fix: coalesce concurrent secret reference folder loads - #8011
Conversation
|
💬 Discussion in Slack: #pr-review-infisical-8011-fix-coalesce-concurrent-secret-reference-folder-loads Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
d2a00a3 to
88bd99c
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
| Filename | Overview |
|---|---|
| backend/src/services/secret-v2-bridge/secret-reference-fns.ts | Adds per-expander in-flight folder-load coalescing while preserving existing missing-secret and error behavior. |
| backend/src/services/secret-v2-bridge/secret-reference-fns.test.ts | Adds a valid concurrent regression test asserting one database read for 50 same-folder references. |
Reviews (1): Last reviewed commit: "fix: coalesce concurrent secret referenc..." | Re-trigger Greptile
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [infisical/infisical](https://infisical.com) ([source](https://github.com/Infisical/infisical)) | minor | `v0.162.24` → `v0.165.9` | --- ### Release Notes <details> <summary>Infisical/infisical (infisical/infisical)</summary> ### [`v0.165.9`](https://github.com/Infisical/infisical/releases/tag/v0.165.9) [Compare Source](Infisical/infisical@v0.165.8...v0.165.9) #### What's Changed - chore: add upgrade impact for v0.165.8 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​8039](Infisical/infisical#8039) - fix(dynamic-secrets): add missing provider logos by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​8032](Infisical/infisical#8032) - chore(deps): bump the bundled CLI to 0.43.129 by [@​Vligai](https://github.com/Vligai) in [#​8026](Infisical/infisical#8026) - improvement(security): derive cookie signing key from KMS root key by [@​victorvhs017](https://github.com/victorvhs017) in [#​8029](Infisical/infisical#8029) - feat(secret-sync): detect duplicate Daytona syncs by organization by [@​lobocv](https://github.com/lobocv) in [#​7994](Infisical/infisical#7994) - improvement(frontend): upgrade framer-motion to motion by [@​claude](https://github.com/claude)\[bot] in [#​8033](Infisical/infisical#8033) - improvement(ui): point onboarding CTA to community instead of Slack by [@​claude](https://github.com/claude)\[bot] in [#​8009](Infisical/infisical#8009) - fix(github-org-sync): safely sync teams for large orgs by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7998](Infisical/infisical#7998) - fix(secrets-access-requests): auto open review sheet when request ID present by [@​varonix0](https://github.com/varonix0) in [#​8041](Infisical/infisical#8041) - feat(ui): add global command menu by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7877](Infisical/infisical#7877) - docs(integrations): poc for app connections and integrations format revamp by [@​adkah](https://github.com/adkah) in [#​8028](Infisical/infisical#8028) - improvement(frontend): flatten pki sidebar general section into top-level items by [@​claude](https://github.com/claude)\[bot] in [#​8049](Infisical/infisical#8049) - improvement(frontend): render server console banners inside sidebar inset by [@​claude](https://github.com/claude)\[bot] in [#​8050](Infisical/infisical#8050) - feat: add pki license gating by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7939](Infisical/infisical#7939) - improvement(frontend): migrate add machine identity to project dialog to v3 by [@​claude](https://github.com/claude)\[bot] in [#​8047](Infisical/infisical#8047) - improvement(frontend): lower bulk action bar and add shadow by [@​claude](https://github.com/claude)\[bot] in [#​8059](Infisical/infisical#8059) - chore(project-cleanup): clarify concurrent worker deletion log message by [@​victorvhs017](https://github.com/victorvhs017) in [#​8053](Infisical/infisical#8053) - feat: introduce INFISICAL\_RUN\_MODES by [@​mathnogueira](https://github.com/mathnogueira) in [#​8031](Infisical/infisical#8031) - improvement(frontend): rename v3 switch component to toggle by [@​claude](https://github.com/claude)\[bot] in [#​8065](Infisical/infisical#8065) - fix: allow read operations in cross project secret sharing by [@​mathnogueira](https://github.com/mathnogueira) in [#​7966](Infisical/infisical#7966) - improvement(frontend): use Alert and Combobox in Doppler import modal by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​8058](Infisical/infisical#8058) - fix(pki): set intermediate CA parentCaId to null instead of cascading on parent delete by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​8063](Infisical/infisical#8063) **Full Changelog**: <Infisical/infisical@v0.165.8...v0.165.9> ### [`v0.165.8`](https://github.com/Infisical/infisical/releases/tag/v0.165.8) [Compare Source](Infisical/infisical@v0.165.7...v0.165.8) #### What's Changed - chore: add upgrade impact for v0.165.7 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​8027](Infisical/infisical#8027) - fix(telemetry): bound HTTP metric cardinality and add core request counter by [@​victorvhs017](https://github.com/victorvhs017) in [#​7995](Infisical/infisical#7995) - docs(pam): rework postgres discovery guide by [@​adkah](https://github.com/adkah) in [#​8034](Infisical/infisical#8034) - fix(secret-rotation): accept iLO 7 "hpeiLO->" prompt in HP iLO rotation by [@​claude](https://github.com/claude)\[bot] in [#​7977](Infisical/infisical#7977) **Full Changelog**: <Infisical/infisical@v0.165.7...v0.165.8> ### [`v0.165.7`](https://github.com/Infisical/infisical/releases/tag/v0.165.7) [Compare Source](Infisical/infisical@v0.165.6...v0.165.7) #### What's Changed - fix: make many-to-one aws sm sync only target one secret by [@​mathnogueira](https://github.com/mathnogueira) in [#​7999](Infisical/infisical#7999) - chore: add upgrade impact for v0.165.6 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​8004](Infisical/infisical#8004) - docs(platform): additional screenshot pass by [@​adkah](https://github.com/adkah) in [#​7997](Infisical/infisical#7997) - improvement(frontend): reduce mobile padding on overview and dashboard pages by [@​claude](https://github.com/claude)\[bot] in [#​8005](Infisical/infisical#8005) - feat: allow one LDAP connection to back many Linux and Windows syncs by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7867](Infisical/infisical#7867) - fix: coalesce concurrent secret reference folder loads by [@​maidul98](https://github.com/maidul98) in [#​8011](Infisical/infisical#8011) - fix: split query into 3 ones to reduce duplicate alloc by joins by [@​mathnogueira](https://github.com/mathnogueira) in [#​8012](Infisical/infisical#8012) - improvement(audit-log): tag stale-claim drops with stream provider by [@​victorvhs017](https://github.com/victorvhs017) in [#​8001](Infisical/infisical#8001) - fix(app-connections): standardize add sheet discard handling by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7942](Infisical/infisical#7942) - improvement(approvals): add create-policy CTA to change requests empty state when no policies exist by [@​claude](https://github.com/claude)\[bot] in [#​8008](Infisical/infisical#8008) - fix(frontend): match secret row hover actions to standard ghost icon buttons by [@​claude](https://github.com/claude)\[bot] in [#​8020](Infisical/infisical#8020) - feat(pam): break-glass for access requests by [@​lb-vn](https://github.com/lb-vn) in [#​7930](Infisical/infisical#7930) **Full Changelog**: <Infisical/infisical@v0.165.6...v0.165.7> ### [`v0.165.6`](https://github.com/Infisical/infisical/releases/tag/v0.165.6) [Compare Source](Infisical/infisical@v0.165.5...v0.165.6) ##### Changed - Auto-refresh scan runs and installations while a scan is running ([#​7964](Infisical/infisical#7964)) ##### Fixed - Fix Unix rotation prompt fragmentation ([#​7976](Infisical/infisical#7976)) - Prevent inheriting existing login browser organization when using CLI login ([#​7993](Infisical/infisical#7993)) ### [`v0.165.5`](https://github.com/Infisical/infisical/releases/tag/v0.165.5) [Compare Source](Infisical/infisical@v0.165.4...v0.165.5) #### What's Changed - feat: added support to send region to license server by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7975](Infisical/infisical#7975) - docs(app-connections): recapture cloud provider and database connector screenshots by [@​adkah](https://github.com/adkah) in [#​7980](Infisical/infisical#7980) - docs(app-connections): recapture source control and CI connector screenshots by [@​adkah](https://github.com/adkah) in [#​7981](Infisical/infisical#7981) - docs(identities): recapture auth method screenshots and align button labels by [@​adkah](https://github.com/adkah) in [#​7984](Infisical/infisical#7984) - docs(platform): recapture org control screenshots and rewrite SSO & Provisioning navigation by [@​adkah](https://github.com/adkah) in [#​7985](Infisical/infisical#7985) - chore: add upgrade impact for v0.165.4 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7991](Infisical/infisical#7991) - docs(pam): credential health by [@​bernie-g](https://github.com/bernie-g) in [#​7971](Infisical/infisical#7971) - docs(app-connections): recapture token-based connector screenshots by [@​adkah](https://github.com/adkah) in [#​7983](Infisical/infisical#7983) - fix: dont inherit exisitng login browser org when using cli login by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7993](Infisical/infisical#7993) **Full Changelog**: <Infisical/infisical@v0.165.4...v0.165.5> ### [`v0.165.4`](https://github.com/Infisical/infisical/releases/tag/v0.165.4) [Compare Source](Infisical/infisical@v0.165.3...v0.165.4) #### What's Changed - docs(security): remove e2e references by [@​adkah](https://github.com/adkah) in [#​7974](Infisical/infisical#7974) - improvement(secret-syncs): rename disable secret deletion copy by [@​claude](https://github.com/claude)\[bot] in [#​7948](Infisical/infisical#7948) - chore: add upgrade impact for v0.165.3 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7973](Infisical/infisical#7973) - fix(frontend): use text-muted for v3 textarea and command placeholders by [@​claude](https://github.com/claude)\[bot] in [#​7962](Infisical/infisical#7962) - fix: bound membership removal and role changes by the target's privileges for legacy system by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7916](Infisical/infisical#7916) - improvement(ui): migrate project upgrade gate to v3 by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7954](Infisical/infisical#7954) - docs(footer): update community link by [@​adkah](https://github.com/adkah) in [#​7988](Infisical/infisical#7988) - chore(deps): base image and dependency updates from a customer contai… by [@​Vligai](https://github.com/Vligai) in [#​7957](Infisical/infisical#7957) - docs(app-connections): recapture deploy platform connector screenshots by [@​adkah](https://github.com/adkah) in [#​7982](Infisical/infisical#7982) **Full Changelog**: <Infisical/infisical@v0.165.3...v0.165.4> ### [`v0.165.3`](https://github.com/Infisical/infisical/releases/tag/v0.165.3) [Compare Source](Infisical/infisical@v0.165.2...v0.165.3) #### What's Changed - improvement(dynamic-secrets): remove legacy provider forms by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7932](Infisical/infisical#7932) - fix: always show cross-project secret sharing in prod settings by [@​mathnogueira](https://github.com/mathnogueira) in [#​7931](Infisical/infisical#7931) - improvement(secrets): normalize honey token v3 interactions by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7735](Infisical/infisical#7735) - docs: remove secret validation rule endpoints from API reference by [@​claude](https://github.com/claude)\[bot] in [#​7938](Infisical/infisical#7938) - chore: add upgrade impact for v0.165.2 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7934](Infisical/infisical#7934) - feat: resolved approval ui showing uuid in list by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7945](Infisical/infisical#7945) - docs: refresh secret versioning and point-in-time recovery screenshots by [@​jakehulberg](https://github.com/jakehulberg) in [#​7946](Infisical/infisical#7946) - docs(secrets-mgmt): improve ia by [@​adkah](https://github.com/adkah) in [#​7937](Infisical/infisical#7937) - docs(screenshots): update highest impact screenshots and prose by [@​adkah](https://github.com/adkah) in [#​7949](Infisical/infisical#7949) - chore(ui): establish component deprecation lifecycle by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7929](Infisical/infisical#7929) - feat: removed plan check from the policy delete endpoint by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7950](Infisical/infisical#7950) - feat: added better logging