🚚 Release by MicahParks · Pull Request #534 · netboxlabs/diode

MicahParks · 2026-05-22T16:04:36Z

This release contains a number of performance improvements and the Diode system has some breaking changes. It will require diode-netbox-plugin version 1.12.0

…463) Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

)

Co-authored-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

#474)

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

Each service config has it's own pprof listener directive defaulting to localhost.

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

#488)

…in /diode-server in the go_modules group across 1 directory (#494) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

…mark (#522) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…#527) Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…pled ingestion processing (#526) Co-authored-by: Micah Parks <66095735+MicahParks@users.noreply.github.com>

github-advanced-security · 2026-05-22T16:04:38Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

CLAassistant · 2026-05-22T16:04:48Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
7 out of 8 committers have signed the CLA.

✅ manrodrigues
✅ mfiedorowicz
✅ paulstuart
✅ jajeffries
✅ MicahParks
✅ leoparente
✅ marc-barry
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

github-actions · 2026-05-22T16:06:22Z

Vulnerability Scan: Passed — diode-ingester

Image: diode-ingester:scan

No vulnerabilities found.

Commit: a616a58

github-actions · 2026-05-22T16:06:23Z

Vulnerability Scan: Passed — diode-reconciler

Image: diode-reconciler:scan

No vulnerabilities found.

Commit: a616a58

github-actions · 2026-05-22T16:06:36Z

Vulnerability Scan: Passed — diode-auth

Image: diode-auth:scan

Source	Library	CVE	Severity	Installed	Fixed	Title
usr/bin/hydra	github.com/docker/docker	CVE-2026-34040	🟠 HIGH	v28.3.3+incompatible	29.3.1	Moby: Moby: Authorization bypass vulnerability
usr/bin/hydra	github.com/docker/docker	CVE-2026-33997	🟡 MEDIUM	v28.3.3+incompatible	29.3.1	moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plu
usr/bin/hydra	github.com/go-jose/go-jose/v3	CVE-2026-34986	🟠 HIGH	v3.0.4	3.0.5	github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of
usr/bin/hydra	github.com/jackc/pgx/v5	CVE-2026-33816	🔴 CRITICAL	v5.7.5	5.9.0	github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra	github.com/jackc/pgx/v5	CVE-2026-41889	⚪ LOW	v5.7.5	5.9.2	github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditio
usr/bin/hydra	go.opentelemetry.io/otel	CVE-2026-29181	🟠 HIGH	v1.40.0	1.41.0	OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive alloc
usr/bin/hydra	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	CVE-2026-39882	🟡 MEDIUM	v1.37.0	1.43.0	OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1 ...
usr/bin/hydra	go.opentelemetry.io/otel/sdk	CVE-2026-39883	🟠 HIGH	v1.40.0	1.43.0	opentelemetry-go: BSD kenv command not using absolute path enables PATH hijackin
usr/bin/hydra	stdlib	CVE-2026-25679	🟠 HIGH	v1.26.0	1.25.8, 1.26.1	net/url: Incorrect parsing of IPv6 host literals in net/url
usr/bin/hydra	stdlib	CVE-2026-27137	🟠 HIGH	v1.26.0	1.26.1	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
usr/bin/hydra	stdlib	CVE-2026-32280	🟠 HIGH	v1.26.0	1.25.9, 1.26.2	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certific
usr/bin/hydra	stdlib	CVE-2026-32281	🟠 HIGH	v1.26.0	1.25.9, 1.26.2	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certifica
usr/bin/hydra	stdlib	CVE-2026-32283	🟠 HIGH	v1.26.0	1.25.9, 1.26.2	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key up
usr/bin/hydra	stdlib	CVE-2026-33810	🟠 HIGH	v1.26.0	1.26.2	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorr
usr/bin/hydra	stdlib	CVE-2026-33811	🟠 HIGH	v1.26.0	1.25.10, 1.26.3	When using LookupCNAME with the cgo DNS resolver, a very long CNAME re ...
usr/bin/hydra	stdlib	CVE-2026-33814	🟠 HIGH	v1.26.0	1.25.10, 1.26.3	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
usr/bin/hydra	stdlib	CVE-2026-39820	🟠 HIGH	v1.26.0	1.25.10, 1.26.3	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
usr/bin/hydra	stdlib	CVE-2026-39836	🟠 HIGH	v1.26.0	1.25.10, 1.26.3	Panic in Dial and LookupPort when handling NUL byte on Windows in net
usr/bin/hydra	stdlib	CVE-2026-42499	🟠 HIGH	v1.26.0	1.25.10, 1.26.3	Pathological inputs could cause DoS through consumePhrase when parsing ...
usr/bin/hydra	stdlib	CVE-2026-27142	🟡 MEDIUM	v1.26.0	1.25.8, 1.26.1	html/template: URLs in meta content attribute actions are not escaped in html/te
usr/bin/hydra	stdlib	CVE-2026-32282	🟡 MEDIUM	v1.26.0	1.25.9, 1.26.2	golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
usr/bin/hydra	stdlib	CVE-2026-32288	🟡 MEDIUM	v1.26.0	1.25.9, 1.26.2	archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously
usr/bin/hydra	stdlib	CVE-2026-32289	🟡 MEDIUM	v1.26.0	1.25.9, 1.26.2	html/template: golang: html/template: Cross-Site Scripting (XSS) via improper co
usr/bin/hydra	stdlib	CVE-2026-39823	🟡 MEDIUM	v1.26.0	1.25.10, 1.26.3	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
usr/bin/hydra	stdlib	CVE-2026-39825	🟡 MEDIUM	v1.26.0	1.25.10, 1.26.3	ReverseProxy can forward queries containing parameters not visible to ...
usr/bin/hydra	stdlib	CVE-2026-39826	🟡 MEDIUM	v1.26.0	1.25.10, 1.26.3	If a trusted template author were to write a <script> tag containing a ...
usr/bin/hydra	stdlib	CVE-2026-27138	⚪ LOW	v1.26.0	1.26.1	crypto/x509: Panic in name constraint checking for malformed certificates in cry
usr/bin/hydra	stdlib	CVE-2026-27139	⚪ LOW	v1.26.0	1.25.8, 1.26.1	os: FileInfo can escape from a Root in golang os module

