Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add security policy #1207

Merged
merged 4 commits into from
Jul 18, 2023
Merged

Add security policy #1207

merged 4 commits into from
Jul 18, 2023

Conversation

johnrballard
Copy link
Contributor

This adds a security policy to the repository to report security issues via the github security vulnerability feature.

workingjubilee
workingjubilee reviewed Jul 12, 2023
View reviewed changes
security.md Outdated Show resolved Hide resolved
@eeeebbbbrrrr
Copy link
Contributor

PR contains changes to README.md that it shouldn't. @johnrballard I think this PR needs to be rebased. Would you mind doing that? You'll have to force-push the branch.

@johnrballard johnrballard changed the base branch from develop to master July 14, 2023 15:08
@johnrballard johnrballard changed the base branch from master to develop July 18, 2023 12:20
@johnrballard
Copy link
Contributor Author

PR contains changes to README.md that it shouldn't. @johnrballard I think this PR needs to be rebased. Would you mind doing that? You'll have to force-push the branch.

@eeeebbbbrrrr I have updated the source branch to point to develop.

@eeeebbbbrrrr eeeebbbbrrrr merged commit 1097819 into pgcentralfoundation:develop Jul 18, 2023
eeeebbbbrrrr pushed a commit that referenced this pull request Jul 18, 2023
@johnrballard @workingjubilee @eeeebbbbrrrr
Add security policy (#1207)
15e679c 
Co-authored-by: Jubilee <[email protected]>
@eeeebbbbrrrr
Copy link
Contributor

Thanks, @johnrballard. This was cherry-picked into master so it's live on the repo landing page too.

@eeeebbbbrrrr
Copy link
Contributor

Note, I renamed this to SECURITY.md in a separate commit. I would have just asked for that in the original PR but I didn't notice.

https://github.com/pgcentralfoundation/pgrx/blob/master/SECURITY.md

@eeeebbbbrrrr eeeebbbbrrrr mentioned this pull request Aug 1, 2023
Merged
eeeebbbbrrrr added a commit that referenced this pull request Aug 1, 2023
@eeeebbbbrrrr
Update version to 0.10.0-beta.2 (#1244)
d3a3901 
This is the third beta in the pgrx v0.10.x series. It contains a number
of soundness fixes, better error handling, more testing, and other
general code cleanup.

## Soundness Issues

* `AnyNumeric` is no longer backed by Postgres-allocated memory by
@eeeebbbbrrrr in #1216

## CI and general Testing Support

* Testing help by @eeeebbbbrrrr in
#1203
* Type testability cleanup by @eeeebbbbrrrr in
#1204
* Type roundtrip tests by @eeeebbbbrrrr in
#1185
* Stop SpiClient soundness from regressing by @workingjubilee in
#1214
* Initial valgrind support by @thomcc in
#1218
* Add a env flag that can be set to skip `#[pg_test]`-generated tests.
by @thomcc in #1239
* Ignores UI tests for MUSL environments by @BradyBonnette in
#1235
* Changes GHA workflows to use new upgraded runners by @BradyBonnette in
#1225

## General Improvements

* Add support for handling SIGINT and SIGCHLD from bgworker by @JelteF
in #1229
* Fix issue #1076: Properly handle dependency graph of `Result<T, _>` by
@eeeebbbbrrrr in #1241

## Improved Error Reporting

* Try to smartly propagate fs errors by @workingjubilee in
#1186
* Addresses cargo-pgrx error reporting by @BradyBonnette in
#1238
* Cleanup the error when cargo-pgrx version doesn't match Cargo.toml by
@eeeebbbbrrrr in #1240

## Additional Postgres Headers

* Add operator and cache related api by @VoVAllen in
#1242
* Add foreign table headers by @workingjubilee in
#1226
* Add postmaster related api by @JelteF in
#1237

## Internal Code Organization

* Modularize pgrx::spi by @workingjubilee in
#1219
* Modularize the interior of pgrx-pg-sys by @workingjubilee in
#1227

## Postgres 16-motivated Changes

* Add a workaround for the pg16/homebrew/icu4c situation by @thomcc in
#1206

## General Project Stuff

* Add security policy by @johnrballard in
#1207

## New Contributors
* @johnrballard made their first contribution in
#1207
* @VoVAllen made their first contribution in
#1242

**Full Changelog**:
v0.10.0-beta.1...v0.10.0-beta.2
@eeeebbbbrrrr eeeebbbbrrrr mentioned this pull request Sep 5, 2023
Merged
eeeebbbbrrrr added a commit that referenced this pull request Sep 5, 2023
@eeeebbbbrrrr
Update version to 0.10.0 (#1280)
3d1c8e3 
This is the final release of v0.10.0. Thanks everyone for the beta
testing, pull requests, issues, and patience.

As always, install `cargo-pgrx` with `cargo install cargo-pgrx --locked`
and update your extension Cargo.toml files to use the `0.10.0` pgrx
dependencies.

This release includes support for Postgres 16RC1. Support for the
previous betas has been removed. As such, a fresh `cargo pgrx init` is
required.

