robusta-api 0.47.0__tar.gz → 0.48.0__tar.gz

{robusta_api-0.47.0 → robusta_api-0.48.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: robusta-api
-Version: 0.47.0
+Version: 0.48.0
 Summary: 
 Author: Arik Alon
 Author-email: arikalon1@users.noreply.github.com
@@ -9,8 +9,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Provides-Extra: all
-Requires-Dist: CairoSVG (>=2.5.2,<3.0.0) ; extra == "all"
-Requires-Dist: Flask (>=3.0.0,<4.0.0) ; extra == "all"
+Requires-Dist: Flask (>=3.1.3,<4.0.0) ; extra == "all"
 Requires-Dist: apprise (==1.6.0)
 Requires-Dist: attrs (>=23.1.0,<24.0.0)
 Requires-Dist: better-exceptions (>=0.3.3,<0.4.0) ; extra == "all"
@@ -21,12 +20,11 @@ Requires-Dist: certifi (>=2026.4.22)
 Requires-Dist: click (>=8.3.3)
 Requires-Dist: colorlog (>=5.0.1,<6.0.0)
 Requires-Dist: croniter (>=1.3.15,<2.0.0)
-Requires-Dist: cryptography (>=48.0.1,<49.0.0)
+Requires-Dist: cryptography (>=50.0.0,<51.0.0)
 Requires-Dist: datadog-api-client (>=1.2.0,<2.0.0) ; extra == "all"
 Requires-Dist: docutils (==0.19)
 Requires-Dist: dpath (>=2.0.5,<3.0.0)
 Requires-Dist: filelock (>=3.20.3)
-Requires-Dist: fpdf2 (>=2.7.1,<3.0.0)
 Requires-Dist: grafana-api (>=1.0.3,<2.0.0) ; extra == "all"
 Requires-Dist: h2 (>=4.3.0,<5.0.0)
 Requires-Dist: hikaru-model-26 (>=1.1.1,<2.0.0)
@@ -54,13 +52,16 @@ Requires-Dist: python-json-logger (>=3.0.0,<4.0.0)
 Requires-Dist: pytz (>=2021.3,<2022.0)
 Requires-Dist: pyyaml (>=6.0,<7.0)
 Requires-Dist: regex (==2024.5.15)
+Requires-Dist: reportlab (>=5.0.0,<6.0.0)
 Requires-Dist: requests (>=2.33.0,<3.0.0)
+Requires-Dist: resvg-py (==0.3.4)
 Requires-Dist: rocketchat-api (>=1.30.0,<2.0.0)
 Requires-Dist: sentry-sdk[flask] (>=2.13.0,<3.0.0) ; extra == "all"
 Requires-Dist: setuptools (>=80.9.0,<81.0.0)
 Requires-Dist: slack-sdk (>=3.23.0,<4.0.0)
 Requires-Dist: supabase (==2.5.1) ; extra == "all"
 Requires-Dist: tabulate (>=0.8.10,<0.9.0) ; extra == "all"
+Requires-Dist: tenacity (>=9.1.2,<10.0.0)
 Requires-Dist: toml (>=0.10.2,<0.11.0)
 Requires-Dist: urllib3 (>=2.7.0,<3.0.0)
 Requires-Dist: virtualenv (>=20.36.1,<21.0.0)

{robusta_api-0.47.0 → robusta_api-0.48.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "robusta-api"
-version = "0.47.0"
+version = "0.48.0"
 description = ""
 authors = ["Arik Alon <arikalon1@users.noreply.github.com>"]
 packages = [
@@ -30,13 +30,17 @@ idna= { version = ">=3.15", optional = true }
 supabase = "2.5.1"
 tabulate = { version = "^0.8.10" }
 slack-sdk = { version = "^3.23.0" }
-Flask = { version = "^3.0.0", optional = true }
+Flask = { version = "^3.1.3", optional = true }
 werkzeug = { version = ">=3.1.6", optional = true }
 jinja2 = { version = ">=3.1.5", optional = true }
 grafana-api = { version = "^1.0.3", optional = true }
 watchdog =  { version = "^2.1.0", optional = true }
 better-exceptions = { version =  "^0.3.3", optional = true }
-CairoSVG = { version = "^2.5.2", optional = true }
+# SVG -> PNG rasterizer for charts sent to chat sinks (resvg is Apache-2.0 OR MIT,
+# bindings are MIT; replaced LGPL-licensed CairoSVG)
+# Pinned to an exact version for supply-chain safety since the binding package
+# has a small maintainer base (see PR #2136 review)
+resvg-py = "0.3.4"
 # Bump to fix CVE-2026-10142, CVE-2026-10143 (High): kafka-python protocol-parser DoS
 kafka-python = { version = "^2.3.2", optional = true }
 datadog-api-client = { version = "^1.2.0", optional = true }
@@ -60,10 +64,12 @@ humanize = "^3.13.1"
 # we're freezing a specific version here because the latest version doesn't have prebuilt wheels on pypi
 # and therefore requires gcc to install which we'd like to avoid
 # this is similar to the issue at https://github.com/dulwich/dulwich/issues/839
+# Pin to fix CVE-2026-69247 (High): cryptography Bleichenbacher oracle in PKCS#7 decryption
 # Pin to fix CVE-2026-39892 (Critical): cryptography buffer overflow with non-contiguous buffers
 # Pin to fix GHSA-537c-gmf6-5ccf (High): cryptography
-cryptography = "^48.0.1"
-fpdf2 = "^2.7.1"
+cryptography = "^50.0.0"
+# PDF renderer for KRR/Popeye scan reports (BSD-3-Clause; replaced LGPL-licensed fpdf2)
+reportlab = "^5.0.0"
 attrs = "^23.1.0"
 prometrix = "0.2.11"
 hikaru-model-26 = "^1.1.1"
@@ -92,13 +98,16 @@ pyasn1 = ">=0.6.4"
 filelock = ">=3.20.3"
 # Pin to fix CVE-2026-22702 (transitive via pre-commit)
 virtualenv = "^20.36.1"
-# Pillow is pulled in transitively (fpdf2, CairoSVG). Pin to fix CVE-2026-54058,
+# Pillow is used directly (MS Teams PNG->JPEG image conversion) and by reportlab.
+# Pin to fix CVE-2026-54058,
 # CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197,
 # CVE-2026-59199, CVE-2026-59200, CVE-2026-59204, CVE-2026-59205 (High)
 pillow = "^12.3.0"
 # click is pulled in transitively (flask, typer). Pin to fix CVE-2026-7246 (High):
 # command injection via unsanitized filename in click.edit()
 click = ">=8.3.3"
+# Used directly for the Supabase login retry (ROB-1228); was only transitive via opsgenie-sdk
+tenacity = "^9.1.2"
 
 [tool.poetry.dev-dependencies]
 pre-commit = "^2.13.0"
@@ -138,7 +147,7 @@ types-toml = "^0.10.2"
 types-tabulate = "^0.8.10"
 
 [tool.poetry.extras]
-all = ["Flask", "grafana-api", "watchdog", "better-exceptions", "CairoSVG", "tabulate", "kafka-python", "prometheus-api-client", "supabase", "datadog-api-client", "sentry-sdk", "poetry-core"]
+all = ["Flask", "grafana-api", "watchdog", "better-exceptions", "tabulate", "kafka-python", "prometheus-api-client", "supabase", "datadog-api-client", "sentry-sdk", "poetry-core"]
 
 [tool.poetry.group.dev.dependencies]
 sphinx-jinja = { git = "https://github.com/robusta-dev/sphinx-jinja.git" }

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/_version.py

@@ -1,2 +1,2 @@
 # this is updated by .github/workflows/release.yaml
-__version__ = "0.47.0"
+__version__ = "0.48.0"

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/core/discovery/discovery.py

@@ -897,12 +897,13 @@ def extract_containers_k8(resource) -> List[Container]:
 
 
 def is_pod_ready(pod) -> bool:
+    # Unset until kubelet reports on the pod.
     conditions = []
     if isinstance(pod, V1Pod):
-        conditions = pod.status.conditions
+        conditions = getattr(pod.status, "conditions", None) or []
 
     if isinstance(pod, Pod):
-        conditions = pod.status.conditions
+        conditions = getattr(pod.status, "conditions", None) or []
 
     for condition in conditions:
         if condition.type == "Ready":

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/core/model/env_vars.py

@@ -28,6 +28,14 @@ DISCOVERY_CHECK_THRESHOLD_SEC = int(os.environ.get("DISCOVERY_CHECK_THRESHOLD_SE
 DISCOVERY_PROCESS_TIMEOUT_SEC = int(os.environ.get("DISCOVERY_PROCESS_TIMEOUT_SEC", 60 * 120))  # 120 min
 DISCOVERY_WATCHDOG_CHECK_SEC = int(os.environ.get("DISCOVERY_WATCHDOG_CHECK_SEC", 15 * 120))  # 15 min
 SUPABASE_TIMEOUT_SECONDS = int(os.environ.get("SUPABASE_TIMEOUT_SECONDS", 60))
+# Transient network failures on the Supabase login used to kill the runner (ROB-1228).
+SUPABASE_LOGIN_RETRIES = int(os.environ.get("SUPABASE_LOGIN_RETRIES", 4))
+SUPABASE_LOGIN_RETRY_BACKOFF_SEC = float(os.environ.get("SUPABASE_LOGIN_RETRY_BACKOFF_SEC", 2))
+SUPABASE_LOGIN_RETRY_MAX_BACKOFF_SEC = float(os.environ.get("SUPABASE_LOGIN_RETRY_MAX_BACKOFF_SEC", 30))
+# A TCP handshake that has not completed in this many seconds is not going to. Capped
+# separately from SUPABASE_TIMEOUT_SECONDS so an unreachable platform fails (and retries)
+# promptly instead of parking every attempt on the full read budget.
+SUPABASE_CONNECT_TIMEOUT_SECONDS = float(os.environ.get("SUPABASE_CONNECT_TIMEOUT_SECONDS", 10))
 GRAFANA_RENDERER_URL = os.environ.get("GRAFANA_RENDERER_URL", "http://127.0.0.1:8281/render")
 RESOURCE_UPDATES_CACHE_TTL_SEC = os.environ.get("RESOURCE_UPDATES_CACHE_TTL_SEC", 120)
 INTERNAL_PLAYBOOKS_ROOT = os.environ.get("INTERNAL_PLAYBOOKS_ROOT", "/app/src/robusta/core/playbooks/internal")

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/core/reporting/utils.py

@@ -21,12 +21,12 @@ def is_image(file_name: str):
 
 
 def convert_svg_to_png(svg: bytes) -> Optional[bytes]:
-    # we import cairosvg here and not globally because in some environments it isn't trivially installed (e.g. windows)
-    # and we don't want to throw an exception globally when it isn't around
-    import cairosvg
+    # we import resvg_py here and not globally so the rasterizer is only loaded on
+    # the SVG-conversion path, and environments without it can still import this module
+    import resvg_py
 
     try:
-        return cairosvg.svg2png(bytestring=svg)
+        return resvg_py.svg_to_bytes(svg_string=svg.decode("utf-8"))
     except Exception:
         logging.error(f"error converting svg to png; svg={svg}")
         return None

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/core/sinks/mail/mail_sink.py

@@ -10,10 +10,10 @@ class MailSink(SinkBase):
         params = sink_config.mail_sink
 
         self.sender = MailSender(
-            params.mailto,
-            self.signing_key,
-            self.account_id,
-            self.cluster_name,
+            mailto=params.mailto,
+            account_id=self.account_id,
+            cluster_name=self.cluster_name,
+            signing_key=self.signing_key,
             use_ses=params.use_ses,
             aws_region=params.aws_region,
             from_email=params.from_email,

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/core/sinks/robusta/dal/supabase_dal.py

@@ -7,7 +7,9 @@ import threading
 from typing import Any, Dict, List, Optional, Tuple
 from uuid import uuid4
 from cachetools import TTLCache
+import httpx
 import requests
+from gotrue.errors import AuthRetryableError
 from postgrest._sync.request_builder import SyncQueryRequestBuilder
 from postgrest.base_request_builder import BaseFilterRequestBuilder, QueryArgs
 from postgrest.exceptions import APIError as PostgrestAPIError
@@ -15,10 +17,17 @@ from postgrest.types import ReturnMethod
 from postgrest.utils import sanitize_param
 from supabase import create_client
 from supabase.lib.client_options import ClientOptions
+from tenacity import RetryCallState, Retrying, retry_if_exception_type, stop_after_attempt, wait_exponential
 
 from robusta.core.model.cluster_status import ClusterStatus
 from robusta.core.exceptions import SupabaseDnsException
-from robusta.core.model.env_vars import SUPABASE_TIMEOUT_SECONDS
+from robusta.core.model.env_vars import (
+    SUPABASE_CONNECT_TIMEOUT_SECONDS,
+    SUPABASE_LOGIN_RETRIES,
+    SUPABASE_LOGIN_RETRY_BACKOFF_SEC,
+    SUPABASE_LOGIN_RETRY_MAX_BACKOFF_SEC,
+    SUPABASE_TIMEOUT_SECONDS,
+)
 from robusta.core.model.helm_release import HelmRelease
 from robusta.core.model.jobs import JobInfo
 from robusta.core.model.namespaces import NamespaceInfo
@@ -69,6 +78,17 @@ def pre_select_patched(*args, **kwargs) -> QueryArgs:
 supabase_request_builder.pre_select = pre_select_patched
 
 
+class _AuthHttpClient(httpx.Client):
+    """The httpx client we hand to Supabase's auth (GoTrue) sub-client.
+
+    Mirrors ``gotrue.http_clients.SyncClient``, whose only addition over ``httpx.Client``
+    is the ``aclose()`` alias that GoTrue's ``close()`` calls.
+    """
+
+    def aclose(self) -> None:
+        self.close()
+
+
 class SupabaseDal(AccountResourceFetcher):
     def __init__(
         self,
@@ -92,6 +112,7 @@ class SupabaseDal(AccountResourceFetcher):
         self.cluster = cluster_name
         options = ClientOptions(postgrest_client_timeout=SUPABASE_TIMEOUT_SECONDS, auto_refresh_token=True)
         self.client = create_client(url, key, options)
+        self.__apply_auth_client_timeout()
         self.patch_postgrest_execute()
         self.email = email
         self.password = password
@@ -104,6 +125,53 @@ class SupabaseDal(AccountResourceFetcher):
         self.token_cache = TTLCache(maxsize=1, ttl=ttl)
         self.lock = threading.Lock()
 
+    def __apply_auth_client_timeout(self) -> None:
+        """Give the auth (GoTrue) client the configured timeout, over HTTP/1.1.
+
+        ``ClientOptions.postgrest_client_timeout`` only reaches postgrest. supabase 2.5.1
+        builds the auth client with neither a timeout nor an http client of its own, so
+        logins ran on httpx's 5s default - and because ``socket.create_connection`` applies
+        the connect timeout once per resolved address, a dual-stack host gave up after ~10s
+        no matter what SUPABASE_TIMEOUT_SECONDS said (ROB-1228). supabase only grew a
+        supported hook for this in 2.28 (``ClientOptions(httpx_client=...)``), so until we
+        bump, replace the client on the instance.
+
+        Connect is capped below the read budget (SUPABASE_CONNECT_TIMEOUT_SECONDS): with a
+        60s flat timeout, every attempt against a firewalled platform parks for a full
+        minute before the retry, so the actionable error takes minutes to appear.
+
+        HTTP/2 is dropped at the same time: httpcore's sync HTTP/2 connection is not thread
+        safe, and this DAL is shared across threads (the same problem as ROB-228). No
+        transport is passed, so environment proxies keep being honored as before.
+        """
+        auth_client = self.client.auth
+        http_client = _AuthHttpClient(
+            timeout=httpx.Timeout(
+                SUPABASE_TIMEOUT_SECONDS,
+                connect=min(SUPABASE_CONNECT_TIMEOUT_SECONDS, SUPABASE_TIMEOUT_SECONDS),
+            ),
+            follow_redirects=True,
+            http2=False,
+        )
+        try:
+            previous = auth_client._http_client
+            # the admin sub-API was handed the original client at construction time
+            admin = auth_client.admin
+        except AttributeError:
+            # A supabase/gotrue bump moved the internals. Keep their default client rather
+            # than failing startup over it, but say so: auth calls stay on httpx defaults.
+            http_client.close()
+            logging.warning(
+                "Could not apply SUPABASE_TIMEOUT_SECONDS to the Supabase auth client - its internals changed. "
+                "Auth calls will use the httpx default timeout.",
+                exc_info=True,
+            )
+            return
+
+        auth_client._http_client = http_client
+        admin._http_client = http_client
+        previous.close()
+
     def patch_postgrest_execute(self):
         # This is somewhat hacky.
         def execute_with_retry(_self):
@@ -553,13 +621,46 @@ class SupabaseDal(AccountResourceFetcher):
             logging.error(f"Failed to persist helm_releases {helm_releases} error: {e}")
             raise
 
+    def __sign_in_once(self) -> str:
+        res = self.client.auth.sign_in_with_password({"email": self.email, "password": self.password})
+        self.client.auth.set_session(res.session.access_token, res.session.refresh_token)
+        self.client.postgrest.auth(res.session.access_token)
+        return res.user.id
+
+    @staticmethod
+    def __log_sign_in_retry(retry_state: RetryCallState) -> None:
+        logging.warning(
+            "Supabase login attempt %s/%s failed: %s. Retrying in %.1fs",
+            retry_state.attempt_number,
+            SUPABASE_LOGIN_RETRIES,
+            retry_state.outcome.exception() if retry_state.outcome else "unknown error",
+            retry_state.next_action.sleep if retry_state.next_action else 0,
+        )
+
     def sign_in(self) -> str:
+        """Log in to Supabase, retrying transient network failures.
+
+        A single failure here used to be fatal: it propagates out of ``__init__`` through
+        Robusta sink construction up to ConfigLoader, which kills the whole runner process
+        group - so one connect timeout at pod start put the runner into CrashLoopBackOff,
+        with no in-process recovery path (ROB-1228). GoTrue labels these errors "retryable"
+        (``AuthRetryableError``); honor that instead of dying. DNS failures are retried too:
+        cluster DNS is often not ready yet at the moment the runner starts. A wrong
+        password or any other 4xx is an ``AuthApiError``, so it still fails immediately.
+        """
         logging.info("Supabase dal login")
         try:
-            res = self.client.auth.sign_in_with_password({"email": self.email, "password": self.password})
-            self.client.auth.set_session(res.session.access_token, res.session.refresh_token)
-            self.client.postgrest.auth(res.session.access_token)
-            return res.user.id
+            login = Retrying(
+                stop=stop_after_attempt(max(1, SUPABASE_LOGIN_RETRIES)),
+                wait=wait_exponential(
+                    multiplier=SUPABASE_LOGIN_RETRY_BACKOFF_SEC,
+                    max=SUPABASE_LOGIN_RETRY_MAX_BACKOFF_SEC,
+                ),
+                retry=retry_if_exception_type((AuthRetryableError, httpx.TransportError)),
+                before_sleep=self.__log_sign_in_retry,
+                reraise=True,
+            )
+            return login(self.__sign_in_once)
         except Exception as e:
             # Check if this is a DNS-related error
             error_msg = str(e).lower()

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/core/sinks/transformer.py

@@ -4,8 +4,6 @@ import urllib.parse
 from typing import List, Optional, Union
 
 import markdown2
-from fpdf import FPDF
-from fpdf.fonts import FontFace
 
 try:
     from tabulate import tabulate
@@ -233,67 +231,106 @@ class Transformer:
         if not isinstance(block, ScanReportBlock):
             return block
 
-        accent_color = (140, 249, 209)
-        headers_color = (63, 63, 63)
-        table_color = (207, 215, 216)
-
-        def set_normal_test_style(pdf: FPDF):
-            pdf.set_font("", "", 8)
-            pdf.set_text_color(0, 0, 0)
-
-        def write_report_header(title: str, end_time, score: Union[int, str], grade: str):
-            pdf.cell(pdf.w * 0.7, 10, f"**{title}** {end_time.strftime('%b %d, %y %X')}", border=0, markdown=True)
-            if int(score) >= 0:
-                pdf.cell(pdf.w * 0.3, 10, f"**{grade}** {score}", border=0, markdown=True)
-
-            pdf.ln(20)
-
-        def write_section_header(pdf: FPDF, header: str):
-            if pdf.will_page_break(50):
-                pdf.add_page()
-
-            pdf.ln(12)
-            pdf.set_font("", "B", 12)
-            pdf.set_text_color(headers_color)
-            pdf.cell(txt=header, border=0)
-            pdf.ln(12)
-
-        def write_config(pdf: FPDF, config: str):
-            pdf.set_text_color(accent_color)
-            pdf.cell(txt="config", border=0)
-            pdf.ln(12)
-            set_normal_test_style(pdf)
-            pdf.multi_cell(w=0, txt=config, border=0)
-
-        def write_table(pdf: FPDF, rows: List[list[str]]):
-            pdf.set_draw_color(table_color)
-            set_normal_test_style(pdf)
-            with pdf.table(
-                borders_layout="INTERNAL",
-                rows=rows,
-                headings_style=FontFace(color=(headers_color)),
-                col_widths=scan.table_widths,
-                markdown=True,
-                line_height=1.5 * pdf.font_size,
-            ):
-                pass
+        # reportlab is imported lazily so the PDF toolchain is only required on the
+        # scan-report path, not for merely importing the sink layer
+        from io import BytesIO
+
+        from reportlab.lib import colors
+        from reportlab.lib.pagesizes import A4, landscape
+        from reportlab.lib.styles import ParagraphStyle
+        from reportlab.platypus import Paragraph, SimpleDocTemplate, Spacer, Table, TableStyle
+
+        accent_color = colors.Color(140 / 255, 249 / 255, 209 / 255)
+        headers_color = colors.Color(63 / 255, 63 / 255, 63 / 255)
+        table_color = colors.Color(207 / 255, 215 / 255, 216 / 255)
+
+        title_style = ParagraphStyle("scan-title", fontName="Courier", fontSize=18, leading=22)
+        config_label_style = ParagraphStyle(
+            "scan-config-label", fontName="Courier", fontSize=18, leading=22, textColor=accent_color
+        )
+        section_style = ParagraphStyle(
+            "scan-section", fontName="Courier-Bold", fontSize=12, leading=14, textColor=headers_color
+        )
+        normal_style = ParagraphStyle("scan-normal", fontName="Courier", fontSize=8, leading=12)
+        heading_cell_style = ParagraphStyle(
+            "scan-heading-cell", fontName="Courier", fontSize=8, leading=12, textColor=headers_color
+        )
+
+        def cell_markup(text) -> str:
+            """Escape a table cell and translate the markdown supported in scan cells
+            (**bold** and newlines) to paragraph markup."""
+            escaped = str(text).replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
+            bolded = re.sub(r"\*\*(.+?)\*\*", r"<b>\1</b>", escaped, flags=re.DOTALL)
+            return bolded.replace("\n", "<br/>")
 
         scan: ScanReportBlock = block
         scan_headers = scan.table_headers
         scan_data = scan.table_data
-        pdf = FPDF(orientation="landscape", format="A4")
-        pdf.add_page()
-        pdf.set_font("courier", "", 18)
-        pdf.set_line_width(0.1)
-        pdf.c_margin = 2  # create default cell margin to add table "padding"
-
         title = f"{scan.type.capitalize()} report"
-        write_report_header(title, scan.end_time, scan.score, scan.grade)
-        write_config(pdf, scan.config)
 
