chore: roll up security dependency bumps (#525 to #532)

cmd/envbuilder/main.go

@@ -23,7 +23,9 @@ import (
 
 func main() {
 	cmd := envbuilderCmd()
-	err := cmd.Invoke().WithOS().Run()
+	inv := cmd.Invoke().WithOS()
+	inv.Environ = options.EnvironWithoutEmptyValues(os.Environ())
+	err := inv.Run()
 	if err != nil {
 		_, _ = fmt.Fprintf(os.Stderr, "error: %v", err)
 		os.Exit(1)

log/coder.go

@@ -9,8 +9,8 @@ import (
 	"sync"
 	"time"
 
-	"cdr.dev/slog"
-	"cdr.dev/slog/sloggers/sloghuman"
+	"cdr.dev/slog/v3"
+	"cdr.dev/slog/v3/sloggers/sloghuman"
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"

log/coder_internal_test.go

@@ -13,7 +13,7 @@ import (
 	"testing"
 	"time"
 
-	"cdr.dev/slog/sloggers/slogtest"
+	"cdr.dev/slog/v3/sloggers/slogtest"
 	"github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"

options/options.go

@@ -672,6 +672,22 @@ func skipDeprecatedOptions(options []serpent.Option) []serpent.Option {
 	return activeOptions
 }
 
+// EnvironWithoutEmptyValues converts environ into a serpent.Environ for
+// option parsing, dropping variables with empty values. Since serpent v0.15.0, an empty
+// value overrides an option's default instead of being ignored. Envbuilder
+// keeps treating empty values as unset so that existing templates that pass
+// empty strings keep their defaults.
+func EnvironWithoutEmptyValues(environ []string) serpent.Environ {
+	envs := serpent.ParseEnviron(environ, "")
+	filtered := make(serpent.Environ, 0, len(envs))
+	for _, env := range envs {
+		if env.Value != "" {
+			filtered = append(filtered, env)
+		}
+	}
+	return filtered
+}
+
 // UnsetEnv unsets all environment variables that are used
 // to configure the options.
 func UnsetEnv() {
@@ -693,4 +709,9 @@ func UnsetEnv() {
 	// Unset the Kaniko environment variable which we set it in the
 	// Dockerfile to ensure correct behavior during building.
 	_ = os.Unsetenv("KANIKO_DIR")
+
+	// dd-trace-go (imported transitively via codersdk) sets this at init
+	// to propagate a per-process session ID to child processes. It must not
+	// leak into the workspace environment.
+	_ = os.Unsetenv("_DD_ROOT_GO_SESSION_ID")
 }

options/options_test.go

@@ -22,6 +22,12 @@ func TestEnvOptionParsing(t *testing.T) {
 		require.Equal(t, o.SetupScript, val)
 	})
 
+	t.Run("empty string keeps default", func(t *testing.T) {
+		t.Setenv(options.WithEnvPrefix("WORKSPACE_BASE_DIR"), "")
+		o := runCLI()
+		require.Equal(t, "/workspaces", o.WorkspaceBaseDir)
+	})
+
 	t.Run("int", func(t *testing.T) {
 		t.Setenv(options.WithEnvPrefix("CACHE_TTL_DAYS"), "7")
 		o := runCLI()
@@ -229,6 +235,7 @@ func runCLI() options.Options {
 	}
 
 	i := cmd.Invoke().WithOS()
+	i.Environ = options.EnvironWithoutEmptyValues(os.Environ())
 	i.Args = []string{"--help"}
 	fakeIO(i)
 	err := i.Run()