From e134a93dcaa98f63ecc40ba60eedc42808cef77c Mon Sep 17 00:00:00 2001 From: Matej Nesuta Date: Tue, 14 Jul 2026 23:13:55 +0200 Subject: [PATCH 1/3] chore: add callback URL for swagger-ui --- docs/book/modules/admin/examples/trustify/sso.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/book/modules/admin/examples/trustify/sso.tf b/docs/book/modules/admin/examples/trustify/sso.tf index d38a4fb95..b469f71c8 100644 --- a/docs/book/modules/admin/examples/trustify/sso.tf +++ b/docs/book/modules/admin/examples/trustify/sso.tf @@ -113,6 +113,7 @@ resource "aws_cognito_user_pool_client" "frontend" { var.console-url, "${var.console-url}/", "${var.console-url}/openapi/oauth-receiver.html", + "${var.console-url}/swagger-ui/oauth2-redirect.html", ] logout_urls = [ "${var.console-url}/", From 93b986f6b78ceb326ed67b4475dbdb7f1b7977b1 Mon Sep 17 00:00:00 2001 From: rh-jfuller Date: Tue, 14 Jul 2026 18:09:16 +0200 Subject: [PATCH 2/3] fix(deps): bump js-yaml to ^4.3.0 to fix merge-key DoS js-yaml 4.1.1 is vulnerable to algorithmic complexity denial of service via crafted YAML merge keys (<<). Repeating the same alias in a merge sequence causes O(K*M) work in mergeMappings() while input size is O(K+M), blocking the event loop with payloads as small as tens of KB. Fixed upstream in 4.2.0 (merge deduplication) and hardened in 4.3.0 (maxTotalMergeKeys limit backport). Assisted-by: Claude Code --- .github/scripts/map-users/package-lock.json | 18 ++++++++++++++---- .github/scripts/map-users/package.json | 2 +- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/scripts/map-users/package-lock.json b/.github/scripts/map-users/package-lock.json index 1329d3c38..295ed833d 100644 --- a/.github/scripts/map-users/package-lock.json +++ b/.github/scripts/map-users/package-lock.json @@ -5,7 +5,7 @@ "packages": { "": { "dependencies": { - "js-yaml": "^4.1.1" + "js-yaml": "^4.3.0" } }, "node_modules/argparse": { @@ -14,9 +14,19 @@ "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" diff --git a/.github/scripts/map-users/package.json b/.github/scripts/map-users/package.json index 54f917cbc..2c26c1b80 100644 --- a/.github/scripts/map-users/package.json +++ b/.github/scripts/map-users/package.json @@ -6,6 +6,6 @@ "main": "main.mjs", "private": true, "dependencies": { - "js-yaml": "^4.1.1" + "js-yaml": "^4.3.0" } } \ No newline at end of file From 23a72ec4d17bd68abf1128d51784deb13e769239 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Sedl=C3=A1k?= Date: Thu, 9 Jul 2026 00:46:14 +0200 Subject: [PATCH 3/3] docs(terraform): use variable for DB version and instance class Availability of RDS PostgreSQL engine version and instance class selections depends on the AWS Region. Exposing these (engine version and instance class) as variables, makes it easier to tweak the values for user selected region. --- .../modules/admin/examples/trustify/database.tf | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/docs/book/modules/admin/examples/trustify/database.tf b/docs/book/modules/admin/examples/trustify/database.tf index d49eb4a00..2f3d38c37 100644 --- a/docs/book/modules/admin/examples/trustify/database.tf +++ b/docs/book/modules/admin/examples/trustify/database.tf @@ -50,6 +50,18 @@ variable "db-user" { description = "Username of the trustify user of the database" } +variable "db-engine-version" { + type = string + default = "17.2" + description = "PostgreSQL version" +} + +variable "db-instance-class" { + type = string + default = "db.m7g.large" + description = "RDS Instance class (defines cpu/mem/network resources available)" +} + locals { # name of the database: # > * Must contain 1 to 63 letters, numbers, or underscores. @@ -117,8 +129,8 @@ resource "aws_db_instance" "trustify" { db_name = "postgres" engine = "postgres" - engine_version = "17.2" - instance_class = "db.m7g.large" + engine_version = var.db-engine-version + instance_class = var.db-instance-class username = var.db-master-user password = random_password.trustify-db-admin-password.result ca_cert_identifier = "rds-ca-rsa4096-g1"