| restatedev/sdk-go |
#161 |
Fix data race between Drain and concurrent Read on the request stream |
✅ Merged |
| element-hq/ess-helm |
#1438 |
Add priorityClassName support to matrix-stack component workloads |
✅ Merged |
| valkey-io/valkey-helm |
#218 |
Add optional priorityClassName to the valkey-operator Deployment |
✅ Merged |
| kubernetes-sigs/kueue |
#12796 |
Fix data race on stickyWorkload between Snapshot and RequeueIfNotPresent |
✅ Merged |
| kubernetes-sigs/kueue |
#12736 |
Fixed a data race on the ClusterQueue sticky workload between the Visibility API snapshot and preemption requeue (self-synchronizing mutex). |
✅ Merged |
| elastic/docs-content |
#7182 |
Documented EKS Pod Identity setup for the S3 snapshot repository |
✅ Merged |
| inference-gateway/cli |
#713 |
Guard Tree tool gitignore cache and screenshot rate-limit against concurrent-map data races |
✅ Merged |
| valkey-io/valkey-helm |
#197 |
Add aggregated admin/editor/viewer ClusterRoles to the valkey-operator chart |
✅ Merged |
| valkey-io/valkey-helm |
#196 |
Add optional Prometheus ServiceMonitor to the valkey-operator chart |
✅ Merged |
| actions-rust-lang/setup-rust-toolchain |
#96 |
Add cache-targets passthrough to rust-cache |
✅ Merged |
| redpanda-data/helm-charts |
#1756 |
kminion chart: add opt-in extraEnvFrom for Secret/ConfigMap env injection (Deployment + DaemonSet) |
✅ Merged |
| valkey-io/valkey-helm |
#195 |
Add optional topologySpreadConstraints to the valkey-operator chart Deployment |
✅ Merged |
| VictoriaMetrics/helm-charts |
#3016 |
Add runtimeClassName option to pod specs across all VictoriaMetrics charts |
✅ Merged |
| woodpecker-ci/helm |
#498 |
Add topologySpreadConstraints to the Woodpecker server (parity with the agent) |
✅ Merged |
| goauthentik/helm |
#483 |
Add server.automountServiceAccountToken to the authentik Helm chart (server-pod parity with the worker setting) |
✅ Merged |
| kubernetes-sigs/headlamp |
#6148 |
Replace the any return type of KubeObject.apiList with a typed value in the Headlamp Kubernetes dashboard frontend |
✅ Merged |
| redpanda-data/helm-charts |
#1754 |
Add opt-in topologySpreadConstraints to the kminion Helm chart (Deployment and DaemonSet) |
✅ Merged |
| kubernetes-sigs/descheduler |
#1885 |
Add an opt-in PodDisruptionBudget to the descheduler Helm chart (Deployment mode) |
✅ Merged |
| longhorn/longhorn |
#13378 |
Add an opt-in PodDisruptionBudget to the Longhorn UI Deployment in the Helm chart |
✅ Merged |
| fluent/fluentd |
#5390 |
Add umask option to the directive |
✅ Merged |
| kudobuilder/kuttl |
#694 |
Fix flaky integration test by randomizing namespace (prevents -count collision) |
✅ Merged |
| vmware-tanzu/helm-charts |
#740 |
Add optional PodDisruptionBudget to the Velero Helm chart |
✅ Merged |
| pypa/pipx |
#1842 |
Add --dry-run flag to pipx ensurepath to preview PATH changes without modifying any shell config |
✅ Merged |
| elastic/elasticsearch |
#151614 |
S3 snapshot repository: EKS Pod Identity credential support |
✅ Merged |
| mindersec/minder |
#6520 |
Resolve OCI artifact created time from the image config instead of the time.Now() fallback (closes #6490) |
✅ Merged |
| external-secrets/external-secrets |
#6481 |
Scoped External Secrets Operator cert-controller ClusterRole to least-privilege (resourceNames-pinned write access) in the Helm chart |
✅ Merged |
| opentofu/setup-opentofu |
#121 |
Verify the downloaded OpenTofu CLI against the release's published SHA256SUMS by default (closes #117) |
✅ Merged |
| open-telemetry/opentelemetry-helm-charts |
#2258 |
