Repository navigation
October release candidate (DO NOT MERGE) - #1228
Draft
ChristianPavilonis wants to merge 524 commits into
Draft
ChristianPavilonis wants to merge 524 commits into
ChristianPavilonis wants to merge 524 commits into
Conversation
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Correct the upgrade checklist: on Fastly the CLI rejects any config key other than the logical store ID, so a leftover `__KEY` selector makes `ts config push` and `ts deploy` fail rather than writing to a key the runtime ignores. My earlier note had this backwards. Add the selector-migration steps the checklist was missing. Service-scoped `EDGEZERO__SERVICES__<SERVICE_ID>__STORES__…__NAME` entries must move to the unscoped variables in the deploy environment, because an unset selector falls back to the logical ID and links whichever account-level store carries that name, possibly another service's. Also call out `trusted_server_kv`, which the managed deploy links even though the Fastly runtime never opens it. Name `EDGEZERO_MANIFEST` in the managed-deploy step, matching the CLI and getting-started guides. Replace the stale "Fastly Runtime Config Store" section in the configuration guide. It still described the removed `edgezero_runtime_env` selector model, `fastly compute publish`, and `--key` overrides. Its local development paragraph also claimed `--local` writes under the resolved `__NAME`; it writes under the logical ID. Update the matching doc comments in settings_data.rs. Read the sandbox reuse bounds from the application's own config store under its logical ID. They previously came from `edgezero_runtime_env`, which is deprecated and which this branch's pin no longer exposes a constant for. The service-scoped key prefix goes with it, since it only existed to namespace entries inside that shared store.
The skill's guardrails told operators to always pass `--service-id` to `fastly compute publish`. That command now strands a service: it clones the active version's resource links, so the new version lacks the logical links the runtime opens, app config fails to load, and every publisher route returns 500 while `/health` still answers 200. Point the guardrail at the managed deploy instead, and keep the `--service-id` advice for whichever deploy command is used, since a checked-in `fastly.toml` can still pin a dead service.
Fastly main skips client-IP sanitization when the native request path is a trace path, and the router hook later classifies the converted URI. Add a regression test that runs encoded, dot-segment, doubled-slash, case and lookalike paths through both and asserts they agree, so a future conversion change cannot route unsanitized forwarded headers into ordinary dispatch. Drop the repeated activation value from the bounded-lifetime test; only 1 and true activate diagnostics.
Adopt the reusable-sandbox Fastly entry point from main (#1179). Trace ingress and trace-path classification are captured first in each handle_request call, before the health shortcut and any native mutation, and are passed into edgezero_main. Trace terminal responses are sent without sandbox counters so their hardened headers stay exact. Pin EdgeZero to 965d482f, the pre-dispatch fidelity branch merged with EdgeZero main, so the reusable application lifecycles and the ingress hook are both available. Re-resolve only the EdgeZero lock entries from main's lockfile. Keep both the trace regression and reusable-sandbox CI steps.
Preserve upstream cache policy for rewritten JavaScript outside likely static bundle paths. Log encoded-response bypasses at warning level only when identity encoding was requested. Repair eligibility coverage, add a path-aware cache regression, and clarify assertion messages, collection diagnostics, and cache docs.
| default: | ||
| return unhandledCase(cycle.delivery); | ||
| return unhandledCase(cycle.delivery) ?? 'Delivery evidence: Not observed'; |
| const items = traceItems(item, maximumArrayItems); | ||
| if (!items || !add('[')) okay = false; | ||
| else { | ||
| for (let index = 0; index < items.length && okay; index += 1) { |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| for pattern in &self.exclude_domains { | ||
| if let Err(reason) = Self::check_exclude_domain(pattern) { | ||
| log::warn!( | ||
| "rewrite.exclude_domains: entry `{pattern}` never matches a URL host ({reason})" |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release scope
Includes current
mainat2dd968aeebeband every open, non-draft PR either assigned directly to milestone 202610 or declaring a closing link to an issue in that milestone. The audit identifies 19 eligible PRs: 12 assigned directly and 7 linked through milestone issues. Excludes all unmerged work authored byjwrosewell, including his prerequisite stack. None of the 19 eligible PRs is authored by him. A contextual mention alone does not qualify.The table records the exact audited revisions, including the latest main-refresh merges for #1300, #1326, #1405, and #1406. Related issues provide traceability; inclusion does not assert that an entire issue is complete.
bccb1bf4782eb090ed90736cb5aac6dafce0f9a426c5ced270ba72155b3b04b8bc52410e36797df7c16275c04911564146608aa7ffccb147fe30187295e3342c9b54a9fb1b22f342610ac683c5921caedc1d9d5c3b374fc278c15ab7d4994fca43967ffe194c3d448f910c2cf0f7a17ddf63Already merged coverage: 38 PRs through main, plus #1069 carried in the RC
The audit also covers these 39 previously merged PRs. Their merge commits are retained through
main, except #1069, which was merged into the original timing branch and is already in the RC history.ts dev proxyinvocation #1176, CI check over.mdfiles in root folder #1177, Extract GTM container IDs from audit evidence #1220, Propose documentation updates after code merges to main #1225, Raise Chrome launch timeout for audit browser sessions #1256, Give each Rust CI job its own cache and save caches only from main #1259, Require specs for feature PRs #1385, Fix contradictions in contributor docs #1387.Carried work and exclusions
RC compatibility notes
spec/pre-dispatch-request-fidelitybranch from EdgeZero #403.Cargo.lockresolves all EdgeZero packages to52121d95770f. This supplies the ingress metadata and pre-dispatch APIs required by Add mobile ad-rendering trace workflow #1107 while retaining Upgrade to Rust 1.98.1 and align dependencies with EdgeZero #1123’s toolchain and dependency-major updates.Validation
Verified the updated source tree at
755223f54272:mainare ancestors of this RC; no unmergedjwrosewellwork is included. The four main-refresh merges change ancestry only and preserve the tested source tree.GitHub CI will rerun after publication. Known upstream issues are tracked below.
Outstanding upstream requests