Fix/708 709 710 711 infrastructure security (conflict resolved) - #800
Merged
Conversation
# [1.1.0](Lex-Studios/predictIQ@v1.0.0...v1.1.0) (2026-05-28) ### Bug Fixes * **#452:** remove double newsletter rate limiting, make policy configurable ([6169065](Lex-Studios@6169065)), closes [#452](https://github.com/Lex-Studios/predictIQ/issues/452) [#452](https://github.com/Lex-Studios/predictIQ/issues/452) * **#453:** Redis-backed newsletter IP rate limiter with atomic counters ([932a14d](Lex-Studios@932a14d)), closes [#453](https://github.com/Lex-Studios/predictIQ/issues/453) * **#454:** harden client IP extraction with trusted proxy CIDRs ([04db648](Lex-Studios@04db648)), closes [#454](https://github.com/Lex-Studios/predictIQ/issues/454) * **#463:** add TTL and max-size eviction to watched_txs ([428b7a7](Lex-Studios@428b7a7)), closes [#463](https://github.com/Lex-Studios/predictIQ/issues/463) * **#485-#488:** sync API_SPEC, add email DLQ, validate templates at startup ([0749bc5](Lex-Studios@0749bc5)), closes [#485](https://github.com/Lex-Studios/predictIQ/issues/485) [-#488](https://github.com/-/issues/488) [#485](https://github.com/Lex-Studios/predictIQ/issues/485) [#486](https://github.com/Lex-Studios/predictIQ/issues/486) [#487](https://github.com/Lex-Studios/predictIQ/issues/487) [#488](https://github.com/Lex-Studios/predictIQ/issues/488) * **#624:** fetch_pyth_price calls on-chain Pyth contract via oracle_address/feed_id ([eb3079f](Lex-Studios@eb3079f)), closes [#624](https://github.com/Lex-Studios/predictIQ/issues/624) * **#625:** determine_outcome uses per-market strike_price from OracleConfig ([901f800](Lex-Studios@901f800)), closes [#625](https://github.com/Lex-Studios/predictIQ/issues/625) * **#626:** validate_oracle_staleness checks all oracle indices ([bc53975](Lex-Studios@bc53975)), closes [#626](https://github.com/Lex-Studios/predictIQ/issues/626) * **#627:** align DISPUTE_WINDOW_SECONDS to 72h (259200) ([4f26453](Lex-Studios@4f26453)), closes [#627](https://github.com/Lex-Studios/predictIQ/issues/627) * **api:** stop leaking internal error details to API consumers ([#628](https://github.com/Lex-Studios/predictIQ/issues/628)) ([e3d8cd9](Lex-Studios@e3d8cd9)) * contract query optimizations and docs fixes ([#481](https://github.com/Lex-Studios/predictIQ/issues/481)-484) ([2a0d193](Lex-Studios@2a0d193)), closes [#481-484](https://github.com/Lex-Studios/predictIQ/issues/481-484) * Enforce SendGrid webhook signature validation ([d49109a](Lex-Studios@d49109a)), closes [#24](https://github.com/Lex-Studios/predictIQ/issues/24) * log cache warming errors and cover all critical endpoints ([bf978d5](Lex-Studios@bf978d5)), closes [#493](https://github.com/Lex-Studios/predictIQ/issues/493) * replace single-connection SCAN loop with per-batch connection acquisition ([#458](https://github.com/Lex-Studios/predictIQ/issues/458)) ([2cfdec4](Lex-Studios@2cfdec4)) * resolve compile errors from issues [#477](https://github.com/Lex-Studios/predictIQ/issues/477)-[#480](https://github.com/Lex-Studios/predictIQ/issues/480) ([81235ac](Lex-Studios@81235ac)), closes [#478](https://github.com/Lex-Studios/predictIQ/issues/478) * stop swallowing blockchain RPC errors into silent defaults ([#460](https://github.com/Lex-Studios/predictIQ/issues/460)) ([fc0ec9c](Lex-Studios@fc0ec9c)) * structured API errors, webhook sig verification, OpenAPI sync ([2430bfe](Lex-Studios@2430bfe)) ### Features * add cache stampede protection (Issue [#47](https://github.com/Lex-Studios/predictIQ/issues/047)) ([4fff7e7](Lex-Studios@4fff7e7)) * add configurable database query timeout ([#49](https://github.com/Lex-Studios/predictIQ/issues/049)) ([522e0f0](Lex-Studios@522e0f0)) * add Dependabot configuration for automated security updates ([34ed35e](Lex-Studios@34ed35e)) * add idempotency key support for email sends (Issue [#45](https://github.com/Lex-Studios/predictIQ/issues/045)) ([54dde3f](Lex-Studios@54dde3f)) * **api:** add database connection health check ([#495](https://github.com/Lex-Studios/predictIQ/issues/495)) ([e012013](Lex-Studios@e012013)) * **frontend:** add form validation with accessible user feedback ([#73](https://github.com/Lex-Studios/predictIQ/issues/073)) ([f376168](Lex-Studios@f376168)) * implement cache TTL per key type (Issue [#46](https://github.com/Lex-Studios/predictIQ/issues/046)) ([8f2bbb1](Lex-Studios@8f2bbb1)) * implement database migration version tracking ([281e2a2](Lex-Studios@281e2a2)), closes [#496](https://github.com/Lex-Studios/predictIQ/issues/496) * implement graceful shutdown for background workers ([0ef02d4](Lex-Studios@0ef02d4)) * implement issues [#513](https://github.com/Lex-Studios/predictIQ/issues/513) [#514](https://github.com/Lex-Studios/predictIQ/issues/514) [#515](https://github.com/Lex-Studios/predictIQ/issues/515) [#516](https://github.com/Lex-Studios/predictIQ/issues/516) ([f8cdec2](Lex-Studios@f8cdec2)) * implement real market resolve write flow ([#457](https://github.com/Lex-Studios/predictIQ/issues/457)) ([ca9de29](Lex-Studios@ca9de29)) * introduce targeted cache invalidation tags ([#459](https://github.com/Lex-Studios/predictIQ/issues/459)) ([e2924e3](Lex-Studios@e2924e3)) * newsletter-security-issues ([59e2a2d](Lex-Studios@59e2a2d)) * protect /metrics endpoint with auth and IP allowlist ([044ef94](Lex-Studios@044ef94)), closes [#456](https://github.com/Lex-Studios/predictIQ/issues/456) * Redis pooling, circuit breaker, retry, correlation IDs, OTel tracing ([cab2ffb](Lex-Studios@cab2ffb)) * sanitize email recipients before SendGrid call (Issue [#44](https://github.com/Lex-Studios/predictIQ/issues/044)) ([13ff88a](Lex-Studios@13ff88a)) * wire and globalise admin security & validation middleware ([#446](https://github.com/Lex-Studios/predictIQ/issues/446) [#447](https://github.com/Lex-Studios/predictIQ/issues/447) [#448](https://github.com/Lex-Studios/predictIQ/issues/448) [#449](https://github.com/Lex-Studios/predictIQ/issues/449)) ([38ad7b3](Lex-Studios@38ad7b3))
- Add JAEGER_ENDPOINT and ZIPKIN_ENDPOINT env var support to otel-collector-config.yml - Update docker-compose.tracing.yml to pass environment variables to otel-collector - Document OTLP endpoint configuration in DISTRIBUTED_TRACING.md with examples
…ng.yml - Jaeger: 1 CPU limit, 1GB memory limit (0.5 CPU, 512MB reserved) - Zipkin: 0.5 CPU limit, 512MB memory limit (0.25 CPU, 256MB reserved) - OTEL Collector: 0.5 CPU limit, 512MB memory limit (0.25 CPU, 256MB reserved) - Limits prevent unbounded resource consumption in shared environments - Rationale documented in comments for each service
- Create dedicated 'appuser' non-root user and group - Set ownership of /app directory to appuser - Switch to appuser before CMD/ENTRYPOINT - Prevents container escape vulnerabilities from granting root access - Mitigates privilege escalation attacks
- rust:1.75-slim pinned to sha256:4dd48afa1d6fcf622b18b60081bb6c897b11787b42006aea2f2cf5ff3f6ae0cc - debian:bookworm-slim pinned to sha256:3d868b89a1b0d8b957fa1798fffb5e1b6db5ac4e9c79e74acd418db9be3506b - Ensures reproducible builds across environments - Prevents unexpected changes from upstream image updates - Digests can be updated via Dependabot or scheduled workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves CHANGELOG.md merge conflict from PR #790.