github-featured/conductor-oss--conductor
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
6,005 Commits 240 Branches 501 Tags
fix/docs-deploy-pythonpath
Commit Graph

107 Commits

Author SHA1 Message Date
Viren Baraiya 8f78c0a781 Resolve #1490: CVEs detected in Conductor-OSS 3.32.0-rc.23 dependencies (#1502) 
* conductor workspace baseline [conductor-workspace:6589c18f-c889-4d2a-b5d8-08a22da1c609:baseline]

Conductor-Original-Branch: main
Conductor-Original-Head: 4799963183

* code_subtask secure-bom-transitives

* code_subtask align-kafka-event-queue

* code_subtask upgrade-direct-libraries

* code_subtask upgrade-boot-jackson

---------

Co-authored-by: Naomi Most <naomi.most@orkes.io>
 2026-08-10 09:53:34 -07:00
Viren Baraiya 978c47a9f0 Move SecretsDAO to org.conductoross package and simplify agentspan integration 
Relocates SecretsDAO out of the legacy com.netflix.conductor.dao package,
adapts SkillMetadataDAO implementations accordingly, and removes the
AgentSpan embedded environment post-processor, principal filter, and
env-backed credential store in favor of a simpler configuration wired
directly through application.properties (agentspan.embedded).
 2026-07-12 22:53:15 -07:00
Viren Baraiya 5cf15d6a4e Revert "MCP for Workflow" (#1137) 2026-05-28 07:45:16 -07:00
kowser 1d398c2b30 MCP for Workflow 2026-05-26 10:04:06 -07:00
Tom Watkins d02296b7ae Update Tomcat version to 10.1.54 2026-04-21 21:08:03 +01:00
Naomi Most 8b2cef9069 build: add dependency pinning system (#964) (#965) 
Converts tribal knowledge about version constraints into grep-able,
enforceable documentation.

- Add // PINNED (#964): tag to all 8 hard-cap locations
- Standardize // Security: and // Compat: prefixes on version floors
- Introduce revGraalVM variable; all five GraalVM artifacts now use it
- Add dependabot.yml ignore rules for protobuf* >= 4.0
- Add dependabot.yml graalvm group for coordinated family upgrades
- Add ## Dependency Pinning section to AGENTS.md documenting all conventions
 2026-04-03 16:58:14 -07:00
Viren Baraiya 4cb030bf08 Refactor redis and upgrade jedis (#927)
CI / build (push) Has been cancelled
Details
CI / test-harness (push) Has been cancelled
Details
CI / build-ui (push) Has been cancelled
Details
2026-03-28 13:12:39 -07:00
Rajeshwar Agrawal 9e99cac928 Feature: Add support for ES8 Persistence (#739) 2026-03-18 10:34:53 -07:00
nthmost-orkes b8161ade63 fix: use capabilitiesResolution to resolve lz4-java capability conflict 
eachDependency alone is insufficient because capability conflicts are
resolved during module selection, before version selection runs.
at.yawk.lz4:lz4-java:1.8.1 declares Gradle capability org.lz4:lz4-java:1.8.1
in its module metadata. When lz4-java is upgraded to 1.8.1 for CVE-2025-12183,
both modules claim the same capability and Gradle deadlocks.

Add capabilitiesResolution rule to explicitly prefer org.lz4:lz4-java
over the at.yawk fork when both are present, breaking the tie.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-07 20:14:59 +13:00
nthmost-orkes 801ef58cc4 fix: resolve lz4-java capability conflict in conductor-kafka build 
at.yawk.lz4:lz4-java declares the same Gradle capability as org.lz4:lz4-java.
Using a dependency constraint forced org.lz4:lz4-java onto the classpath as a
direct dependency, triggering an unresolvable capability conflict with the yawk
fork. Moved the version pin to resolutionStrategy.eachDependency which upgrades
existing transitive deps without adding a new direct dependency.

