From d57ead2ec76ae5a534074e752767beb6bb58bf7f Mon Sep 17 00:00:00 2001 From: maxlerebourg Date: Fri, 7 Aug 2026 12:15:10 +0200 Subject: [PATCH 1/3] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20renovate:=20Update=20a?= =?UTF-8?q?ctions/setup-go=20action=20to=20v7=20(#364)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Renovate Bot <22881669+maxlerebourg@users.noreply.github.com> --- .github/workflows/e2e.yml | 2 +- .github/workflows/main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 9c9f6ad..781b3a6 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -19,7 +19,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 with: # Track go.mod (Go 1.22) — the plugin's yaegi-bound floor. Keeps the # single source of truth and builds the mock on the supported version. diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c7bff20..64d5f87 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -32,7 +32,7 @@ jobs: # https://github.com/marketplace/actions/setup-go-environment - name: Set up Go ${{ env.GO_VERSION }} - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 with: go-version: ${{ env.GO_VERSION }} From 9b8d6b937cff1295a96807c0c0954e8f900adb52 Mon Sep 17 00:00:00 2001 From: mathieuHa Date: Fri, 7 Aug 2026 19:11:54 +0200 Subject: [PATCH 2/3] :bug: keep the stream lease alive when updateIntervalSeconds is 1 (#371) * :bug: keep the stream lease alive when updateIntervalSeconds is 1 handleStreamCache takes a lease so a single node polls LAPI per interval, and stores it for updateInterval-1 seconds. The e2e stream scenario now sets updateIntervalSeconds to 1, which makes that a 0 second duration: golang-ttl-map returns early on a zero ttl (map.go:114) and redis rejects a non positive EX, so the lease is never stored and the guard silently does nothing. Floor the duration at 1 second. At an interval of 1 the lease can survive a tick that fires slightly early and cost one skipped poll, which is far better than every node polling every tick against a shared redis. * Adjust lease duration to prevent cache update conflicts Updated lease duration logic to ensure a minimum of 1 second. --------- Co-authored-by: maxlerebourg --- bouncer.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/bouncer.go b/bouncer.go index d362996..5f02e27 100644 --- a/bouncer.go +++ b/bouncer.go @@ -641,7 +641,12 @@ func handleStreamCache(bouncer *Bouncer) error { if err.Error() != cache.CacheMiss { return err } - bouncer.cacheClient.Set(cacheTimeoutKey, cache.NoBannedValue, bouncer.updateInterval-1) + // To avoid every instance trying to update the cache, set 1 second at least + leaseDuration := bouncer.updateInterval - 1 + if leaseDuration < 1 { + leaseDuration = 1 + } + bouncer.cacheClient.Set(cacheTimeoutKey, cache.NoBannedValue, leaseDuration) streamRouteURL := url.URL{ Scheme: bouncer.crowdsecScheme, Host: bouncer.crowdsecHost, From ae7481caa5a06e9fd31dcc5017f7dc0f9e2d00b3 Mon Sep 17 00:00:00 2001 From: maxlerebourg Date: Thu, 20 Aug 2026 12:05:45 +0200 Subject: [PATCH 3/3] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20renovate:=20Update=20a?= =?UTF-8?q?ll=20(#375)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Renovate Bot <22881669+maxlerebourg@users.noreply.github.com> --- .github/workflows/renovate.yml | 2 +- docker-compose.local.yml | 2 +- docker-compose.yml | 4 ++-- examples/appsec-enabled/docker-compose.yml | 4 ++-- examples/behind-proxy/docker-compose.yml | 6 +++--- examples/captcha/docker-compose.yml | 4 ++-- examples/custom-ban-page/docker-compose.yml | 4 ++-- examples/custom-captcha/docker-compose.yml | 4 ++-- examples/kubernetes/traefik/values.yml | 4 ++-- examples/redis-cache/docker-compose.yml | 6 +++--- examples/standalone-mode/docker-compose.yml | 4 ++-- examples/tls-auth/docker-compose.yml | 4 ++-- examples/trusted-ips/docker-compose.yml | 4 ++-- tests/e2e/mock/lib/common.sh | 2 +- 14 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index b2bdd80..6e292b0 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run Renovate - uses: renovatebot/github-action@v46.1.21 + uses: renovatebot/github-action@v46.2.2 with: token: ${{ secrets.RENOVATE_TOKEN }} env: diff --git a/docker-compose.local.yml b/docker-compose.local.yml index 7bce755..88f47b7 100644 --- a/docker-compose.local.yml +++ b/docker-compose.local.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: diff --git a/docker-compose.yml b/docker-compose.yml index 225ce81..6c84baa 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -12,7 +12,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" # - './ban.html:/ban.html:ro' diff --git a/examples/appsec-enabled/docker-compose.yml b/examples/appsec-enabled/docker-compose.yml index 79fae60..b6f8413 100644 --- a/examples/appsec-enabled/docker-compose.yml +++ b/examples/appsec-enabled/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/examples/behind-proxy/docker-compose.yml b/examples/behind-proxy/docker-compose.yml index f7c138d..ba7b40b 100644 --- a/examples/behind-proxy/docker-compose.yml +++ b/examples/behind-proxy/docker-compose.yml @@ -1,6 +1,6 @@ services: cloudflare: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "cloudflare" restart: unless-stopped command: @@ -19,7 +19,7 @@ services: - 8080:8080 traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -33,7 +33,7 @@ services: - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - logs-traefik:/var/log/traefik diff --git a/examples/captcha/docker-compose.yml b/examples/captcha/docker-compose.yml index a17d346..98a8331 100644 --- a/examples/captcha/docker-compose.yml +++ b/examples/captcha/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/examples/custom-ban-page/docker-compose.yml b/examples/custom-ban-page/docker-compose.yml index 6dca9aa..8a94283 100644 --- a/examples/custom-ban-page/docker-compose.yml +++ b/examples/custom-ban-page/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/examples/custom-captcha/docker-compose.yml b/examples/custom-captcha/docker-compose.yml index d1c035e..031951d 100644 --- a/examples/custom-captcha/docker-compose.yml +++ b/examples/custom-captcha/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -14,7 +14,7 @@ services: - "--entrypoints.web.forwardedheaders.trustedips=172.18.0.0/24" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/examples/kubernetes/traefik/values.yml b/examples/kubernetes/traefik/values.yml index a56bee3..ff003e5 100644 --- a/examples/kubernetes/traefik/values.yml +++ b/examples/kubernetes/traefik/values.yml @@ -1,5 +1,5 @@ image: - tag: v3.7.9 + tag: v3.7.11 logs: general: @@ -15,4 +15,4 @@ experimental: plugins: bouncer: moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - version: "v1.7.0" + version: "v1.7.1" diff --git a/examples/redis-cache/docker-compose.yml b/examples/redis-cache/docker-compose.yml index a0b660c..12b1596 100644 --- a/examples/redis-cache/docker-compose.yml +++ b/examples/redis-cache/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro @@ -87,7 +87,7 @@ services: - "traefik.enable=false" redis-secure: - image: "redis:8.8.1-alpine" + image: "redis:8.10.0-alpine" container_name: "redis-secure" hostname: redis-secure restart: unless-stopped diff --git a/examples/standalone-mode/docker-compose.yml b/examples/standalone-mode/docker-compose.yml index bc1c7ad..25e664d 100644 --- a/examples/standalone-mode/docker-compose.yml +++ b/examples/standalone-mode/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/examples/tls-auth/docker-compose.yml b/examples/tls-auth/docker-compose.yml index c1dd427..10f95b3 100644 --- a/examples/tls-auth/docker-compose.yml +++ b/examples/tls-auth/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/examples/trusted-ips/docker-compose.yml b/examples/trusted-ips/docker-compose.yml index f6b598d..5c3d1f2 100644 --- a/examples/trusted-ips/docker-compose.yml +++ b/examples/trusted-ips/docker-compose.yml @@ -1,6 +1,6 @@ services: traefik: - image: "traefik:v3.7.9" + image: "traefik:v3.7.11" container_name: "traefik" restart: unless-stopped command: @@ -13,7 +13,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.7.0" + - "--experimental.plugins.bouncer.version=v1.7.1" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/tests/e2e/mock/lib/common.sh b/tests/e2e/mock/lib/common.sh index 3dc5f1d..f15dfc7 100644 --- a/tests/e2e/mock/lib/common.sh +++ b/tests/e2e/mock/lib/common.sh @@ -14,7 +14,7 @@ set -euo pipefail # Pinned to match the Docker suite (tests/e2e/scenarios/*/docker-compose.yml). -TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.9}" +TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.11}" WEB_PORT="${WEB_PORT:-8000}" LAPI_PORT="${LAPI_PORT:-8090}"