[jtroup]

ENG-9783

what

Merge the upstream v1.6.77 release tag (v1.6 LTS) into
stacklet/integration. The image now installs the 1.6.77
@cubejs-backend/* packages. The merge commit message records the
conflict resolution:

• Upstream adds a moment-timezone resolution. We keep it next to our
  scoped tar, basic-ftp, tmp and toml resolutions. Upstream
  still locks the same parents, which still ask for the vulnerable
  ranges, so all seven Stacklet resolutions stay.
• cubejs-docker/package.json takes upstream's 1.6.77 pins, still
  without databricks-jdbc-driver and hive-driver.

A second commit refreshes body-parser, follow-redirects, joi and
zod in yarn.lock within their declared ranges. Every new version is
at least 7 days old. follow-redirects stays at 1.16.2 because 1.16.3
is newer than that. packages/cubejs-docker/yarn.lock matches the root
lockfile again.

why

v1.6.77 is the current release on the LTS line we track. A grype scan
of the image found four new High npm advisories, each with a fix inside
the locked ranges. After the refresh, the only High or Critical npm
finding is decompress, which has no fixed release. The remaining
Debian findings have no bookworm update.

testing

Relying on the image workflow's build, logger-patch check and smoke
test, then downstream tests against the PR image.

• Downstream tests pass against the v1.6.77-stacklet-pr<N> image

docs

No docs needed.

---

🤖 Generated with Claude Code

[cubic-dev-ai]

14 issues found across 171 files

Confidence score: 2/5

• claude-code-review.yml gives Docker access to a secrets-bearing review based on the PR author's association, not whether the PR head is trusted. Gate this on a trusted PR head so an untrusted fork cannot reach the privileged runner.
• claude-code-review.yml allows Grep to search arbitrary runner paths, so prompt-injected PR content may expose files outside the checkout. Restrict search to the workspace or deny the broad search tools.
• claude-code-review.yml hard-codes cube-js/cube, so /bot-review operates on the upstream repository instead of stacklet/cube. Use the current repository when listing, deduplicating, and resolving threads.
• claude-code-review.yml omits issues: read from both caller jobs, so the reusable workflow cannot query issues for /bot-review. Add the permission to both callers or remove the issue-query tools.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="rust/cubestore/cubestore-sql-tests/src/files.rs">

<violation number="1" location="rust/cubestore/cubestore-sql-tests/src/files.rs:78">
P3: Dropping `TestFileServer` aborts only the accept loop; active connection tasks can still finish delayed requests after the server is dropped. Track those handles or cancel them from `Drop` so the documented server lifetime also bounds in-flight requests.</violation>
</file>

<file name="docs-mintlify/scripts/extract-core-data.js">

<violation number="1" location="docs-mintlify/scripts/extract-core-data.js:279">
P2: The extractor cannot reproduce the committed `RequestId` and `Traceparent` additions because the source spec has no parameter references or definitions. Add these parameters and their path references to the source/extraction inputs, otherwise the next regeneration will silently delete the request-tracing documentation.</violation>
</file>

<file name="docs-mintlify/api-reference/core-data.yaml">

<violation number="1" location="docs-mintlify/api-reference/core-data.yaml:201">
P2: The new header contract claims invalid IDs return 400, but the gateway passes `x-request-id` and `traceparent` through without validation. Remove the rejection claim and constraints or add matching gateway validation.</violation>

<violation number="2" location="docs-mintlify/api-reference/core-data.yaml:207">
P3: The `traceparent` schema is not W3C-compatible: its pattern accepts arbitrary request-ID strings such as `foo`. Use the W3C traceparent grammar, or describe this as a generic tracing value instead of a W3C header.</violation>
</file>

<file name="packages/cubejs-api-gateway/src/member-expression-security.ts">

<violation number="1" location="packages/cubejs-api-gateway/src/member-expression-security.ts:50">
P2: This scanner treats escaped `\${...}` text as executable interpolation. Since a backslash before `$` makes the sequence literal in the generated template, skip `${` occurrences preceded by an odd run of backslashes so valid SQL containing literal `${...}` is not rejected.</violation>
</file>

<file name="packages/cubejs-api-gateway/src/gateway.ts">

<violation number="1" location="packages/cubejs-api-gateway/src/gateway.ts:1380">
P2: Malformed filters can now trigger a 500 before Joi validation instead of the expected 400. Validate the query before traversing member paths, or make `memberPaths` tolerate every malformed shape and let the schema report it.</violation>

<violation number="2" location="packages/cubejs-api-gateway/src/gateway.ts:1612">
P3: Remove this unused `memberTarget` helper or wire it into normalization; as written, it is dead code and makes member-alias handling appear implemented when it is not.</violation>
</file>

<file name=".github/workflows/claude-code-review.yml">

<violation number="1" location=".github/workflows/claude-code-review.yml:35">
P2: `issues: read` does not reach `/bot-review` because the caller jobs omit it and reusable workflows cannot elevate `GITHUB_TOKEN` permissions. Add `issues: read` to both caller jobs or remove the new issue-query tools from this workflow.</violation>

<violation number="2" location=".github/workflows/claude-code-review.yml:44">
P1: Custom agent: **Flag Security Vulnerabilities**

This grants Docker to a secrets-bearing review based on the PR author's association, not whether the PR head is trusted. A collaborator-authored fork is checked out as PR code, so prompt injection can use Docker's host access to expose runner credentials through the allowed comment tools; gate this on the PR head repository being the base repository or remove Docker access for fork reviews.</violation>

<violation number="3" location=".github/workflows/claude-code-review.yml:84">
P2: Reusable `/bot-review` runs load trusted review configuration from the default branch whenever the PR targets a different base branch. Fetch or pass the actual PR base SHA before this checkout so branch-specific review instructions and aliases match the PR being reviewed.</violation>

<violation number="4" location=".github/workflows/claude-code-review.yml:139">
P1: The inlined trusted instructions hard-code `cube-js/cube`, but this workflow runs in `stacklet/cube`, so `/bot-review` lists, deduplicates, and resolves threads for the upstream repository instead of the PR being reviewed. Keep the repository dynamic when assembling the trusted prompt and thread commands.</violation>

<violation number="5" location=".github/workflows/claude-code-review.yml:145">
P1: The bare `Grep` allow rule lets a prompt-injected PR search arbitrary runner paths, not just the checkout. Restrict search tools to the workspace with the Claude sandbox/path policy, or deny `Grep` and `Glob` and use `Read` only; the two `Read` denies do not establish a workspace boundary.</violation>
</file>

<file name="rust/cubesql/Cargo.toml">

<violation number="1" location="rust/cubesql/Cargo.toml:13">
P2: Custom agent: **Check new dependencies**

These patches redirect the existing crates.io dependencies to pinned commits from a fork, but the manifest and lockfile do not establish the fork commits’ source provenance or license. Verify the exact revisions’ upstream provenance and license, or use the official chrono-tz source.</violation>
</file>

<file name="rust/cube/Cargo.toml">

<violation number="1" location="rust/cube/Cargo.toml:14">
P2: Custom agent: **Check new dependencies**

This patch sources `chrono-tz` from the `cube-js` fork rather than its listed upstream, `chronotope/chrono-tz`, and does not establish the fork’s license. Verify the pinned fork’s provenance and license, or use the official upstream source.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Client as API Client
    participant API as API Gateway
    participant Auth as Auth Validator
    participant Schema as Schema Compiler
    participant Eval as Member Expr Evaluator
    participant Guard as Expression Security Guard
    participant SQL as SQL Escaper
    participant DB as Database Driver

