Skip to content

chore: roll up security dependency bumps (#525 to #532) #534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stirby merged 4 commits into from
Oct 6, 2026
+724 −565
Merged

chore: roll up security dependency bumps (#525 to #532) #534

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cf8808e
chore: roll up security dependency bumps
stirby Oct 3, 2026
9199315
chore: bump otel exporters and log SDK to fix GO-2026-6505, GO-2026-6…
stirby Oct 3, 2026
38799a3
fix(options): keep treating empty env values as unset
stirby Oct 3, 2026
7d9f058
refactor(options): rename ParseEnviron to EnvironWithoutEmptyValues
stirby Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion cmd/envbuilder/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ import (

func main() {
cmd := envbuilderCmd()
err := cmd.Invoke().WithOS().Run()
inv := cmd.Invoke().WithOS()
inv.Environ = options.ParseEnviron(os.Environ())
err := inv.Run()
if err != nil {
_, _ = fmt.Fprintf(os.Stderr, "error: %v", err)
os.Exit(1)
Expand Down
287 changes: 158 additions & 129 deletions go.mod
View file
Open in desktop

Large diffs are not rendered by default.

964 changes: 532 additions & 432 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions log/coder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ import (
"sync"
"time"

"cdr.dev/slog"
"cdr.dev/slog/sloggers/sloghuman"
"cdr.dev/slog/v3"
"cdr.dev/slog/v3/sloggers/sloghuman"
"github.com/coder/coder/v2/agent/proto"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/codersdk/agentsdk"
Expand Down
2 changes: 1 addition & 1 deletion log/coder_internal_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import (
"testing"
"time"

"cdr.dev/slog/sloggers/slogtest"
"cdr.dev/slog/v3/sloggers/slogtest"
"github.com/coder/coder/v2/agent/proto"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/codersdk/agentsdk"
Expand Down
21 changes: 21 additions & 0 deletions options/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -672,6 +672,22 @@ func skipDeprecatedOptions(options []serpent.Option) []serpent.Option {
return activeOptions
}

// ParseEnviron converts environ into a serpent.Environ for option parsing,
// dropping variables with empty values. Since serpent v0.15.0, an empty
// value overrides an option's default instead of being ignored. Envbuilder
// keeps treating empty values as unset so that existing templates that pass
// empty strings keep their defaults.
func ParseEnviron(environ []string) serpent.Environ {

@spikecurtis spikecurtis Oct 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Purpose and side effect of this function are obscured by its generic sounding name.

@stirby stirby Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renamed to EnvironWithoutEmptyValues in 7d9f058.

Generated by Coder Agents on behalf of @stirby.

envs := serpent.ParseEnviron(environ, "")
filtered := make(serpent.Environ, 0, len(envs))
for _, env := range envs {
if env.Value != "" {
filtered = append(filtered, env)
}
}
return filtered
}

// UnsetEnv unsets all environment variables that are used
// to configure the options.
func UnsetEnv() {
Expand All @@ -693,4 +709,9 @@ func UnsetEnv() {
// Unset the Kaniko environment variable which we set it in the
// Dockerfile to ensure correct behavior during building.
_ = os.Unsetenv("KANIKO_DIR")

// dd-trace-go (imported transitively via codersdk) sets this at init
// to propagate a per-process session ID to child processes. It must not
// leak into the workspace environment.
_ = os.Unsetenv("_DD_ROOT_GO_SESSION_ID")
}
7 changes: 7 additions & 0 deletions options/options_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ func TestEnvOptionParsing(t *testing.T) {
require.Equal(t, o.SetupScript, val)
})

t.Run("empty string keeps default", func(t *testing.T) {
t.Setenv(options.WithEnvPrefix("WORKSPACE_BASE_DIR"), "")
o := runCLI()
require.Equal(t, "/workspaces", o.WorkspaceBaseDir)
})

t.Run("int", func(t *testing.T) {
t.Setenv(options.WithEnvPrefix("CACHE_TTL_DAYS"), "7")
o := runCLI()
Expand Down Expand Up @@ -229,6 +235,7 @@ func runCLI() options.Options {
}

i := cmd.Invoke().WithOS()
i.Environ = options.ParseEnviron(os.Environ())
i.Args = []string{"--help"}
fakeIO(i)
err := i.Run()
Expand Down
Loading