fix(config): disable profiling diagnostics by default#5991
Conversation
dosubot
Bot
added
the
size:XS
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## v2 #5991 +/- ##
==========================================
- Coverage 61.40% 61.39% -0.02%
==========================================
Files 142 142
Lines 14261 14261
==========================================
- Hits 8757 8755 -2
- Misses 4770 4771 +1
- Partials 734 735 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: request changes
The PR correctly disables profiling diagnostics by default in the Go code and updates the marshal test fixture, but it leaves two schema files out of sync with the new default. Both the JSON schema and CUE schema still document the old default: true value, which will mislead users and schema-driven tooling.
config/flipt.schema.json
- major (L771): The JSON schema still documents
"default": truefordiagnostics.profiling.enabled. Update it tofalseto match the new code default.
config/flipt.schema.cue
- major (L189): The CUE schema still documents
enabled?: bool | *truefor diagnostics profiling. Update it to*falseto match the new code default.
🤖 Automated review by the Flipt PR review agent.
The profiling diagnostics feature exposes pprof endpoints on the HTTP server. Having it enabled by default was a security concern since it leaks runtime internals. Change the default to false so operators must consciously opt in. Signed-off-by: Roman Dmytrenko <[email protected]>
There was a problem hiding this comment.
Verdict: approve
Clean, well-scoped security fix. All defaults (Go code, viper, CUE schema, JSON schema) are consistently changed to false, and the marshal test fixture is correctly updated to omit the zero-value diagnostics block.
🤖 Automated review by the Flipt PR review agent.
2 participants
The profiling diagnostics feature exposes pprof endpoints on the HTTP
server. Having it enabled by default was a security concern since it
leaks runtime internals. Change the default to false so operators
must consciously opt in.