS_AUTH_CONFIRM=true(and clarified/healthvs API response behavior).connect.sid→drydock.sidsession cookie rename and one-time sign-out on upgrade.ALLOWMETADATAescape hatch.Originvalidation (scheme/host/port) and clarified reverse-proxy requirements viaDD_SERVER_TRUSTPROXY+ forwarded headers (X-Forwarded-Proto/X-Forwarded-Host), including log-stream connection failures when misconfigured.maturity-not-reached(clock source + ISO-8601 start timestamp payload) and UI countdown rendering behavior.updateInsightchip styling + persistent pin glyph/tooltips.DD_ANONYMOUS_AUTH_CONFIRM=trueto website quickstarts and updated Docker run snippet wording.protobufjsto7.6.5in both app and e2e dependencies.content/docs/currentwhile preserving legacy v1.5 behavior.Concerns
DD_SERVER_TRUSTPROXYdocs explicitly require forwardingX-Forwarded-ProtoandX-Forwarded-Hostfor scheme/host matching./health503 reporting.ALLOWMETADATAis evaluated.