-        for section_name, section_data in scan_data.items():
-            rows = [scan_headers, *section_data]
-            write_section_header(pdf, section_name)
-            write_table(pdf, rows)
+        story = []
+
+        header_cells = [Paragraph(f"<b>{cell_markup(title)}</b> {scan.end_time.strftime('%b %d, %y %X')}", title_style)]
+        header_widths = [0.7]
+        try:
+            # scan.grade also parses the score, so it must stay inside this guard
+            if int(scan.score) >= 0:
+                header_cells.append(Paragraph(f"<b>{scan.grade}</b> {scan.score}", title_style))
+                header_widths.append(0.3)
+        except (TypeError, ValueError):
+            logging.warning(f"scan report has a non-integer score {scan.score!r}; skipping the score badge")
+
+        page_width, _ = landscape(A4)
+        margin = 28  # ~10mm, matching the previous layout
+        content_width = page_width - 2 * margin
+        story.append(Table([header_cells], colWidths=[w * content_width for w in header_widths]))
+        story.append(Spacer(1, 20))
+
+        story.append(Paragraph("config", config_label_style))
+        story.append(Spacer(1, 6))
+        story.append(Paragraph(cell_markup(scan.config), normal_style))
 
-        return FileBlock(f"{title}.pdf", pdf.output())
+        for section_name, section_data in scan_data.items():
+            story.append(Spacer(1, 12))
+            story.append(Paragraph(cell_markup(section_name), section_style))
+            story.append(Spacer(1, 6))
+
+            heading_row = [Paragraph(cell_markup(header), heading_cell_style) for header in scan_headers]
+            body_rows = [
+                [Paragraph(cell_markup(cell), normal_style) for cell in row] for row in section_data
+            ]
+            width_total = sum(scan.table_widths)
+            column_widths = [w / width_total * content_width for w in scan.table_widths]
+            # splitInRow lets a single row taller than the page (e.g. a Popeye resource
+            # with very many issues in one cell) split across pages instead of raising
+            table = Table(
+                [heading_row, *body_rows],
+                colWidths=column_widths,
+                repeatRows=1,
+                splitByRow=1,
+                splitInRow=1,
+            )
+            table.setStyle(
+                TableStyle(
+                    [
+                        ("INNERGRID", (0, 0), (-1, -1), 0.3, table_color),
+                        ("VALIGN", (0, 0), (-1, -1), "TOP"),
+                        ("LEFTPADDING", (0, 0), (-1, -1), 6),
+                        ("RIGHTPADDING", (0, 0), (-1, -1), 6),
+                    ]
+                )
+            )
+            story.append(table)
+
+        buffer = BytesIO()
+        doc = SimpleDocTemplate(
+            buffer,
+            pagesize=landscape(A4),
+            leftMargin=margin,
+            rightMargin=margin,
+            topMargin=margin,
+            bottomMargin=margin,
+            title=title,
+        )
+        doc.build(story)
+        return FileBlock(f"{title}.pdf", buffer.getvalue())

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/integrations/mail/sender.py

@@ -23,8 +23,12 @@ from robusta.core.sinks.transformer import Transformer
 
 
 class MailSender(HTMLBaseSender):
+    # Keyword-only: account_id, cluster_name and signing_key are all plain strings, so a
+    # positional call that gets their order wrong silently puts the signing key into the
+    # `account` query parameter of the platform links we email out.
     def __init__(
         self,
+        *,
         mailto: str,
         account_id: str,
         cluster_name: str,

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/integrations/msteams/msteams_adaptive_card_files_image.py

@@ -5,7 +5,7 @@ import uuid
 from typing import List
 
 from robusta.core.reporting.blocks import FileBlock
-from robusta.core.reporting.utils import JPG_SUFFIX, PNG_SUFFIX, file_suffix_match, is_image
+from robusta.core.reporting.utils import JPG_SUFFIX, PNG_SUFFIX, convert_svg_to_png, file_suffix_match, is_image
 from robusta.integrations.msteams.msteams_elements.msteams_images import MsTeamsImages
 