around the tunnel closing and changed the tunnel closing order by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7944](Infisical/infisical#7944) - fix: cert dashboard and signer approval policy improvements by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7880](Infisical/infisical#7880) - docs(secrets-mgmt): update most screenshots by [@​adkah](https://github.com/adkah) in [#​7955](Infisical/infisical#7955) - chore(code-agents): license check guidelines by [@​varonix0](https://github.com/varonix0) in [#​7956](Infisical/infisical#7956) - feat(pam): account password viewing with access requests by [@​lb-vn](https://github.com/lb-vn) in [#​7879](Infisical/infisical#7879) - chore: add upgrade impact for v0.165.1 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7933](Infisical/infisical#7933) - feat: add oidc auth template support for MIs by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7935](Infisical/infisical#7935) - docs(style): fix contractions + ui buttons by [@​adkah](https://github.com/adkah) in [#​7910](Infisical/infisical#7910) - feat(secret-sync): add Daytona app connection and secret sync by [@​lobocv](https://github.com/lobocv) in [#​7866](Infisical/infisical#7866) - feat: sync member email and name from the identity provider when the IdP is authoritative by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7936](Infisical/infisical#7936) - feat(pam): heartbeats by [@​bernie-g](https://github.com/bernie-g) in [#​7849](Infisical/infisical#7849) - docs(platform): first pass screenshot audit by [@​adkah](https://github.com/adkah) in [#​7968](Infisical/infisical#7968) **Full Changelog**: <Infisical/infisical@v0.165.2...v0.165.3> ### [`v0.165.2`](https://github.com/Infisical/infisical/releases/tag/v0.165.2) [Compare Source](Infisical/infisical@v0.165.1...v0.165.2) #### What's Changed - improvement(admin-encryption): warn before forcing previous root key deactivation by [@​victorvhs017](https://github.com/victorvhs017) in [#​7912](Infisical/infisical#7912) **Full Changelog**: <Infisical/infisical@v0.165.1...v0.165.2> ### [`v0.165.1`](https://github.com/Infisical/infisical/releases/tag/v0.165.1) #### What's Changed - feat(pki): windows/linux PKI Syns pre-fetch commands by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7694](Infisical/infisical#7694) - fix: make approvals check for validation rules by [@​mathnogueira](https://github.com/mathnogueira) in [#​7837](Infisical/infisical#7837) - feat(pki): expose the latest renewal of a certificate so agents can follow renewals by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7820](Infisical/infisical#7820) - chore: add upgrade impact for v0.164.1 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7840](Infisical/infisical#7840) - docs: fix grammar in dynamic secrets overview by [@​devin-ai-integration](https://github.com/devin-ai-integration)\[bot] in [#​7847](Infisical/infisical#7847) - fix(ui): reset search input when user gets into folder by [@​adilsitos](https://github.com/adilsitos) in [#​7844](Infisical/infisical#7844) - docs: linux and windows doc improvements by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7846](Infisical/infisical#7846) - improvement: add port number to Splunk provider by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7843](Infisical/infisical#7843) - fix: add blocks for ca incompatibility by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7848](Infisical/infisical#7848) - docs: add AI agent identities to identity counting by [@​0xArshdeep](https://github.com/0xArshdeep) in [#​7845](Infisical/infisical#7845) - feat(permissions): folder rbac by [@​adilsitos](https://github.com/adilsitos) in [#​7762](Infisical/infisical#7762) - fix(kubernetes-auth): pin direct API requests with safeRequest by [@​victorvhs017](https://github.com/victorvhs017) in [#​7855](Infisical/infisical#7855) - feat(pki-sync): add GCP Certificate Manager Sync by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7737](Infisical/infisical#7737) - fix(docs): route vulnerability reports through the disclosure policy by [@​Vligai](https://github.com/Vligai) in [#​7856](Infisical/infisical#7856) - fix(auth): pool https agents and fix gateway sni by [@​victorvhs017](https://github.com/victorvhs017) in [#​7857](Infisical/infisical#7857) - feat(webhooks): approval and change request webhook events by [@​lobocv](https://github.com/lobocv) in [#​7780](Infisical/infisical#7780) - docs(wip): top level ia 2 by [@​adkah](https://github.com/adkah) in [#​7830](Infisical/infisical#7830) - docs(secret-rotation): fix typos by [@​adkah](https://github.com/adkah) in [#​7861](Infisical/infisical#7861) - feat(pam): default ssh access to interactive shell by [@​lb-vn](https://github.com/lb-vn) in [#​7838](Infisical/infisical#7838) - feat(pam): improve error code for deleting discovery cred acc by [@​lb-vn](https://github.com/lb-vn) in [#​7854](Infisical/infisical#7854) - feat(docs): add folder rbac docs by [@​adilsitos](https://github.com/adilsitos) in [#​7862](Infisical/infisical#7862) - docs(footer): fix forum link by [@​adkah](https://github.com/adkah) in [#​7865](Infisical/infisical#7865) - fix(certificate): scope certificate private-key read permission to the certificate subject on v3 issuance by [@​Vligai](https://github.com/Vligai) in [#​7549](Infisical/infisical#7549) - fix(cert-v3): route DigiCert requests through external issuance on approval by [@​devin-ai-integration](https://github.com/devin-ai-integration)\[bot] in [#​7870](Infisical/infisical#7870) - improvement(approvals): migrate page shell to v3 by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7836](Infisical/infisical#7836) - docs(folder-rbac): enhancements by [@​adilsitos](https://github.com/adilsitos) in [#​7874](Infisical/infisical#7874) - feat(abac): add trim suffix by [@​adilsitos](https://github.com/adilsitos) in [#​7817](Infisical/infisical#7817) - improvement(secrets): migrate Vault import dialogs to v3 by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7794](Infisical/infisical#7794) - feat: add kubernetes MI auth template support by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7713](Infisical/infisical#7713) - fix: collapse signer approvals into a single setup card until a policy exists by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7875](Infisical/infisical#7875) - feat(ui): select all for vault import secret path Combobox by [@​claude](https://github.com/claude)\[bot] in [#​7878](Infisical/infisical#7878) - fix(pam): re-check session validity when privileged access is granted by [@​lb-vn](https://github.com/lb-vn) in [#​7852](Infisical/infisical#7852) - feat(docs): add ansible folder operations by [@​adilsitos](https://github.com/adilsitos) in [#​7871](Infisical/infisical#7871) - docs(secrets-mgmt): clarify dual-phase rotation by [@​adkah](https://github.com/adkah) in [#​7864](Infisical/infisical#7864) - docs(secrets-mgmt): refresh spacelift sync by [@​adkah](https://github.com/adkah) in [#​7896](Infisical/infisical#7896) - feat(dynamic-secrets): cut over to shared provider registry by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7839](Infisical/infisical#7839) - fix: pki ux patches by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7853](Infisical/infisical#7853) - feat: set project retention limits by [@​varonix0](https://github.com/varonix0) in [#​7887](Infisical/infisical#7887) - docs(style): add skill for applying docs style by [@​adkah](https://github.com/adkah) in [#​7907](Infisical/infisical#7907) - feat(secret-manager): revamp replicate secrets workflow by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7793](Infisical/infisical#7793) - fix(identity-ldap-auth): stop returning bind password on GET by [@​victorvhs017](https://github.com/victorvhs017) in [#​7873](Infisical/infisical#7873) - fix(pki): clear NULL extended key usage elements on certificates by [@​claude](https://github.com/claude)\[bot] in [#​7900](Infisical/infisical#7900) - chore(docker): refresh stale libssl pin and slim the runtime image by [@​Vligai](https://github.com/Vligai) in [#​7905](Infisical/infisical#7905) - fix: resolved multi line yaml pasting issue by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7920](Infisical/infisical#7920) - chore: storybook preview by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7914](Infisical/infisical#7914) - feat: add helper text for digicert profiles during