chore: update changelog CLI v2.40.0, v2.40.1 and Terraform Provider v0.9.4 - #409
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
|
Claude finished @mintlify[bot]'s task in 3m 27s —— View job Doc review —
|
| # | Line | Finding |
|---|---|---|
| 1 | changelog/index.mdx:21 |
The Terraform v0.9.4 entry says expires_at "no longer produces an inconsistent result after apply", but terraform-reference/resources/service_account_api_key.mdx:63 and :96 still document that exact behavior (inconsistent result + tainted resource) as current. That text landed in #407 describing pre-v0.9.4 behavior — one of the two is now stale. |
| 2 | changelog/index.mdx:11 |
"Leaving --expires-at unset uses the maximum allowed lifetime" is true for create api-key but not rotate api-key, which defaults to the rotated key's current expiry (client_reference/kosli_rotate_api-key.md:23, administration/authentication/api_key_rotation.md:14, :21). |
| 3 | changelog/index.mdx:35 |
kosli attest pullrequest-* isn't the command spelling (subcommands are space-separated), and "all" pullrequest commands includes Bitbucket, which the same bullet excludes by naming only GitHub, GitLab, and Azure. Suggestion block posted inline. |
| 4 | changelog/index.mdx:41 |
The breaking config-file change sits under ## Bug fixes with an inline "(breaking)" marker; this changelog's convention is a dedicated ## Breaking changes section (lines 181, 349, 384). "Standard locations" is also vaguer than the help text, which names --config-file / $HOME/.kosli.yml. |
| 5 | changelog/index.mdx:43 |
"Always includes .kosli_ignore" overstates the reference text — --exclude still drops the file from the fingerprint while its entries keep applying (client_reference/kosli_fingerprint.md:49-52). |
Verified clean: all five internal links are root-relative and resolve to existing files listed in config/navigation.json; no new pages, moves or deletions, so no nav or redirect entries are needed; the --jira-trailer, 1 MB payload, snapshot azure ACR-scoping and snapshot s3 unsafe-key claims all match the regenerated reference at v2.40.1 (client_reference/overview.md:7); nothing in the site still tells readers to place kosli.yml in a repo root as CLI config.
No upstream-only findings — every finding is in the hand-authored changelog and fixable in this PR.
Not checked: gh pr checks needs approval in this environment, so I could not read the link-rot / vale-spellcheck statuses; I verified link targets by file existence instead. The x/crypto v0.56.0 / CVE-2026-56855 claim is external to this repo and unverified here.
Advisory review — nothing blocks the merge. Finding 1 is the one worth resolving before this ships, since the changelog and the Terraform reference currently tell readers opposite things about the same release.
· branch mintlify/08eaa7c8
mbevc1
changed the title
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
|
||
| ## Bug fixes | ||
|
|
||
| - **`kosli.yml` no longer loaded from the working directory** (breaking) — the CLI previously loaded configuration from `kosli.yml` in whichever directory it was invoked in, which let a checked-in file in a repository silently change behavior. It now only reads config from the standard locations. Before upgrading, check for `kosli.yml` files at the root of any repository where the CLI runs. |
There was a problem hiding this comment.
Improvement — a breaking change filed under "Bug fixes", and "standard locations" is unactionable
The PR body calls this a "breaking config-file lookup change", and the entry marks it "(breaking)" inline, but this changelog already has a convention for that: a dedicated ## Breaking changes section, used at changelog/index.mdx:181 (CLI v2.37.0), :349 (Terraform v0.9.2) and :384 (CLI v2.35.0). A reader scanning headings — or the RSS feed — will not see this one.
Also, "It now only reads config from the standard locations" doesn't tell an affected reader where config is read from. The generated help is specific: "Config is read from this path or the default only, never implicitly from the current directory. (default $HOME/.kosli.yml)" (client_reference/kosli_create_policy.md:28 and every other command). Naming $HOME/.kosli.yml and --config-file makes the migration checkable.
|
|
||
| - **`kosli.yml` no longer loaded from the working directory** (breaking) — the CLI previously loaded configuration from `kosli.yml` in whichever directory it was invoked in, which let a checked-in file in a repository silently change behavior. It now only reads config from the standard locations. Before upgrading, check for `kosli.yml` files at the root of any repository where the CLI runs. | ||
| - **`kosli snapshot azure` scopes Azure credentials to ACR** — Azure credentials configured for the snapshot are no longer sent to non-Azure Container Registry hosts that a scanned Azure Web App references, closing a credential-disclosure path. See the [`kosli snapshot azure` reference](/client_reference/kosli_snapshot_azure). | ||
| - **`.kosli_ignore` can no longer exclude itself from a fingerprint** — a `.kosli_ignore` entry that matched the file itself used to change the resulting directory fingerprint. The CLI now always includes `.kosli_ignore` when fingerprinting a directory. Directories with self-excluding `.kosli_ignore` files will produce a different fingerprint after upgrading. |
There was a problem hiding this comment.
Suggestion — "always includes" is stronger than the reference page
The reference text (21 pages, e.g. client_reference/kosli_fingerprint.md:49-52) says the file's own entries cannot exclude it, and then adds the caveat this bullet drops: "Excluding the file with --exclude keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. To drop the file from the fingerprint safely, move its entries to --exclude and delete it."
So .kosli_ignore is not always included — --exclude still removes it. Narrowing the claim to "a .kosli_ignore entry can no longer exclude the file itself" keeps the entry true and avoids contradicting the command help a reader lands on from this page.
1 participant
Summary
Adds changelog entries for the new tagged releases published on September 11, 2026.
Changes
--jira-traileronkosli attest jira, paginated PR commits/reviews across GitHub/GitLab/Azure, breaking config-file lookup change,snapshot azurecredential scoping,.kosli_ignoreself-exclusion fix,snapshot s3unsafe-key rejection,x/cryptoCVE fix, and doc note on 1 MB payload limit.--expires-atand--grace-period-hoursoncreate api-keyandrotate api-key.kosli_service_account_api_keyalignsexpires_atwith the server's 365-day cap, fixing post-apply drift.Context
No
kosli-dev/serverreleases were published in the scoped window, so no Platform entry is added.