CVE-2025-12183 mitigation is preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-07 20:05:26 +13:00
Naomi Most ee74bf1d71 Merge branch 'main' into fix/security-dependency-bumps 2026-03-06 21:53:52 +00:00
nthmost-orkes c00c0b4b61 Bump Spring Boot 3.3.5 to 3.3.11 and pin vulnerable transitive deps 
Spring Boot BOM bump fixes:
- CVE-2025-48988: Tomcat DoS in multipart upload
- CVE-2025-48989: Tomcat HTTP/2 MadeYouReset DoS
- CVE-2025-55752: Tomcat directory traversal with possible RCE
- CVE-2025-22235: Spring Boot EndpointRequest.to() wrong matcher
- CVE-2025-41249: Spring Framework annotation detection vulnerability

Dependency version constraints added for transitive deps:
- CVE-2025-66516: tika-core 3.0.0 -> 3.2.2 (CRITICAL)
- CVE-2025-48734: commons-beanutils 1.9.4 -> 1.11.0
- CVE-2025-12183: lz4-java 1.8.0 -> 1.8.1
- CVE-2025-59250: mssql-jdbc 12.6.4 -> 12.8.2.jre11
 2026-02-27 04:24:17 -08:00
dependabot[bot] 3b51204bf8 Bump org.projectlombok:lombok from 1.18.34 to 1.18.42 
Bumps [org.projectlombok:lombok](https://github.com/projectlombok/lombok) from 1.18.34 to 1.18.42.
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](https://github.com/projectlombok/lombok/compare/v1.18.34...v1.18.42)

---
updated-dependencies:
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-25 09:54:29 +00:00
Naomi Most 95ad464fdb Merge pull request #686 from conductor-oss/dependabot/gradle/io.spring.dependency-management-1.1.7 
Bump io.spring.dependency-management from 1.1.3 to 1.1.7
 2026-02-25 01:51:52 -08:00
Viren Baraiya 0c723f7aa4 Support Agentic flows (#745) 
🤖 Support for agentic workflows in Conductor
 2026-02-03 08:42:22 -08:00
Viren Baraiya 99ecc5f126 sweeper fixes and sync execution 2025-12-28 23:24:52 -08:00
dependabot[bot] 54999e92dc Bump io.spring.dependency-management from 1.1.3 to 1.1.7 
Bumps io.spring.dependency-management from 1.1.3 to 1.1.7.

---
updated-dependencies:
- dependency-name: io.spring.dependency-management
  dependency-version: 1.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-08 12:10:02 +00:00
Bradley 87ce38ed56 Update tomcat to 10.1.45 
Addressing: 
- https://nvd.nist.gov/vuln/detail/CVE-2025-55754
- https://nvd.nist.gov/vuln/detail/CVE-2025-55752
 2025-12-02 11:22:22 -08:00
Viren Baraiya ba24100035 remove legacy clients 2025-06-12 01:42:12 -07:00
Richard Race fce4a7635c Bump Tomcat version (#519) 2025-06-03 14:06:19 +05:30
Jean-Philippe Belval 5e704e7598 Add OpenSearch integration 2024-12-10 10:56:05 -05:00
Dávid Gracza 46612a7a92 Updated Spring Boot to version 3.3.5 (#297) 
* Updated Spring Boot to version 3.3.5

- removed unnecessary restriction from `tomcat-embed-core`

* Fix grpc end-of-stream mid-frame error by updating to grpc and protobuf

- grpc 1.66.0
- protobuf 3.25.5

based on: https://github.com/camunda-community-hub/spring-zeebe/issues/862
 2024-11-12 00:25:33 +04:00
Viren Baraiya 02c7499c7f upgrade flyway 2024-07-13 01:54:25 -07:00
Viren Baraiya 1e0bf01424 more fixes 2024-07-06 11:26:33 -07:00
Viren Baraiya 600ba09796 vulnerability fixes 2024-07-05 21:50:50 -07:00
Viren Baraiya 7198ed26e2 update from Orkes 2024-06-30 13:44:25 -07:00
dependabot[bot] 50bb82ced7 Bump com.diffplug.spotless from 5.0.0 to 6.25.0 
Bumps com.diffplug.spotless from 5.0.0 to 6.25.0.

---
updated-dependencies:
- dependency-name: com.diffplug.spotless
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-27 13:01:07 +00:00
HOA PHAN abf29a0848 upgrade from gradle 7.6.2 to gradle 8.5 (#28) 2024-01-31 10:55:54 -08:00
Dennis Caldwell ac00735d42 Fix CVEs in 3.16. (#46) 
* Upgraded ES7 to 7.17.16, alpine to 3.19

* Update ElasticSearch to 7.17.16, some sdk tests are failing.

* Server would not run, StackOverflow - 54742540 had this handy fix.

* Use the new image in test container.

* Update Spring Boot to 3.2.1. One failing test in end to end.

* Handle the change in exceptions from Spring Framework.

* Update AWS SDK for CVE fix.

* Replace generic import with specific class.