issuance by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7911](Infisical/infisical#7911) - fix(webhook): render the test event for the webhook's type by [@​lobocv](https://github.com/lobocv) in [#​7893](Infisical/infisical#7893) - improvement(integrations): move integrations page header and tabs to v3 by [@​claude](https://github.com/claude)\[bot] in [#​7909](Infisical/infisical#7909) - feature(ui): add generic v3 loader component and migrate branded loader call sites by [@​claude](https://github.com/claude)\[bot] in [#​7895](Infisical/infisical#7895) - improvement: refactor cert profile policy creation to be inline by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7908](Infisical/infisical#7908) - chore: comment storybook preview links by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7925](Infisical/infisical#7925) - chore(docker): drop the source tree and recommended packages from the image by [@​Vligai](https://github.com/Vligai) in [#​7917](Infisical/infisical#7917) - fix(ui): read the real reduced-motion preference in v3 Loader by [@​claude](https://github.com/claude)\[bot] in [#​7927](Infisical/infisical#7927) **Full Changelog**: <Infisical/infisical@v0.164.1...v0.165.1> ### [`v0.164.1`](https://github.com/Infisical/infisical/releases/tag/v0.164.1) [Compare Source](Infisical/infisical@v0.164.0...v0.164.1) #### What's Changed - feat: add validation rules for LDAP, SQL and linux by [@​mathnogueira](https://github.com/mathnogueira) in [#​7568](Infisical/infisical#7568) - docs(cli): add note about --recursive by [@​adkah](https://github.com/adkah) in [#​7832](Infisical/infisical#7832) - chore: add upgrade impact for v0.164.0 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7829](Infisical/infisical#7829) - feature(helm): require config.siteUrl in infisical-nkp chart by [@​0xArshdeep](https://github.com/0xArshdeep) in [#​7834](Infisical/infisical#7834) - feat(pam): postgres account discovery by [@​x032205](https://github.com/x032205) in [#​7790](Infisical/infisical#7790) - docs(style): add custom vale ci check by [@​adkah](https://github.com/adkah) in [#​7835](Infisical/infisical#7835) - feat(gateway-pools): load balancing by [@​bernie-g](https://github.com/bernie-g) in [#​7703](Infisical/infisical#7703) - fix: resolve provisioning identifiers through SSO user aliases by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7827](Infisical/infisical#7827) - feat(dynamic-secrets): migrate identity and access provider forms by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7569](Infisical/infisical#7569) - chore(secrets): remove deprecated IP allowlist frontend by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7799](Infisical/infisical#7799) - feat(dynamic-secrets): migrate data-service and protocol provider forms by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7574](Infisical/infisical#7574) - improvement(auth): harden signup and account recovery email dispatch by [@​victorvhs017](https://github.com/victorvhs017) in [#​7833](Infisical/infisical#7833) **Full Changelog**: <Infisical/infisical@v0.164.0...v0.164.1> ### [`v0.164.0`](https://github.com/Infisical/infisical/releases/tag/v0.164.0) [Compare Source](Infisical/infisical@v0.163.0...v0.164.0) #### What's Changed - fix(pam): show orphan sessions to product admins by [@​x032205](https://github.com/x032205) in [#​7811](Infisical/infisical#7811) - feat: allow creation of cert profiles from inside applications by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7768](Infisical/infisical#7768) - chore: add upgrade impact for v0.163.0 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7825](Infisical/infisical#7825) - fix(pam): send cancellation signal to gateway when a session expires by [@​x032205](https://github.com/x032205) in [#​7813](Infisical/infisical#7813) - improvement(ui): migrate email service setup modal to v3 Dialog by [@​claude](https://github.com/claude)\[bot] in [#​7807](Infisical/infisical#7807) - improvement(settings): gate cross-project sharing actions by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7746](Infisical/infisical#7746) - feat(encryption): implement root encryption key rotation by [@​victorvhs017](https://github.com/victorvhs017) in [#​7744](Infisical/infisical#7744) - fix(ui): restore wheel scrolling in select menus rendered inside dialogs by [@​claude](https://github.com/claude)\[bot] in [#​7819](Infisical/infisical#7819) **Full Changelog**: <Infisical/infisical@v0.163.0...v0.164.0> ### [`v0.163.0`](https://github.com/Infisical/infisical/releases/tag/v0.163.0) [Compare Source](Infisical/infisical@v0.162.24...v0.163.0) #### What's Changed - feat: allow to edit cert details on manual renewals by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7592](Infisical/infisical#7592) - feat(ui): migrate project roles access control to v3 by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7663](Infisical/infisical#7663) - chore: add upgrade impact for v0.162.23 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7757](Infisical/infisical#7757) - fix: remove redundant toast notifcations when erroring on creating an identity by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7760](Infisical/infisical#7760) - feat(pam): iam auth for postgres by [@​x032205](https://github.com/x032205) in [#​7676](Infisical/infisical#7676) - chore: add upgrade impact for v0.162.24 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​7763](Infisical/infisical#7763) - docs(secrets-mgmt): add more guide links by [@​adkah](https://github.com/adkah) in [#​7767](Infisical/infisical#7767) - feat: first improvement in gc for secrets by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7756](Infisical/infisical#7756) - fix(insights): revive dates to be Date so they are not string by [@​adilsitos](https://github.com/adilsitos) in [#​7773](Infisical/infisical#7773) - feat: allow change policy to apply to machine identities by [@​mathnogueira](https://github.com/mathnogueira) in [#​7540](Infisical/infisical#7540) - improvement: add clock skew handling for gw and relay by [@​sheensantoscapadngan](https://github.com/sheensantoscapadngan) in [#​7575](Infisical/infisical#7575) - docs(self-hosting): add copy button for env vars by [@​adkah](https://github.com/adkah) in [#​7779](https://github.com/Infisical/infisical/pull/7779) - feat(kms): add delete protection for KMS keys by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7771](https://github.com/Infisical/infisical/pull/7771) - docs(vale): fix config and errors by [@​adkah](https://github.com/adkah) in [#​7781](https://github.com/Infisical/infisical/pull/7781) - chore: enforce checking at least one type in a pr description by [@​scott-ray-wilson](https://github.com/scott-ray-wilson) in [#​7764](https://github.com/Infisical/infisical/pull/7764) - docs(secrets-mgmt): fix browser by [@​adkah](https://github.com/adkah) in [#​7782](https://github.com/Infisical/infisical/pull/7782) - fix(gateway-helm): pass positional gateway name for default CLI by [@​victorvhs017](https://github.com/victorvhs017) in [#​7775](https://github.com/Infisical/infisical/pull/7775) - fix(frontend): allow data: URIs in CSP font-src by [@​claude](https://github.com/claude)\[bot] in [#​7681](https://github.com/Infisical/infisical/pull/7681) - feat(dynamic-secrets): migrate relational and warehouse provider forms by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7572](https://github.com/Infisical/infisical/pull/7572) - docs(secrets-mgmt): revert browser fix by [@​adkah](https://github.com/adkah) in [#​7786](https://github.com/Infisical/infisical/pull/7786) - fix(identity-lockout): replace Redis SCAN with sorted-set index for list reads by [@​victorvhs017](https://github.com/victorvhs017) in [#​7777](https://github.com/Infisical/infisical/pull/7777) - fix: honor machine identity auth on org membership endpoints by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7788](https://github.com/Infisical/infisical/pull/7788) - fix(auth): clear stale MFA attempts warning on successful verification by [@​claude](https://github.com/claude)\[bot] in [#​7791](https://github.com/Infisical/infisical/pull/7791) - feat(frontend): identify new accounts in PostHog at signup completion by [@​claude](https://github.com/claude)\[bot] in [#​7787](https://github.com/Infisical/infisical/pull/7787) - feat(pam): dedicated folder views by [@​x032205](https://github.com/x032205) in [#​7769](https://github.com/Infisical/infisical/pull/7769) - fix(project-cleanup): batch-delete secret tree and index FK columns by [@​victorvhs017](https://github.com/victorvhs017) in [#​7796](https://github.com/Infisical/infisical/pull/7796) - feat(telemetry): make team invite a queryable signup source by [@​claude](https://github.com/claude)\[bot] in [#​7789](https://github.com/Infisical/infisical/pull/7789) - improvement(secrets): migrate create secret flow to v3 by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7730](https://github.com/Infisical/infisical/pull/7730) - docs(certificate-mgmt): revamp microsoft intune guide by [@​adkah](https://github.com/adkah) in [#​7766](https://github.com/Infisical/infisical/pull/7766) - docs(style): fix padding at bottom of pages by [@​adkah](https://github.com/adkah) in [#​7806](https://github.com/Infisical/infisical/pull/7806) - feat(settings): add project tag editing by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7750](https://github.com/Infisical/infisical/pull/7750) - feat: brought back the cleanup for license server by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7761](https://github.com/Infisical/infisical/pull/7761) - docs(secrets-mgmt): add local dev guide by [@​adkah](https://github.com/adkah) in [#​7802](https://github.com/Infisical/infisical/pull/7802) - feat: show renewed certificates as Renewed by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7784](https://github.com/Infisical/infisical/pull/7784) - fix: resolved dev server reloading by [@​akhilmhdh](https://github.com/akhilmhdh) in [#​7772](https://github.com/Infisical/infisical/pull/7772) - improvement(secrets): unify overview navigation and query state by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7738](https://github.com/Infisical/infisical/pull/7738) - feat: add RFC 8693 token exchange grant by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7759](https://github.com/Infisical/infisical/pull/7759) - feat(dynamic-secrets): migrate managed-store provider forms by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7573](https://github.com/Infisical/infisical/pull/7573) - fix: add multi arch images on dev env by [@​Thiago-AS](https://github.com/Thiago-AS) in [#​7816](https://github.com/Infisical/infisical/pull/7816) - fix(auth): hide initial signup progress by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7783](https://github.com/Infisical/infisical/pull/7783) - fix(api): allow machine identities on approval policy routes by [@​saifsmailbox98](https://github.com/saifsmailbox98) in [#​7755](https://github.com/Infisical/infisical/pull/7755) - fix(cert-manager): evaluate application permissions consistently across actor types by [@​carlosmonastyrski](https://github.com/carlosmonastyrski) in [#​7778](https://github.com/Infisical/infisical/pull/7778) - fix(ui): prevent concurrent environment mutations by [@​andrewhuhh](https://github.com/andrewhuhh) in [#​7751](https://github.com/Infisical/infisical/pull/7751) - improvement(admin): remove unused SAML/OIDC trust-email toggles and wire LDAP trust by [@​victorvhs017](https://github.com/victorvhs017) in [#​7792](https://github.com/Infisical/infisical/pull/7792) **Full Changelog**: <Infisical/infisical@v0.162.24...v0.163.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS42IiwidXBkYXRlZEluVmVyIjoiNDQuNjEuNiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsibWlub3IiLCJyZW5vdmF0ZSJdfQ==--> Reviewed-on: https://gitea.vcasaserver.com/omar/swarm/pulls/821 Co-authored-by: Renovate Bot <renovate-bot@vcasaserver.com>
Context
When Redis has no cached response, several secret references can try to load the same folder at once. Previously, each could start its own database read before the in-memory cache was ready.
This change lets those references wait for one shared folder load, then reuse its result. This reduces duplicate database reads and memory used while resolving references within the same expander. Redis caching stays the same.
Steps to verify the change
I added a test that resolves 50 references to the same folder and checks that it is read only once. It fails on the old code and passes with this fix. Lint passes for the changed files.
Type