## What's Changed Since v0.10.0-beta.4

* Fix `GetMemoryChunkContext` port by @workingjubilee in
#1273
* Better error messages when `pg_config` isn't found. by @eeeebbbbrrrr
in #1271
* Make `PostgresHash` also need `Eq` by @workingjubilee in
#1264
* Memoize git hash and extension metadata by @levkk in
#1274
* move to pg16rc1 by @eeeebbbbrrrr in
#1276
* Fix bgworker template up to 0.10.0-beta.4 by @workingjubilee in
#1270

## New Contributors
* @levkk made their first contribution in
#1274

**Changelog**:
v0.10.0-beta.4...v0.10.0

---

v0.10.0's full set of changes throughout the entire beta period are:

* Postgres 16beta1 Support by @eeeebbbbrrrr in
#1169
* Support building against macOS universal binaries by @clowder in
#1166
* list specific versions in feature gates by @eeeebbbbrrrr in
#1175
* Fix bug with converting a `pg_sys::Datum` into a `pgrx::Date` by
@eeeebbbbrrrr in #1177
* Fix Arrays with leading nulls by @eeeebbbbrrrr in
#1180
* Disable hello_versioned_so test by @workingjubilee in
#1192
* doc: fix link broken by @yihong0618 in
#1181
* fcinfo: fix incorrect length set in unsafe code by @Sasasu in
#1190
* update to pg16beta2 support by @eeeebbbbrrrr in
#1188
* Array-walking is aligned by @workingjubilee in
#1191
* Implement PGRXSharedMemory for Deque by @feikesteenbergen in
#1170
* Include security labels header by @daamien in
#1189
* Fixes macos-11 tests by @BradyBonnette in
#1197
* Pgcentralfoundation updates again by @eeeebbbbrrrr in
#1200
* Update version to 0.10.0-beta.0 by @eeeebbbbrrrr in
#1201
* Testing help by @eeeebbbbrrrr in
#1203
* Type testability cleanup by @eeeebbbbrrrr in
#1204
* Try to smartly propagate fs errors by @workingjubilee in
#1186
* Fix issue #1209 by @eeeebbbbrrrr in
#1210
* Type roundtrip tests by @eeeebbbbrrrr in
#1185
* Update version to 0.10.0-beta.1 by @eeeebbbbrrrr in
#1213
* Add a workaround for the pg16/homebrew/icu4c situation by @thomcc in
#1206
* Add security policy by @johnrballard in
#1207
* `AnyNumeric` is no longer backed by Postgres-allocated memory by
@eeeebbbbrrrr in #1216
* Modularize pgrx::spi by @workingjubilee in
#1219
* Stop SpiClient soundness from regressing by @workingjubilee in
#1214
* Add foreign table headers by @workingjubilee in
#1226
* Modularize the interior of pgrx-pg-sys by @workingjubilee in
#1227
* Initial valgrind support by @thomcc in
#1218
* Add support for handling SIGINT and SIGCHLD from bgworker by @JelteF
in #1229
* Ignores UI tests for MUSL environments by @BradyBonnette in
#1235
* Add a env flag that can be set to skip `#[pg_test]`-generated tests.
by @thomcc in #1239
* Fix issue #1076: Properly handle dependency graph of `Result<T, _>` by
@eeeebbbbrrrr in #1241
* Cleanup the error when cargo-pgrx version doesn't match Cargo.toml by
@eeeebbbbrrrr in #1240
* Add operator and cache related api by @VoVAllen in
#1242
* Addresses cargo-pgrx error reporting by @BradyBonnette in
#1238
* Update version to 0.10.0-beta.2 by @eeeebbbbrrrr in
#1244
* Bump cargo-metadata and clap-cargo by @thomcc in
#1246
* Derive Clone for Inet by @JelteF in
#1251
* Correct docs for datetime `From` impls by @workingjubilee in
#1253
* Only enable line tables for profile.dev by @thomcc in
#1249
* Remove references to master branch by @thomcc in
#1243
* Ensure bindgen gets all the `cppflags` it needs (on macOS, anyway) by
@thomcc in #1247
* update for pg16beta3 support by @eeeebbbbrrrr in
#1254
* Update version to 0.10.0-beta.3 by @eeeebbbbrrrr in
#1255
* Add proptest support by @workingjubilee in
#1258
* Misc reformatting and typo fixes by @workingjubilee in
#1260
* spi: simplify (optimize?) Datum preparation by @vrmiguel in
#1256
* Assume commutation when deriving PostgresEq by @workingjubilee in
#1261
* Demand Ord for PostgresOrd by @workingjubilee in
#1262
* Fix pgrx install causing postgresql coredump by @Sasasu in
#1263
* Update version to 0.10.0-beta.4 by @workingjubilee in
#1267

## New Contributors
* @clowder made their first contribution in
#1166
* @yihong0618 made their first contribution in
#1181
* @Sasasu made their first contribution in
#1190
* @daamien made their first contribution in
#1189
* @johnrballard made their first contribution in
#1207
* @VoVAllen made their first contribution in
#1242
* @vrmiguel made their first contribution in
#1256


**Full Changelog**:
v0.9.8...v0.10.0
@bayandin bayandin mentioned this pull request Sep 6, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@workingjubilee workingjubilee workingjubilee left review comments

@eeeebbbbrrrr eeeebbbbrrrr eeeebbbbrrrr approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@johnrballard @eeeebbbbrrrr @workingjubilee