chore: resolve open dependabot security alerts by jonathannorris · Pull Request #394 · open-feature/python-sdk-contrib · GitHub
Skip to content

chore: resolve open dependabot security alerts - #394

Merged
toddbaert merged 1 commit into
mainfrom
chore/dependabot-alerts
Jun 1, 2026
Merged

toddbaert merged 1 commit into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

Copy link
Copy Markdown
Member

Summary

  • Bumped idna 3.13 -> 3.16 via uv lock --upgrade-package idna to resolve a medium-severity transitive vulnerability

Dependabot Alerts Resolved

Alert Package Severity Fix
#33 idna medium Specially crafted inputs to idna.encode() can bypass the CVE-2024-3651 fix; bumped to 3.16 in uv.lock

idna is a transitive dependency. The upgrade is a single-package bump in uv.lock with no manifest changes required.

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris
jonathannorris requested review from a team as code owners May 25, 2026 14:09
@jonathannorris
jonathannorris marked this pull request as draft May 25, 2026 14:09
@codecov

codecov Bot commented May 25, 2026 •

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the idna package version from 3.13 to 3.16 in the uv.lock file. I have no feedback to provide.

@jonathannorris
jonathannorris marked this pull request as ready for review June 1, 2026 14:06
@toddbaert
toddbaert merged commit c4b4257 into main Jun 1, 2026
59 checks passed
@toddbaert
toddbaert deleted the chore/dependabot-alerts branch June 1, 2026 18:47
aepfli added a commit that referenced this pull request Sep 12, 2026
Adds the policy item 8 settled: a containerised adoption suite is excluded
from the default build and a maintainer runs it by hand before merge. Written
down because an exclusion nobody wrote down is indistinguishable from an
oversight, which is exactly how this went unnoticed. Two reasons, and the
second decides it: Docker, and the fact that a conformance suite's honest
output includes failures that are not the provider's -- a canonical flag the
backend does not seed yet -- so a gate that must be green cannot hold it and an
xfail would blame the provider for the backend.

The corrections:

  - control_api is documented as required, closed and stated rather than
    guessed, in both the control section and the no-backend one;
  - the compose table's configuration row is backend_configuration;
  - there is no /restart binding, and the reason, replacing a bullet that
    presented the endpoint as part of the contract every backend owes;
  - the settle paragraph no longer claims flagd-testbed#394 closed the window.
    It did not -- #394 is open and unmerged, the launchpad still returns from
    /start as soon as /readyz answers, and the ~40 ms window is real and
    measured. The reason not to sleep is that control-api.yaml now requires
    every state-changing endpoint to serve before it returns, and that a fixed
    delay is un-tunable and hides the defect from the one consumer positioned
    to notice it. Where an adopter is stuck with such a backend the wait
    belongs in that adoption, named and citing the defect -- which is what the
    OFREP adoption's SettledControl is, and what Appendix F now prescribes.

The self-test tally was also stale: 190, not 163.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 15, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 15, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Sep 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 1, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 1, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 2, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 2, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 5, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 8, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 8, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 9, 2026
Adds the policy item 8 settled: a containerised adoption suite is excluded
from the default build and a maintainer runs it by hand before merge. Written
down because an exclusion nobody wrote down is indistinguishable from an
oversight, which is exactly how this went unnoticed. Two reasons, and the
second decides it: Docker, and the fact that a conformance suite's honest
output includes failures that are not the provider's -- a canonical flag the
backend does not seed yet -- so a gate that must be green cannot hold it and an
xfail would blame the provider for the backend.

The corrections:

  - control_api is documented as required, closed and stated rather than
    guessed, in both the control section and the no-backend one;
  - the compose table's configuration row is backend_configuration;
  - there is no /restart binding, and the reason, replacing a bullet that
    presented the endpoint as part of the contract every backend owes;
  - the settle paragraph no longer claims flagd-testbed#394 closed the window.
    It did not -- #394 is open and unmerged, the launchpad still returns from
    /start as soon as /readyz answers, and the ~40 ms window is real and
    measured. The reason not to sleep is that control-api.yaml now requires
    every state-changing endpoint to serve before it returns, and that a fixed
    delay is un-tunable and hides the defect from the one consumer positioned
    to notice it. Where an adopter is stuck with such a backend the wait
    belongs in that adoption, named and citing the defect -- which is what the
    OFREP adoption's SettledControl is, and what Appendix F now prescribes.