 
@@ -64,6 +64,7 @@ class MsTeamsAdaptiveCardFilesImage:
     # msteams cant read parsing of url to svg image
     @classmethod
     def __svg_convert_bytes_to_jpg(cls, svg_bytes: bytes):
-        from cairosvg import svg2png
-
-        return cls.__png_convert_bytes_to_base_64_url(svg2png(bytestring=svg_bytes))
+        png_bytes = convert_svg_to_png(svg_bytes)
+        if png_bytes is None:
+            raise ValueError("failed to convert svg to png for msteams image")
+        return cls.__png_convert_bytes_to_base_64_url(png_bytes)

{robusta_api-0.47.0 → robusta_api-0.48.0}/src/robusta/runner/config_loader.py

@@ -41,6 +41,7 @@ from robusta.integrations.scheduled.playbook_scheduler_manager_impl import Playb
 from robusta.integrations.scheduled.trigger import ScheduledTriggerEvent
 from robusta.model.config import PlaybooksRegistry, PlaybooksRegistryImpl, Registry, SinksRegistry
 from robusta.model.playbook_definition import PlaybookDefinition
+from robusta.utils.archive import safe_extract_tar
 from robusta.utils.cluster_provider_discovery import cluster_provider
 from robusta.utils.file_system_watcher import FileSystemWatcher
 from robusta.core.exceptions import SupabaseDnsException
@@ -354,7 +355,7 @@ class ConfigLoader:
             f.flush()
 
             with tarfile.open(f.name, "r:gz") as tar, tempfile.TemporaryDirectory() as temp_dir:
-                tar.extractall(path=temp_dir)
+                safe_extract_tar(tar, temp_dir)
                 extracted_items = os.listdir(temp_dir)
 
                 pkg_path = temp_dir

robusta_api-0.48.0/src/robusta/utils/archive.py

@@ -0,0 +1,54 @@
+import os
+import tarfile
+from typing import List
+
+
+class UnsafeArchiveError(Exception):
+    """Raised when a tar archive contains a member that would be extracted outside the target directory."""
+
+
+def _is_within(directory: str, target: str) -> bool:
+    directory = os.path.realpath(directory)
+    target = os.path.realpath(target)
+    return target == directory or target.startswith(directory + os.sep)
+
+
+def _validate_members(tar: tarfile.TarFile, path: str) -> List[tarfile.TarInfo]:
+    members = tar.getmembers()
+    for member in members:
+        if member.isdev():
+            raise UnsafeArchiveError(f"Archive contains a device/fifo member: {member.name}")
+
+        if os.path.isabs(member.name) or member.name.startswith("/"):
+            raise UnsafeArchiveError(f"Archive contains a member with an absolute path: {member.name}")
+
+        if not _is_within(path, os.path.join(path, member.name)):
+            raise UnsafeArchiveError(f"Archive contains a member escaping the target directory: {member.name}")
+
+        if member.issym() or member.islnk():
+            # link targets are resolved relative to the directory holding the link
+            link_base = os.path.join(path, os.path.dirname(member.name))
+            if os.path.isabs(member.linkname) or not _is_within(path, os.path.join(link_base, member.linkname)):
+                raise UnsafeArchiveError(
+                    f"Archive contains a link escaping the target directory: {member.name} -> {member.linkname}"
+                )
+
+    return members
+
+
+def safe_extract_tar(tar: tarfile.TarFile, path: str) -> None:
+    """
+    Extract a tar archive into ``path``, refusing archives whose members would be written outside of it.
+
+    Guards against path traversal ("zip slip"), absolute member paths, escaping symlinks/hardlinks and
+    device nodes. Raises ``UnsafeArchiveError`` without extracting anything if the archive is unsafe.
+    """
+    if hasattr(tarfile, "data_filter"):  # python 3.12+, and 3.10.12+/3.11.4+ backports
+        # pre-validate so that nothing is written before an unsafe member is detected
+        _validate_members(tar, path)
+        try:
+            tar.extractall(path=path, filter="data")
+        except tarfile.FilterError as e:
+            raise UnsafeArchiveError(f"Refusing to extract unsafe archive: {e}") from e
+    else:
+        tar.extractall(path=path, members=_validate_members(tar, path))