Commit: a616a58

github-actions · 2026-05-22T16:07:25Z

Go test coverage

STATUS	ELAPSED	PACKAGE	COVER	PASS
🟢 PASS	1.47s	github.com/netboxlabs/diode/diode-server/auth	44.7%	42
🟢 PASS	0.90s	github.com/netboxlabs/diode/diode-server/auth/cli	0.0%	0
🟢 PASS	1.02s	github.com/netboxlabs/diode/diode-server/authutil	82.8%	5
🟢 PASS	0.14s	github.com/netboxlabs/diode/diode-server/dbstore/postgres	0.0%	0
🟢 PASS	1.08s	github.com/netboxlabs/diode/diode-server/entityhash	79.2%	13
🟢 PASS	1.12s	github.com/netboxlabs/diode/diode-server/entitymatcher	82.8%	97
🟢 PASS	0.11s	github.com/netboxlabs/diode/diode-server/errors	0.0%	0
🟢 PASS	1.19s	github.com/netboxlabs/diode/diode-server/graph	52.0%	81
🟢 PASS	1.02s	github.com/netboxlabs/diode/diode-server/grpckeepalive	100.0%	1
🟢 PASS	1.53s	github.com/netboxlabs/diode/diode-server/ingester	85.4%	66
🟢 PASS	1.13s	github.com/netboxlabs/diode/diode-server/matching	94.1%	66
🟢 PASS	1.07s	github.com/netboxlabs/diode/diode-server/migrator	70.4%	4
🟢 PASS	3.12s	github.com/netboxlabs/diode/diode-server/netboxdiodeplugin	45.4%	23
🟢 PASS	0.16s	github.com/netboxlabs/diode/diode-server/pprof	0.0%	0
🟢 PASS	5.09s	github.com/netboxlabs/diode/diode-server/reconciler	62.0%	92
🟢 PASS	0.11s	github.com/netboxlabs/diode/diode-server/reconciler/changeset	0.0%	0
🟢 PASS	1.07s	github.com/netboxlabs/diode/diode-server/reconciler/differ	49.3%	23
🟢 PASS	1.02s	github.com/netboxlabs/diode/diode-server/server	85.7%	14
🟢 PASS	1.01s	github.com/netboxlabs/diode/diode-server/strcase	100.0%	24
🟢 PASS	1.02s	github.com/netboxlabs/diode/diode-server/telemetry	28.0%	26
🟢 PASS	1.02s	github.com/netboxlabs/diode/diode-server/telemetry/otel	90.2%	25
🟢 PASS	0.09s	github.com/netboxlabs/diode/diode-server/tls	0.0%	0
🟢 PASS	1.01s	github.com/netboxlabs/diode/diode-server/version	100.0%	2

Total coverage: 52.6%

mfiedorowicz and others added 30 commits January 19, 2026 10:41

fix: make index creation idempotent in entity hash lookup migration (#…

65f8aee

…463) Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

chore: update CODEOWNERS (#465)

83b7a57

feat(matching): add fuzzy string matching package (#464)

f84c30c

feat(protograph): add entity mapping code generator (#466)

1e9ab2d

feat(db): add graph tables migration for entity storage (#467)

488ee9f

feat(db): add SQLC queries and generated code for graph tables (#468)

ff60ddc

feat(entitymatcher): add confidence-based entity matching package (#470)

f7f7d0f

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

feat(reconciler): add GraphBuilder for recursive entity extraction (#471

343b589

)

feat(reconciler): integrate graph DB with feature flag (#472)

41bd6e5

feat: list entities rpc (#473)

731ce14

chore: Implement pytest in Diode (#469)

1f56d16

Co-authored-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

feat(reconciler): add CreateEntity RPC for synchronous entity creation (

32e7242

#474)

Chore: (OBS-1959) python linting (#475)

525476d

feat: add DeviceConfig (#476)

0ad24c0

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

add optional pprof listeners to servers

85a84d0

include supporting file

eff7051

use service configs to set auth endpoints

c750b7f

restore removed return for early error

f0b5662

feat: add optional pprof listeners to servers (#478)

caaa7ce

Each service config has it's own pprof listener directive defaulting to localhost.

feat(graph): add metadata storage and lookup for entity matching (#480)

1fb551e

remove defaults and allow distinct env names for each pprof env var

85ec6f2

consistent naming for pprof var

a4fb468

fix: remove defaults for pprof env var (#481)

78216d9

fix erroneously updated doc

410af18

fix: docs had wrong info for pprof env var (#482)

dce5917

refactor: graph package (#486)

f42de3b

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

chore: remove CreateEntity and ListEntities RPCs from reconciler proto (

b56fb63

#488)

refactor: graph pkg - Service reshape + ListNodes (#491)

4b2bac5

chore(deps): bump go.opentelemetry.io/otel/sdk from 1.36.0 to 1.40.0 …

d254bcd

…in /diode-server in the go_modules group across 1 directory (#494) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: prevent infinite recursion in updateRefsInData (#495)

c8287b9

Signed-off-by: Michal Fiedorowicz <mfiedorowicz@netboxlabs.com>

MicahParks and others added 4 commits May 13, 2026 13:23

feat(ingester): opt-in soft-shed when Redis memory crosses high-water…

4a78218

…mark (#522) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

feat(OBS-2873): add gRPC server keepalive for ingester and reconciler (…

dcb9384

…#527) Co-authored-by: Cursor <cursoragent@cursor.com>

feat: sync ingester.proto for NetBox 4.6 support (#528)

71939f0

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

feat(reconciler): persistent worker pools + bulk operations for decou…

e496e1f

…pled ingestion processing (#526) Co-authored-by: Micah Parks <66095735+MicahParks@users.noreply.github.com>

github-actions Bot added documentation Improvements or additions to documentation go markdown python diode-proto github-actions dependencies diode-server diode-ingester diode-reconciler internal build diode-chart labels May 22, 2026

MicahParks marked this pull request as ready for review May 22, 2026 16:05

MicahParks requested review from jajeffries, leoparente, ltucker and mfiedorowicz as code owners May 22, 2026 16:05

mfiedorowicz approved these changes May 22, 2026

View reviewed changes

MicahParks merged commit b87f1da into release May 22, 2026
28 of 29 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚚 Release#534

🚚 Release#534
MicahParks merged 60 commits into
releasefrom
develop

MicahParks commented May 22, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented May 22, 2026

Uh oh!

CLAassistant commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Uh oh!

Conversation

MicahParks commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-advanced-security AI commented May 22, 2026

What Enabling Code Scanning Means:

Uh oh!

CLAassistant commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Vulnerability Scan: Passed — diode-ingester

Uh oh!

github-actions Bot commented May 22, 2026

Vulnerability Scan: Passed — diode-reconciler

Uh oh!

github-actions Bot commented May 22, 2026

Vulnerability Scan: Passed — diode-auth

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

MicahParks commented May 22, 2026 •

edited

Loading