Honor schedulerName in daemonset and statefulset collector modes |
✅ Merged |
| vectordotdev/vector |
#25607 |
host_metrics temperature collector (sysinfo Components) |
✅ Merged |
| jaegertracing/helm-charts |
#761 |
Restore extraVolumes/extraVolumeMounts on the all-in-one deployment |
✅ Merged |
| nginx/nginx-gateway-fabric |
#5392 |
Add GEP-713 Programmed status condition to custom policies |
✅ Merged |
| yannh/kubeconform |
#356 |
Avoid SIGSEGV panic on null-decoding schema |
✅ Merged |
| meshery/meshery |
#19835 |
Fix typos, function names & license header |
✅ Merged |
| kubernetes-sigs/kubespray |
#13370 |
cilium: wire the scrape port variables into the Helm values template so they stop being no-ops |
🔵 Review |
| carvel-dev/kapp-controller |
#1844 |
Fix concurrent map iteration/write panic in AppRefTracker under high reconciliation concurrency |
🔵 Review |
| prometheus-community/helm-charts |
#7108 |
prometheus-adapter chart: add optional schedulerName and runtimeClassName to the Deployment |
🔵 Review |
| rancher/dynamiclistener |
#315 |
Guard the queuedSecret field with a mutex to fix a data race in the Kubernetes storage controller |
🔵 Review |
| kubernetes-sigs/kubebuilder |
#5864 |
Authenticate pinact with GITHUB_TOKEN in the workflow-lint CI job to avoid GitHub API rate limits (#5817) |
🔵 Review |
| anchore/scan-action |
#726 |
Add glob pattern support to the scan-action sbom input (expands to exactly one SBOM file) |
🔵 Review |
| open-telemetry/opentelemetry-helm-charts |
#2299 |
Add opt-in crds.annotations to the opentelemetry-operator chart so CRDs can carry helm.sh/resource-policy: keep and survive helm uninstall |
🔵 Review |
| temporalio/helm-charts |
#949 |
Add schedulerName/runtimeClassName/priorityClassName to Temporal server/web/admintools pods |
🔵 Review |
| terraform-google-modules/terraform-google-composer |
#203 |
Fixed cloud_data_lineage_integration=false being a no-op (nullable var so it can be explicitly disabled) |
🔵 Review |
| terraform-google-modules/terraform-google-kubernetes-engine |
#2617 |
Fixed add_shadow_firewall_rules requiring add_cluster_firewall_rules (null cluster_subnet_cidr plan error) |
🔵 Review |
| element-hq/ess-helm |
#1442 |
Add affinity support to component workloads |
🔵 Review |
| stakater/Reloader |
#1181 |
Add runtimeClassName and schedulerName support to the Reloader Helm chart deployment |
🔵 Review |
| kubeshark/kubeshark |
#1949 |
Opt-in Prometheus Operator ServiceMonitor for the Helm chart's metrics services |
🔵 Review |
| open-telemetry/opentelemetry-go-contrib |
#9238 |
Fix otelslog dropping error attributes nested inside a slog.Group |
🔵 Review |
| apache/gravitino |
#11917 |
Add opt-in topologySpreadConstraints support to Gravitino/Iceberg-REST/Lance-REST Helm charts |
🔵 Review |
| open-feature/go-sdk |
#522 |
Guard memprovider Resolve against a non-nil pointer to a nil ContextEvaluator func (panic fix) |
🔵 Review |
| kubernetes-sigs/descheduler |
#1892 |
Added opt-in hostUsers (user-namespace sharing) to the descheduler Helm chart |
🔵 Review |
| terraform-docs/terraform-docs |
#947 |
Render explicit null variable defaults as null (not "") in tfvars hcl output |
🔵 Review |
| terraform-aws-modules/terraform-aws-dynamodb-table |
#123 |
Add opt-in standalone GSI management (aws_dynamodb_global_secondary_index) for independent index lifecycle |
🔵 Review |
| terraform-aws-modules/terraform-aws-fsx |
#11 |
FSx OpenZFS: add read_cache_configuration for INTELLIGENT_TIERING storage |
🔵 Review |
| kubernetes-sigs/kueue |
#12797 |
Fix non-transitive ClusterQueue sort when the sticky workload changes mid-sort |
🔵 Review |
| argoproj/argo-cd |
#28584 |
Add skip schema validation toggle to Application parameters editor (#5111) |
🔵 Review |
| open-telemetry/opentelemetry-go-contrib |
#9229 |
Fix otelslog data race corrupting log attributes via shared kvBuffer (closes #9046) |
🔵 Review |
| supabase-community/supabase-kubernetes |
#214 |
Add configurable Prometheus ServiceMonitor support to the Supabase Helm chart |
🔵 Review |
| ory/k8s |
#888 |
Completed the PodDisruptionBudget namespace fix across the remaining Ory Helm charts (kratos, hydra-maester, oathkeeper-maester) |
🔵 Review |
| terraform-aws-modules/terraform-aws-lambda |
#762 |
Clarify lambda_role is ignored when create_role is true (docs) |
🔵 Review |
| terraform-aws-modules/terraform-aws-security-group |
#361 |
Document ICMP -1 semantics (type/code) for from_port/to_port in module README |
🔵 Review |
| terraform-aws-modules/terraform-aws-app-runner |
#20 |
Fix AWS provider v6 deprecation warning by using aws_partition.partition instead of the deprecated .id attribute |
🔵 Review |
| valkey-io/valkey-helm |
#217 |
Add configurable health probes (startup/liveness/readiness) to the Valkey chart |
🔵 Review |
| guerzon/vaultwarden |
#234 |
Add opt-in topologySpreadConstraints to the vaultwarden Helm chart pod spec |
🔵 Review |
| kyverno/kyverno |
#16428 |
Add opt-in schedulerName and runtimeClassName to the Kyverno controller Helm chart |
🔵 Review |
| kubernetes-sigs/descheduler |
#1890 |
Add opt-in schedulerName and runtimeClassName to the descheduler Helm chart |
🔵 Review |
| fyrash/fyra-cli |
#1 |
Warn when secret files are excluded from the push |
🔵 Review |
| terraform-aws-modules/terraform-aws-lambda |
#761 |
Add region variable to alias submodule for AWS provider v6 resource-level region |
🔵 Review |
| istio/istio |
#60723 |
Add terminationGracePeriodSeconds option to the istiod Helm chart |
🔵 Review |
| terraform-aws-modules/terraform-aws-eventbridge |
#203 |
Gate the EventBridge log delivery source on configured log delivery (fixes orphan aws_cloudwatch_log_delivery_source); fixes #201 |
🔵 Review |
| terraform-aws-modules/terraform-aws-eks |
#3729 |
Ignore server-side desired_capacity_type drift on self-managed node group ASG (fixes apply failure) |
🔵 Review |
| terraform-google-modules/terraform-google-bastion-host |
#246 |
Add allow_stopping_for_update variable to the GCP bastion host VM |
🔵 Review |
| terraform-aws-modules/terraform-aws-msk-kafka-cluster |
#69 |
Restore broker log delivery for MSK Express brokers |
🔵 Review |
| terraform-aws-modules/terraform-aws-secrets-manager |
#26 |
Persist a custom staging label so external secret updates don't orphan the Terraform-tracked version (fixes ignore_secret_changes data-loss); fixes #24 |
🔵 Review |
| terraform-aws-modules/terraform-aws-eks |
#3726 |
Fix the FAQ example so case 2 sets attach_cluster_primary_security_group = false (the two opposite remedies previously showed the same example); fixes #3724 |
🔵 Review |
| terraform-aws-modules/terraform-aws-iam |
#651 |
Add opt-in ebs_csi_volume_tagging variable so the EBS CSI driver can tag existing volumes (enables VolumeAttributesClass); fixes #649 |
🔵 Review |
| terraform-aws-modules/terraform-aws-elasticache |
#74 |
Lowercase the default ElastiCache user engine fallback to silence the AWS provider case-insensitive deprecation warning |
🔵 Review |
| argoproj/argo-cd |
#28406 |
Persist Applications search bar text across navigation (view preferences) |
🔵 Review |
| metallb/metallb |
#3079 |
