* Apply `pnpx codemod run pnpm-v10-to-v11`
* Remove `eslint` hoisting, it's in the root package.json anyway
* `pnpm install`
* Bump Node.js to 24.15
* Bump pnpm to 11.1.1
* Update pnpm to 11.3.0
* Update `electron` to 42.2.0, `electron-builder` to 26.11.1
* Update `node-abi` to 4.31.0
* Override `yauzl` to workaround Electron not being installed on Node.js 24.16
* Update Node.js to 24.16
* Bump Playwright to 1.60.0
* Convert DeleteProxy RPC from HTTP to gRPC
* Use `t.Context()`
* Add more greppable TODO
* Fix usage of deprecated rpc
* Upsert RPC
* Use wrapper message for UpsertResponse
* gofmt
* Simplify godoc
* Update response message
* Update method names on public api client
* fix tests
* Introduce UpsertProxyWithoutServer
* Edoardo comments
* separate
* Change to UpsertProxyServer RPC handler
* tctl: add YAML parity for structured output commands
* Add WriteProto Go Doc comment
* Make output format flag visible in evaluate-db-access command
* Make output format flag visible in evaluate SSH command
* remove x509 override dry-run format flag
* refactor: simplify error messages for unknown output formats
* refactor: replace printJSON with utils.WriteJSON and WriteJSONArray
Render `/webapi/scripts/installer/:name` responses with the text
template engine instead of the HTML template engine. The endpoint emits
shell script content, so HTML entity escaping can corrupt rendered values
containing characters such as `&`, `<`, or `>`.
Resolves https://github.com/gravitational/pressure-washing/issues/195.
AWS SSO sessions return assumed-role ARNs from GetCallerIdentity
(e.g. arn:aws:sts::ACCOUNT:assumed-role/AWSReservedSSO_Admin_.../session)
but the corresponding IAM role lives at a path that includes the SSO
home region:
arn:aws:iam::ACCOUNT:role/aws-reserved/sso.amazonaws.com/REGION/AWSReservedSSO_Admin_...
The region component is not present in the STS ARN and cannot be
inferred by string manipulation, so the previous convertAssumedRoleToIAMRole
approach produced an incorrect ARN for SSO credentials, causing EKS
access entry creation to fail.
Fix this by adding iam:GetRole to the AWSClientGetter interface and
calling it with the role name extracted from the assumed-role ARN.
IAM accepts just the role name (no path required) and returns the
full ARN including the correct path. convertAssumedRoleToIAMRole is
retained as a fallback for cases where iam:GetRole is unavailable.
Signed-off-by: Tiago Silva <[email protected]>
* Refactor duplicated CA override logic into lib/subca
* Make getClientCert resilient to trailing PEM whitespace
* Drop a.subCAEnabled from lib/auth/ca_override.go
During a graceful restart (SIGHUP), the shutdown context passed to
StartShutdown has a very long timeout (MaxCertDuration). This means
ExitContext does not close until that timeout elapses, while
GracefulExitContext closes immediately when graceful shutdown begins.
reconnectToAuthService was selecting on ExitContext().Done(), so the
retry loop kept firing (with growing backoff) even after graceful
shutdown started — because ExitContext stays open throughout. Meanwhile,
connectToAuthService uses GracefulExitContext internally and returns
"context canceled" on every attempt. The net effect: register.discovery
and discovery.init never exited, Supervisor.Wait blocked indefinitely,
and the pod was stuck for the full 5m terminationGracePeriodSeconds
before Kubernetes sent SIGKILL.
Switching the select to GracefulExitContext().Done() makes the retry
loop exit as soon as graceful shutdown is initiated, unblocking the
supervisor and allowing the pod to terminate cleanly.
Signed-off-by: Tiago Silva <[email protected]>
Fix a self-deadlock in `(*Server).startDynamicWatcherUpdater`. When the
watcher receives an `OpPut` event for an already-tracked `DiscoveryConfig`
whose `DiscoveryGroup` no longer matches the local server, the `OpPut`
handler acquires `dynamicDiscoveryConfigMu.RLock()` for the existence
check, never releases it on the fall-through path, then calls
`dynamicDiscoveryConfigMu.Lock()`. Go's `sync.RWMutex` does not allow a
same-goroutine upgrade from read to write, so `Lock()` blocks forever.
The dynamic-config watcher goroutine wedges and no further
`DiscoveryConfig` events are processed until the process is restarted.
Mirror the sibling `OpDelete` handler: take `RLock`, read, `RUnlock`,
then branch on the membership flag, then acquire the write lock. Also
drop a duplicate "part" in the adjacent comment.
Add `TestDiscoveryServer_dynamicMatcherGroupReassign`, which drives an
`OpPut` event for an already-tracked config with a non-matching group,
then sends an unrelated event and asserts forward progress. Without
the fix the test times out at 30s with the watcher goroutine blocked
on `Lock()`.
* Add vulnerability management page to docs
* Fix some typos and improve language
* clarify cadence for updates, fix stylistic issues
* add govulncheck to cspell
* Add Troubleshooting notes to Azure join guide
Fixes#61191
- Add table of required endpoints to the Prerequisites section
- Add a Troubleshooting section that illustrates error messages that
occur if Teleport services cannot reach the required endpoints
* Clarify the Azure join guide
- Split a long Prerequisites item (per mmcallister feedback).
- Add a URL to the table of required URLs.
In #65190, we inadvertently introduced two small issues, which this
change fixes:
- Remove a reference to a nonexistent role. This was a mistake due to a
find/replace operation.
- Add full permissions to the access-plugin-update role. The Jira Access
Request plugin needs to list and read `access_plugin_data`, not just
create it.
* Make `VnetContext` tests depend on action order rather than no of calls
* Explain the idea behind acknowledgement/dismissal being "sticky"
* Update Jest mock outside of `act`
Grzegorz Zdunek