The self-test tally was also stale: 190, not 163.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 9, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 9, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 14, 2026
Adds the policy item 8 settled: a containerised adoption suite is excluded
from the default build and a maintainer runs it by hand before merge. Written
down because an exclusion nobody wrote down is indistinguishable from an
oversight, which is exactly how this went unnoticed. Two reasons, and the
second decides it: Docker, and the fact that a conformance suite's honest
output includes failures that are not the provider's -- a canonical flag the
backend does not seed yet -- so a gate that must be green cannot hold it and an
xfail would blame the provider for the backend.

The corrections:

  - control_api is documented as required, closed and stated rather than
    guessed, in both the control section and the no-backend one;
  - the compose table's configuration row is backend_configuration;
  - there is no /restart binding, and the reason, replacing a bullet that
    presented the endpoint as part of the contract every backend owes;
  - the settle paragraph no longer claims flagd-testbed#394 closed the window.
    It did not -- #394 is open and unmerged, the launchpad still returns from
    /start as soon as /readyz answers, and the ~40 ms window is real and
    measured. The reason not to sleep is that control-api.yaml now requires
    every state-changing endpoint to serve before it returns, and that a fixed
    delay is un-tunable and hides the defect from the one consumer positioned
    to notice it. Where an adopter is stuck with such a backend the wait
    belongs in that adoption, named and citing the defect -- which is what the
    OFREP adoption's SettledControl is, and what Appendix F now prescribes.

The self-test tally was also stale: 190, not 163.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 14, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 16, 2026
Adds the policy item 8 settled: a containerised adoption suite is excluded
from the default build and a maintainer runs it by hand before merge. Written
down because an exclusion nobody wrote down is indistinguishable from an
oversight, which is exactly how this went unnoticed. Two reasons, and the
second decides it: Docker, and the fact that a conformance suite's honest
output includes failures that are not the provider's -- a canonical flag the
backend does not seed yet -- so a gate that must be green cannot hold it and an
xfail would blame the provider for the backend.

The corrections:

  - control_api is documented as required, closed and stated rather than
    guessed, in both the control section and the no-backend one;
  - the compose table's configuration row is backend_configuration;
  - there is no /restart binding, and the reason, replacing a bullet that
    presented the endpoint as part of the contract every backend owes;
  - the settle paragraph no longer claims flagd-testbed#394 closed the window.
    It did not -- #394 is open and unmerged, the launchpad still returns from
    /start as soon as /readyz answers, and the ~40 ms window is real and
    measured. The reason not to sleep is that control-api.yaml now requires
    every state-changing endpoint to serve before it returns, and that a fixed
    delay is un-tunable and hides the defect from the one consumer positioned
    to notice it. Where an adopter is stuck with such a backend the wait
    belongs in that adoption, named and citing the defect -- which is what the
    OFREP adoption's SettledControl is, and what Appendix F now prescribes.

The self-test tally was also stale: 190, not 163.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
aepfli added a commit that referenced this pull request Oct 16, 2026
Four languages pinned this image by hand and had drifted: JavaScript was already
on v3.10.1 while Go, Java and Python sat on v3.8.0, so the suites whose results
are only comparable if they asked the same backend were asking two. v3.10.1 is
the current release, so aligning up rather than down.

What this does NOT fix, stated because the tag is easy to mistake for a fix:
open-feature/flagd-testbed#392 and #394 are both still open, so v3.10.1 carries
neither the three missing precision flags nor the /start readiness fix. The
fixture failures and the readiness race are unchanged.

The one behavioural change in range is open-feature/flagd-testbed#390, which
increases the simulated downtime -- and that is exactly the timing the @Stale and
@unavailable scenarios depend on. Tallies recorded against v3.8.0 have not been
re-measured on this image, including the failure ranges the adoption READMEs cite
by tag; those figures stay as they are because they are a record of what v3.8.0
did, and re-taking them is follow-up work rather than a rewrite.

Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants