chore(deps-dev): bump @codacy/codacy-mcp from cd23200 to 7d6d510 in the npm group - #295
Merged
Merged
Conversation
Bumps the npm group with 1 update: [@codacy/codacy-mcp](https://github.com/karoltheguy/codacy-mcp-server). Updates `@codacy/codacy-mcp` from `cd23200` to `7d6d510` - [Commits](karoltheguy/codacy-mcp-server@cd23200...7d6d510) --- updated-dependencies: - dependency-name: "@codacy/codacy-mcp" dependency-version: 7d6d510366fe217378774559ee48a7670657d51b dependency-type: direct:development dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Up to standards ✅🟢 Issues
|
karoltheguy
added a commit
that referenced
this pull request
Aug 3, 2026
## The failure The `GitHub / podman` job has been failing on the last two or three tests of an otherwise green run, in asyncssh with `ConnectionLost`. It looked PR-specific, because each branch lost a different tail test and the branches bumped unrelated things, but PR #295, PR #297 and `main` (run 30828236096) all failed the same way within twenty minutes of each other. The sshd journal from inside the host container names the cause outright: ``` sshd[189]: drop connection #0 from [172.18.0.1]:44264 on [172.18.0.3]:22 penalty: connections without attempting authentication ``` ## Why OpenSSH 9.8 added `PerSourcePenalties` and Fedora ships it enabled. sshd charges a source address one penalty second per TCP connection that closes without attempting authentication, and starts dropping connections outright once the accrued total passes the default 15s floor: ``` persourcepenalties crash:90 authfail:5 noauth:1 grace-exceeded:10 refuseconnection:10 max:600 min:15 ... ``` `podman_target` probes the port with a bare `socket.create_connection`, so a developer with no host up gets a skip rather than a wall of red. At function scope that ran once per test. Every client sits behind the compose bridge and so shares one source address, 172.18.0.1, which makes the whole run a single offender: 34 unauthenticated connections in 45 seconds, comfortably past the floor, and the tests still running when it tripped are the ones that died. That also explains the shape of it. Always the tail of the run, never the start; a different test each time, because the crossing point moves with timing; and intermittent on `main`, where a fast run squeaked under the threshold. ## The fix Two changes, both wanted. - `tests/podman/conftest.py`: `podman_target` becomes session-scoped, cutting the probes from roughly forty per run to one. That is all the probe was ever meant to be. - `Dockerfile.podman-host`: `PerSourcePenalties no` in the sshd drop-in, because a rate limiter that a full run can still reach is one that will fire again the next time the suite grows. The drop-in already verifies its own effect through `sshd -G`, so the new directive is asserted the same way. `sshd -G` exits non-zero on an unknown keyword, so a base image bump that drops the option fails the build rather than quietly restoring the flake. The app itself is untouched. It authenticates every connection it opens and so never accrued these penalties; only the test probe did. No production sshd config changes. ## Verification Built against the real base image (`fedora:43` + `openssh-server`): ``` usepam yes passwordauthentication no kbdinteractiveauthentication no persourcepenalties no ASSERTION PASSED ``` Removing the drop-in in the same container confirms the default was `noauth:1` against `min:15`. Full suite against the real host: **36 passed, 4 skipped, 1102 deselected in 35.13s**. The 4 skips are the `tests/e2e/test_podman_e2e.py` ones, which need the app container. ## Follow-up #295 and #297 will not go green on their own. Once this lands they each need a rebase (`@dependabot rebase`) to pick it up.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm group with 1 update: @codacy/codacy-mcp.
Updates
@codacy/codacy-mcpfromcd23200to7d6d510Commits
7d6d510Merge branch 'codacy:master' into master14bdb5bfix(deps): bump@modelcontextprotocol/sdkto 1.29.0 to resolve CVE-2026-25536...af55f87ci: empty commit to retrigger CircleCI6048269ci: trigger rebuildDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions