patched temporal version

patched temporal version

patched temporal version

[v1.30] Add Nexus callback source header inspection toggle (temporali…

…o#12085)

## What

- gate legacy Nexus callback source-header routing behind
callback.inspectSourceHeader
- default the setting to true for mixed-version migration compatibility
- keep temporal://system callbacks routed internally regardless of the
toggle
- cover both CHASM and legacy callback routing

## Why

Trusting a caller-controlled source header to select internal routing
can lead to privilege escalation. The compatibility toggle allows
operators to disable that legacy behavior after worker callbacks migrate
to temporal://system.

## Testing

- go test -tags test_dep ./chasm/lib/callback ./components/callbacks
- go vet -tags test_dep ./chasm/lib/callback ./components/callbacks

patched temporal version

Cherry-pick: List matching perf (temporalio#11014) to release/v1.31.x (…

…temporalio#12069)

## What changed?

Cherry-pick of c10c730 ("List matching
perf", temporalio#11014) onto `release/v1.31.x`.

Adds a compute bound to the schedule spec next-time search
(`scheduler.specMaxIterations` hard bound,
`scheduler.specWarnIterations` warn threshold) so over-excluded specs
can't burn unbounded CPU, plus the `schedule_compute_limit_exceeded` /
`schedule_compute_limit_warning` metrics.

## Cherry-pick deviations

The commit did not apply cleanly. Resolutions, all mechanical:

- **`service/worker/scheduler/workflow.go`** —
`schedulerWorkflowWithSpecBuilder` takes `enableCHASMMigration bool` on
1.31.x rather than main's two `func() bool` closures. Kept the
release-branch signature; only the `NewSpecBuilder(...)` construction
was taken from the cherry-pick.
- **`service/worker/scheduler/export_test.go`** (new file) — same
signature adaptation.
- **`service/worker/scheduler/workflow_test.go`** — took the
release-branch content and applied only this commit's real change
(`NewSpecBuilder()` → `newSpecBuilderForTest(0, 0)`). The conflict hunks
were drift from the migration-closure change, which is not part of this
commit.
- **`common/metrics/metric_defs.go`** — the conflict region spanned a
large block of metrics 1.31.x does not have. Took only the two metrics
this commit adds.
- **`chasm/lib/scheduler/scheduler_test.go`** — no change needed;
1.31.x's copy does not reference `legacyscheduler.NewSpecBuilder`.
- **`tests/schedule_test.go` — DROPPED.** The four added functional
tests (`TestMirroredIncludeExcludeSpec`,
`TestMirroredIncludeExcludeSpecOnUpdate`,
`TestScheduleFarFutureActionTimes`, `TestScheduleManyCalendars`) depend
on `tests/` harness helpers that only exist on main (`createSchedule`,
`startWorkflowAction`, `chasmContextFactory`,
`registerCountingWorkflow`, `intervalSpec`, `calendarSpec`,
`await.RequireTruef`, and a `scheduleCommonOpts(t)` signature 1.31.x
does not have). Back-porting them would drag in the functional-test
harness refactor — out of scope for a release branch. The behaviour is
still covered by the unit tests below.

## How did you test it?
- [X] `go build ./...` clean
- [X] `go vet` on all touched packages — only pre-existing
`admin_handler_test.go` lock-copy warnings, unrelated
- [X] `go test ./service/worker/scheduler/...` pass
- [X] `go test ./chasm/lib/scheduler/... ./common/dynamicconfig/...
./common/metrics/...` pass
- [X] `TestReplays` and `TestReplaysWithDynamicConfigChange` pass,
including the new `replay_compute_limit_exceeded.json.gz` fixture — this
is the nondeterminism guard for the change
- [ ] functional tests (dropped, see above)

## Potential risks

Same as the original PR: this touches V1 schedule next-time computation,
so the nondeterminism risk is the main concern. The replay test with the
new fixture covers it — scheduling decisions live in
SideEffect/MutableSideEffect markers, so replay returns recorded values
rather than recomputing against new limits. Defaults are permissive
(hard bound ~1.2M iterations, warn at 86400), so no existing schedule
should hit the cap without an operator lowering it.

Reduced coverage vs. main on this branch because the functional tests
were dropped.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Lina Jodoin <lina.jodoin@temporal.io>

patched temporal version

Upgrade go.temporal.io/auto-scaled-workers (temporalio#12021)

## What changed?
Bump `go.temporal.io/auto-scaled-workers` to `v0.2.0-1.32.0.158.0`.

## Why?
Update go.temporal.io/auto-scaled-workers dependency

## How did you test it?
- [X] built
- [ ] run locally and tested manually
- [X] covered by existing tests
- [ ] added new unit test(s)
- [ ] added new functional test(s)

## Potential risks
n/a

patched temporal version

patched temporal version