    Note over Client,DB: Runtime Request Flow - Query Processing

    Client->>API: HTTP POST /load (with/without member expressions)
    API->>Auth: Validate JWT token
    Auth-->>API: Token valid

    alt REST API (memberExpressions=false)
        API->>API: normalizeQuery() - strict schema validation
        Note over API: Rejects member expressions, subqueryJoins
        API->>Schema: applyRowLevelSecurity(query)
        Schema-->>API: Query with RLS filters
        API->>API: queryRewrite() + validate return type
        API->>Schema: applyRowLevelSecurity(rewritten)
        Schema-->>API: Final normalized query
    else SQL API (memberExpressions=true)
        API->>API: normalizeQuery() - permissive schema (allows expressions)
        API->>Eval: parseMemberExpressionsInQuery()
        Eval->>Eval: Build compiled function arrays
        Eval->>Guard: assertSafeCompiledMemberExpression()
        Guard->>Guard: Validate cubeParams identifiers
        
        alt Unsafe expression detected
            Guard-->>API: Throw UserError
            API-->>Client: 400 "Unsafe member expression"
        else Safe expression
            Eval-->>API: Compiled expression functions
            API->>Schema: applyRowLevelSecurity() + queryRewrite()
            Schema-->>API: Filtered query
        end
    end

    API->>DB: Execute query with escaped identifiers
    Note over SQL,DB: NEW: Identifier escaping per-dialect
    DB->>SQL: escapeColumnName()
    SQL-->>DB: Properly quoted identifier
    
    alt Unsafe identifier characters (quotes/backslashes)
        DB->>SQL: escapeIdentifierAnsi/MySql/SparkSql
        SQL-->>DB: Doubled or backslash-escaped
    end
    
    DB-->>API: Result set
    API-->>Client: Response with data

    Note over API,Guard: Error paths
    alt Invalid query format
        API-->>Client: 400 Invalid query format
    end

    Note over Client,DB: Security boundaries
    Note over Guard: Guards Function.constructor eval<br/>Rejects backtick breakout<br/>Rejects non-identifier cubeParams<br/>Rejects prototype chain access

Loading

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: The inlined trusted instructions hard-code cube-js/cube, but this workflow runs in stacklet/cube, so /bot-review lists, deduplicates, and resolves threads for the upstream repository instead of the PR being reviewed. Keep the repository dynamic when assembling the trusted prompt and thread commands.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/claude-code-review.yml, line 139:

<comment>The inlined trusted instructions hard-code `cube-js/cube`, but this workflow runs in `stacklet/cube`, so `/bot-review` lists, deduplicates, and resolves threads for the upstream repository instead of the PR being reviewed. Keep the repository dynamic when assembling the trusted prompt and thread commands.</comment>

<file context>
@@ -61,142 +75,150 @@ jobs:
-
-            Leave a blank line after `<summary>` and before `</details>`, otherwise GitHub
-            won't render the markdown inside (tables and lists especially).
+            ${{ env.REVIEW_PROMPT }}
 
-            **Resolving your own stale review threads:**
</file context>

[cubic-dev-ai]

P1: The bare Grep allow rule lets a prompt-injected PR search arbitrary runner paths, not just the checkout. Restrict search tools to the workspace with the Claude sandbox/path policy, or deny Grep and Glob and use Read only; the two Read denies do not establish a workspace boundary.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/claude-code-review.yml, line 145:

<comment>The bare `Grep` allow rule lets a prompt-injected PR search arbitrary runner paths, not just the checkout. Restrict search tools to the workspace with the Claude sandbox/path policy, or deny `Grep` and `Glob` and use `Read` only; the two `Read` denies do not establish a workspace boundary.</comment>

<file context>
@@ -61,142 +75,150 @@ jobs:
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github__get_issue_comments,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh list-review-threads:*),Bash(gh resolve-thread:*)"
-            --model "claude-opus-5"
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github__get_issue_comments,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search issues:*),Bash(gh list-review-threads:*),Bash(gh show-review-thread:*),Bash(gh reply-to-thread:*),Bash(gh resolve-thread:*),Task,Read(./**),Grep,Glob(./**)${{ env.ADDITIONAL_ALLOWED_TOOLS }}"
+            --disallowedTools "Read(~/.*),Read(/${{ runner.temp }}/**)"
+            --settings '{"outputStyle":"Cube"}'
</file context>

Suggested change

	--allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github__get_issue_comments,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search issues:*),Bash(gh list-review-threads:*),Bash(gh show-review-thread:*),Bash(gh reply-to-thread:*),Bash(gh resolve-thread:*),Task,Read(./**),Grep,Glob(./**)${{ env.ADDITIONAL_ALLOWED_TOOLS }}"
	--disallowedTools "Read(~/.*),Read(/${{ runner.temp }}/**)"
	--allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github__get_issue_comments,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search issues:*),Bash(gh list-review-threads:*),Bash(gh show-review-thread:*),Bash(gh reply-to-thread:*),Bash(gh resolve-thread:*),Task,Read(./**)${{ env.ADDITIONAL_ALLOWED_TOOLS }}"
	--disallowedTools "Grep,Glob,Read(~/.*),Read(/${{ runner.temp }}/**)"

[cubic-dev-ai]

P1: Custom agent: Flag Security Vulnerabilities

This grants Docker to a secrets-bearing review based on the PR author's association, not whether the PR head is trusted. A collaborator-authored fork is checked out as PR code, so prompt injection can use Docker's host access to expose runner credentials through the allowed comment tools; gate this on the PR head repository being the base repository or remove Docker access for fork reviews.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/claude-code-review.yml, line 44:

<comment>This grants Docker to a secrets-bearing review based on the PR author's association, not whether the PR head is trusted. A collaborator-authored fork is checked out as PR code, so prompt injection can use Docker's host access to expose runner credentials through the allowed comment tools; gate this on the PR head repository being the base repository or remove Docker access for fork reviews.</comment>

<file context>
@@ -28,15 +28,29 @@ jobs:
+      # Running the PR's code is the same trust boundary the rest of CI already
+      # crosses for a branch PR, but not one to hand a fork. On `workflow_call`
+      # the payload is the caller's issue_comment, whose issue is the PR.
+      ADDITIONAL_ALLOWED_TOOLS: ${{ contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association || github.event.issue.author_association) && ',Bash(docker:*),Bash(psql:*)' || '' }}
     steps:
+      # Cube is public OSS, so runner time is free for us, but Anthropic models
</file context>

[cubic-dev-ai]

P2: The extractor cannot reproduce the committed RequestId and Traceparent additions because the source spec has no parameter references or definitions. Add these parameters and their path references to the source/extraction inputs, otherwise the next regeneration will silently delete the request-tracing documentation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At docs-mintlify/scripts/extract-core-data.js, line 279:

<comment>The extractor cannot reproduce the committed `RequestId` and `Traceparent` additions because the source spec has no parameter references or definitions. Add these parameters and their path references to the source/extraction inputs, otherwise the next regeneration will silently delete the request-tracing documentation.</comment>

<file context>
@@ -250,6 +276,7 @@ const out = {
           'e.g. `Authorization: <CUBE_API_TOKEN>` (no "Bearer" prefix).',
       },
     },
+    ...(Object.keys(parameters).length ? { parameters } : {}),
     schemas: sortedSchemas,
   },
</file context>

[cubic-dev-ai]

P2: This scanner treats escaped \${...} text as executable interpolation. Since a backslash before $ makes the sequence literal in the generated template, skip ${ occurrences preceded by an odd run of backslashes so valid SQL containing literal ${...} is not rejected.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/cubejs-api-gateway/src/member-expression-security.ts, line 50:

<comment>This scanner treats escaped `\${...}` text as executable interpolation. Since a backslash before `$` makes the sequence literal in the generated template, skip `${` occurrences preceded by an odd run of backslashes so valid SQL containing literal `${...}` is not rejected.</comment>

<file context>
@@ -0,0 +1,101 @@
+  let searchFrom = 0;
+
+  for (;;) {
+    const open = sql.indexOf('${', searchFrom);
+
+    if (open === -1) {
</file context>

[cubic-dev-ai]

P2: Custom agent: Check new dependencies

These patches redirect the existing crates.io dependencies to pinned commits from a fork, but the manifest and lockfile do not establish the fork commits’ source provenance or license. Verify the exact revisions’ upstream provenance and license, or use the official chrono-tz source.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At rust/cubesql/Cargo.toml, line 13:

<comment>These patches redirect the existing crates.io dependencies to pinned commits from a fork, but the manifest and lockfile do not establish the fork commits’ source provenance or license. Verify the exact revisions’ upstream provenance and license, or use the official chrono-tz source.</comment>

<file context>
@@ -8,3 +8,7 @@ members = [
 debug = true
+
+[patch.crates-io]
+chrono-tz = { git = "https://github.com/cube-js/chrono-tz", rev = "eec5a8cadb1b40e139195581be5f0b16afa61145" }
+chrono-tz-06 = { package = "chrono-tz", git = "https://github.com/cube-js/chrono-tz", rev = "ee0827f1de1501cdd851d9efdcd128b3ccdd2753" }
</file context>

[cubic-dev-ai]

P2: Custom agent: Check new dependencies

This patch sources chrono-tz from the cube-js fork rather than its listed upstream, chronotope/chrono-tz, and does not establish the fork’s license. Verify the pinned fork’s provenance and license, or use the official upstream source.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At rust/cube/Cargo.toml, line 14:

<comment>This patch sources `chrono-tz` from the `cube-js` fork rather than its listed upstream, `chronotope/chrono-tz`, and does not establish the fork’s license. Verify the pinned fork’s provenance and license, or use the official upstream source.</comment>

<file context>
@@ -9,3 +9,6 @@ members = [
 ]
+
+[patch.crates-io]
+chrono-tz = { git = "https://github.com/cube-js/chrono-tz", rev = "eec5a8cadb1b40e139195581be5f0b16afa61145" }
</file context>

[cubic-dev-ai]

P3: Dropping TestFileServer aborts only the accept loop; active connection tasks can still finish delayed requests after the server is dropped. Track those handles or cancel them from Drop so the documented server lifetime also bounds in-flight requests.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At rust/cubestore/cubestore-sql-tests/src/files.rs, line 78:

<comment>Dropping `TestFileServer` aborts only the accept loop; active connection tasks can still finish delayed requests after the server is dropped. Track those handles or cancel them from `Drop` so the documented server lifetime also bounds in-flight requests.</comment>

<file context>
@@ -55,3 +60,75 @@ pub fn recursive_copy_directory(from: &Path, to: &Path) -> Result<(), CubeError>
+
+impl Drop for TestFileServer {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
</file context>

[cubic-dev-ai]

P3: The traceparent schema is not W3C-compatible: its pattern accepts arbitrary request-ID strings such as foo. Use the W3C traceparent grammar, or describe this as a generic tracing value instead of a W3C header.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At docs-mintlify/api-reference/core-data.yaml, line 207:

<comment>The `traceparent` schema is not W3C-compatible: its pattern accepts arbitrary request-ID strings such as `foo`. Use the W3C traceparent grammar, or describe this as a generic tracing value instead of a W3C header.</comment>

<file context>
@@ -186,6 +192,31 @@ components:
+        type: string
+        minLength: 1
+        maxLength: 128
+        pattern: ^[A-Za-z0-9+/=._:@~-]+$
+    Traceparent:
+      in: header
</file context>

Suggested change

	pattern: ^[A-Za-z0-9+/=._:@~-]+$
	pattern: ^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$

[cubic-dev-ai]

P3: Remove this unused memberTarget helper or wire it into normalization; as written, it is dead code and makes member-alias handling appear implemented when it is not.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/cubejs-api-gateway/src/gateway.ts, line 1612:

<comment>Remove this unused `memberTarget` helper or wire it into normalization; as written, it is dead code and makes member-alias handling appear implemented when it is not.</comment>

<file context>
@@ -1530,6 +1542,80 @@ class ApiGateway {
+    });
+  }
+
+  protected memberTarget(resolve?: (path: string) => any) {
+    return resolve && ((path: string) => {
+      const resolved = resolve(path);
</file context>

[wgrant]

How can I say no!