[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mariadb (source)	service	major	10.11 → 13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d4a57841-d3f9-4a2c-bbbd-689d4f7ff1d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale comment

Security review (automation)

Scope: Added/modified lines in this PR only.

Change: Bumps the GitHub Actions services.mariadb image from mariadb:10.11 to mariadb:13.0 in .github/workflows/dev.yml (two jobs).

Assessment: No medium, high, or critical vulnerabilities identified in this diff.

• No application code, API, or auth logic changes; no new attacker-controlled input paths.
• The MariaDB container is an ephemeral CI test dependency; the version tag change does not alter Semaphore’s runtime attack surface for deployed instances.
• CI database credentials and port mapping on the service block are unchanged (pre-existing test fixtures, not introduced here).

Prior threads: None from earlier automation runs on this PR.

Recommendation: Merge from a security perspective is fine; validate CI green for MariaDB 13 compatibility separately if needed.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review (automation)

Scope: Added/modified lines in this PR only (83bddaf…59fc72f).

Change: Bumps GitHub Actions services.mariadb from mariadb:10.11 to mariadb:13.0 in .github/workflows/dev.yml (migrate-mariadb and integrate-mariadb jobs).

Assessment: No medium, high, or critical vulnerabilities identified in this diff.

• No application, API, auth, or deserialization changes; no new attacker-controlled sinks.
• MariaDB runs only as an ephemeral CI service container; the tag bump does not change Semaphore’s production/runtime attack surface.
• Image reference remains the official mariadb Docker Hub tag (Renovate-managed); no untrusted registry or digest substitution in this PR.
• CI test credentials and 3306:3306 mapping are unchanged from the base branch (pre-existing fixtures, out of scope for this review).

Prior threads: Re-validated the earlier automation assessment on the updated head; no inline findings were filed previously and no open review threads remain.

Recommendation: Acceptable from a security perspective; confirm CI passes for MariaDB 13 compatibility separately.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Scope: Added/modified lines only (mariadb:10.11 → mariadb:13.0 in .github/workflows/dev.yml for the migrate-mariadb and integrate-mariadb jobs).

Prior threads: None from earlier automation runs on this PR.

Findings: No medium, high, or critical vulnerabilities identified in this diff.

The change affects GitHub Actions service containers used for CI migration/integration tests, not Semaphore runtime images or application code. I did not find attacker-controlled input reaching a new sink, authz changes, or secret exposure introduced by this PR. Hardcoded CI test DB credentials on adjacent lines are unchanged and pre-existing.

Supply chain: Pinning mariadb:13.0 is a routine Renovate bump; without evidence of a exploitable CI-only compromise path against the product, this does not meet the bar for a reportable finding.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Scope: Added/modified lines only (mariadb:10.11 → mariadb:13.0 in .github/workflows/dev.yml for the migrate-mariadb and integrate-mariadb jobs).

Assessment: No medium, high, or critical vulnerabilities identified in this change.

The diff only updates the GitHub Actions service container image used for CI database migration and integration tests. Application code, authentication, network exposure, and CI credentials are unchanged from the prior 10.11 configuration. The mariadb:13.0 tag points to the official Docker Library image (MariaDB Community Server 13.0.x); this is a routine dependency refresh, not a new attacker-controlled input path or production deployment surface.

Prior threads: No open inline finding threads from earlier automation runs; nothing to re-report.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review (automation)

Scope: Added/modified lines in this PR only (0f07f81…7e8e9867).

Change: Bumps GitHub Actions services.mariadb from mariadb:10.11 to mariadb:13.0 in .github/workflows/dev.yml (migrate-mariadb and integrate-mariadb jobs).

Assessment: No medium, high, or critical vulnerabilities identified in this diff.

• No application code, API handlers, authn/authz, or deserialization paths are touched; there is no new attacker-controlled input reaching a sink.
• The MariaDB container is an ephemeral GitHub Actions service used only for CI migrations/integration tests. Changing the image tag does not change Semaphore’s production/runtime attack surface.
• Database credentials, port exposure, and health-check options on these jobs are unchanged from the prior workflow (pre-existing CI fixtures, not introduced here).
• Supply-chain risk from pulling a newer official mariadb image is inherent to any image bump; this diff does not pin to an untrusted registry, alter pull secrets, or disable integrity controls beyond what already existed for mariadb:10.11.

Prior threads: Re-validated earlier automation assessments on synchronize; no open finding threads remain applicable.

Recommendation: No security blockers from this review; continue with functional/CI validation for MariaDB 13 compatibility as needed.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review (automation)

Scope: Added/modified lines only (c170fce…ac17249).

Change: Bumps GitHub Actions services.mariadb from mariadb:10.11 to mariadb:13.0 in .github/workflows/dev.yml (migrate-mariadb and integrate-mariadb jobs).

Assessment: No medium, high, or critical vulnerabilities identified in this diff.

• No application code, API handlers, authn/authz, or deserialization paths are touched; there is no new attacker-controlled input reaching a sink.
• MariaDB runs only as an ephemeral GitHub Actions service container for CI migration/integration tests. The image tag change does not alter Semaphore’s production or runtime attack surface.
• CI database credentials, 3306:3306 port mapping, and health-check options are unchanged from the prior workflow (pre-existing fixtures, out of scope for this review).
• Supply-chain exposure is limited to pulling a newer official Docker Library mariadb tag (Renovate-managed), consistent with the existing mariadb:10.11 pattern; no untrusted registry or new pull-secret handling in this PR.

Prior threads: Re-validated earlier automation assessments on synchronize; no open inline finding threads and no findings to re-report.

Recommendation: No security blockers; continue with functional/CI validation for MariaDB 13 compatibility as needed.

  

_{Sent by Cursor Automation: Find vulnerabilities}