Avoid stale resourceVersion churn in ServiceL2Status and ServiceBGPStatus reconcile (#3063) |
🔵 Review |
| kubereboot/charts |
#141 |
Add opt-in topologySpreadConstraints to the kured chart DaemonSet |
🔵 Review |
| argoproj/argo-helm |
#3943 |
Add envFrom to the argo-workflows controller and argo-server containers |
🔵 Review |
| robinraju/release-downloader |
#952 |
Fix path traversal (CWE-22) when saving release assets |
🔵 Review |
| kedacore/charts |
#882 |
Per-component Deployment labels/annotations for KEDA pods |
🔵 Review |
| kedacore/charts |
#881 |
Make the KEDA operator gRPC metrics service port configurable (#511) |
🔵 Review |
| anchore/grype |
#3519 |
Add vulnerable version ranges to the CycloneDX output format (closes #3512) |
🔵 Review |
| amacneil/dbmate |
#803 |
Add --wait-interval flag and DBMATE_WAIT_INTERVAL env var to configure the delay between connection attempts for --wait |
🔵 Review |
| metallb/metallb |
#3076 |
Remove deprecated metallb.universe.tf managed annotation lingering on Services after upgrade |
🔵 Review |
| ray-project/kuberay |
#4934 |
Add optional PodDisruptionBudget to the ray-cluster Helm chart |
🔵 Review |
| vapor/vapor |
#3475 |
Add typed Retry-After HTTP header accessor |
🔵 Review |
| kedacore/charts |
#880 |
Add an opt-in hostUsers field to the KEDA operator, metrics server and webhooks pods (user namespaces) |
🔵 Review |
| stern/stern |
#373 |
Support nested-field extraction via dot notation in extractJSONParts/tryExtractJSONParts template funcs (closes #343) |
🔵 Review |
| jenkins-infra/helm-charts |
#1972 |
Add an opt-in PodDisruptionBudget to the httpd Helm chart |
🔵 Review |
| open-telemetry/opentelemetry-collector-contrib |
#49146 |
Add opt-in TLS support to the memcached receiver |
🔵 Review |
| open-policy-agent/conftest |
#1355 |
Add --github-hide-passed flag to skip passing files in the GitHub outputter (closes #1315) |
🔵 Review |
| open-policy-agent/conftest |
#1354 |
Add per-test names to successful test cases in conftest verify --output junit output |
🔵 Review |
| openobserve/openobserve-helm-chart |
#222 |
Add opt-in Prometheus Operator ServiceMonitor to the OpenObserve standalone Helm chart |
🔵 Review |
| dragonflydb/dragonfly-operator |
#550 |
Add optional PodDisruptionBudget to the operator Helm chart |
🔵 Review |
| tj-actions/changed-files |
#2884 |
Hardened README to recommend injection-safe consumption of the changed-files list (JSON + bash array + -- separator). |
🔵 Review |
| grafana/cloudcost-exporter |
#1051 |
Opt-in leader election so multi-replica deployments make a single set of cloud provider API calls |
🔵 Review |
| dexidp/dex |
#4831 |
Add EdDSA (Ed25519) signing algorithm support to the local token signer |
🔵 Review |
| hashicorp/setup-terraform |
#561 |
Verify the downloaded Terraform CLI against HashiCorp's signed SHA256SUMS before install (closes #556) |
🔵 Review |
| hashicorp/terraform-provider-kubernetes |
#2905 |
Add env_from_map provider-defined function |
🔵 Review |
| FairwindsOps/polaris |
#1201 |
Add SARIF output format to audit CLI |
🔵 Review |
| helm/chart-testing-action |
#210 |
Report a clear error when blob verification fails |
🔵 Review |
| helm/chart-testing |
#841 |
Honor --release-name instead of generating one |
🔵 Review |
| percona/percona-helm-charts |
#862 |
pmm gRPC ClusterIP nodePort fix |
🔵 Review |
| meshery/meshery |
#19866 |
Fix export flag validation + tests |
🔵 Review |
| dependabot/dependabot-core |
#15199 |
Identify Dependabot commits by author name |
🔵 Review |
| aquasecurity/trivy |
#10770 |
Add --color flag for table output |
🔵 Review |