* Removed dependencies.lock file from projects. No longer used.
 2024-01-30 14:56:51 -08:00
Viren Baraiya a8f1260105 deployment preparation 2024-01-05 14:13:30 -08:00
c4lm 5c06b37ad1 more cleanup 2023-12-22 22:24:59 +04:00
LuisLainez 064b0a6292 Issue/upgrade to spring (#3828) 
SB3 upgrades
 2023-10-31 09:08:06 -07:00
Jamie DeMichele d16453149f Remove log4j constraints for downstream users of client and common (#3791) 2023-09-29 16:35:27 -07:00
Alex May 5d40a20be7 Update to Java 17 2023-07-20 14:41:42 -06:00
Viren Baraiya 5bdb4ac855 use spring events to initialize workers and added tests 
1. Add annotation support for pollingInterval
2. Allow configuration using spring
3. Tests
 2023-02-19 21:26:33 -08:00
Jamie DeMichele b88c27d6e0 Allow for an upgrade of log4j2 versions by loosening constraint (#3321) 
* Allow for an upgrade of log4j2 versions

* Update lock
 2023-01-26 13:43:02 -08:00
Aravindan Ramkumar 0787f8477a authorization for StartWorkflowOperation 2022-10-13 13:55:41 -07:00
dependabot[bot] b61cab5f1f Bump spring-boot-gradle-plugin from 2.7.2 to 2.7.3 (#3193) 
Bumps [spring-boot-gradle-plugin](https://github.com/spring-projects/spring-boot) from 2.7.2 to 2.7.3.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](https://github.com/spring-projects/spring-boot/compare/v2.7.2...v2.7.3)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-gradle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-08-22 14:58:17 -07:00
dependabot[bot] c1695c3d1e Bump io.spring.dependency-management (#3177) 
Bumps io.spring.dependency-management from 1.0.12.RELEASE to 1.0.13.RELEASE.

---
updated-dependencies:
- dependency-name: io.spring.dependency-management
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-08-15 22:50:18 -07:00
dependabot[bot] cae0d88210 Bump org.sonarqube from 3.3 to 3.4.0.2513 (#3045) 
Bumps org.sonarqube from 3.3 to 3.4.0.2513.

---
updated-dependencies:
- dependency-name: org.sonarqube
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-08-01 14:39:00 -07:00
dependabot[bot] f171f62976 Bump spring-boot-gradle-plugin from 2.6.7 to 2.7.2 (#3129) 
Bumps [spring-boot-gradle-plugin](https://github.com/spring-projects/spring-boot) from 2.6.7 to 2.7.2.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](https://github.com/spring-projects/spring-boot/compare/v2.6.7...v2.7.2)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-gradle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-07-25 14:11:37 -07:00
dependabot[bot] 3079f02eed Bump io.spring.dependency-management (#3077) 
Bumps io.spring.dependency-management from 1.0.11.RELEASE to 1.0.12.RELEASE.

---
updated-dependencies:
- dependency-name: io.spring.dependency-management
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-06-30 21:42:16 -07:00
Aravindan Ramkumar fe135aa4c5 added junit-vintage-engine and dependency updates 2022-06-30 16:22:54 -07:00
Aravindan Ramkumar f82caba4a5 Introducing RequestHandler which encapsulates all HTTP operations. The JerseyRequestHandler is an implementation that uses the Jersey client. 2022-06-01 17:17:21 -07:00
Aravindan Ramkumar a08510db39 dependecy lock update for SB 2.6.7 2022-05-18 09:07:38 -07:00
dependabot[bot] 6d4db1a067 Bump spring-boot-gradle-plugin from 2.3.12.RELEASE to 2.6.7 
Bumps [spring-boot-gradle-plugin](https://github.com/spring-projects/spring-boot) from 2.3.12.RELEASE to 2.6.7.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](https://github.com/spring-projects/spring-boot/compare/v2.3.12.RELEASE...v2.6.7)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-gradle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-05-18 09:07:38 -07:00
Aravindan Ramkumar 4f6afcf6d5 add dependencies for jersey to support springboot version upgrade 2022-05-16 15:59:23 -07:00
Aravindan Ramkumar d0add13ec5 merge main 2022-05-16 15:38:16 -07:00
Anoop Panicker bc68c9c5b4 move contributed modules into community repo 2022-04-28 15:34:15 -07:00
Anoop Panicker e739c34a81 remove guava from common module;handle exceptions in sweeper 2022-04-26 15:03:20 -07:00