[szibis]

Problem

Open alerts on main: 15 code-scanning (CodeQL, Semgrep, Trivy) and 4 Dependabot.

Change

alert(s)	tool / rule	location	fix
#534, #535	CodeQL go/allocation-size-overflow	internal/proxy/patterns.go:978-979	custom-pattern merge sizes its slice/set from the response's pattern count instead of the sum of two lengths
#567	Semgrep run-shell-injection	.github/workflows/ci.yaml:676	github.base_ref passed via env: BASE_REF
#575, #593, #594, #598	Semgrep insecure-hash-algorithm-sha1	bench/ab/perf_matrix.py, bench/visual/compare.py, bench/parity/corpus.py	SHA-256 (digests only compared within a run)
#597	same	bench/parity/cluster.py:77	kept SHA-1 with usedforsecurity=False + inline suppression: the cluster id is a content identifier that every registry case claims clusters by; changing it would renumber every claim
#587–#592	Semgrep path-join-resolve-traversal	bench/visual/capture.spec.ts	spec ids reduced to single path segments before naming files; plan.py --check rejects ids with other characters
Dependabot #90	katex < 0.18.2 (CVE-2026-103923)	website	override ^0.18.2 (0.18.10)
Dependabot #89	postcss-selector-parser < 7.1.6 (CVE-2026-104844)	website	override ^7.1.6
Dependabot #88	http-cache-semantics ≤ 4.2.0 (CVE-2026-93748)	website	4.3.0 (in range)

Not fixable here

• Dependabot Learn custom dot/underscore aliases and document Grafana builder caveat #87 braces ≤ 3.0.3 (CVE-2026-93687): no fixed release exists (3.0.3 is the latest). Reached only through the site's build tooling (chokidar, micromatch) with patterns from the repository's own config.
• Trivy fix: keep Explore json logs volume with label filters on VictoriaLogs stats #568 DLA-4792-1 tzdata 2026b in the image: comes from gcr.io/distroless/static-debian12:nonroot; the current image (digest sha256:afa5c872…) still ships 2026b. Data-only (timezone database) note; clears when distroless publishes a rebuilt base.

Proof

• go test -count=1 ./internal/proxy/, go vet, gofmt, golangci-lint v2.13.2: 0 issues.
• Semgrep 1.161.0 (p/default, p/github-actions, p/owasp-top-ten) on the changed files: only rules CI already excludes remain.
• Trivy 0.71.0 fs (CI command): 0 HIGH/CRITICAL in every lockfile.
• docusaurus build completes with the overrides.
• bench/visual (67), bench/parity and bench/ab unit tests; plan.py --check, conformance and changelog gates pass. Parity cluster ids unchanged, so registry claims are unaffected.

[github-actions]

⚪ Performance A/B: no change beyond noise

8 shape×range — 8 ⚪ same · results vs Loki: 7 same, 0 new difference(s), 1 pre-existing

Every shape is within noise of the base build (±30% and 100 ms).

8 unchanged shape×range (within noise)

	shape	range	base p50	PR p50	change	Loki p50	PR ÷ Loki	result vs Loki
⚪	drilldown service landing	1h	18 ms	20 ms	⚪ +11%	17 ms	1.18×	✅ same
⚪	instant ungrouped rate	instant	4 ms	6 ms	⚪ +50%	47 ms	0.13×	✅ same
⚪	json rate by level (no filter, no drop)	1h	400	400	⚪ +0%	400	—	✅ same
⚪	json volume no filters	1h	106 ms	104 ms	⚪ -2%	90 ms	1.16×	✅ same
⚪	logs plain	1h	38 ms	37 ms	⚪ -3%	193 ms	0.19×	✅ same
⚪	logs | json	1h	49 ms	54 ms	⚪ +10%	387 ms	0.14×	✅ same
⚪	stream-label count by app	1h	15 ms	16 ms	⚪ +7%	25 ms	0.64×	✅ same
⚪	topk rate by app	1h	24 ms	25 ms	⚪ +4%	55 ms	0.45×	➖ differs (as base)

Cold (first-run) timings — what a user opening a panel sees

shape	range	base cold	PR cold	Loki cold	PR ÷ Loki cold
drilldown service landing	1h	19 ms	17 ms	356 ms	0.05×
instant ungrouped rate	instant	4 ms	5 ms	47 ms	0.11×
json rate by level (no filter, no drop)	1h	400	400	400	—
json volume no filters	1h	102 ms	101 ms	1.15 s	0.09×
logs plain	1h	73 ms	59 ms	198 ms	0.30×
logs | json	1h	58 ms	50 ms	537 ms	0.09×
stream-label count by app	1h	17 ms	14 ms	750 ms	0.02×
topk rate by app	1h	27 ms	23 ms	472 ms	0.05×

Why these shapes

• control smoke → 8: control/drilldown service landing, control/instant ungrouped rate, control/json rate by level (no filter, no drop), control/json volume no filters, control/logs plain, control/logs | json, control/stream-label count by app, control/topk rate by app

_{base f8dc826bd0 → PR 0f8c699083 · 4 runs (first is cold), warm p50 · ranges 1h · noise ±30% and 100 ms · VictoriaLogs restarts 0→0 · 1.8 min. Same runner, one fresh stack, targets interleaved per request. How to read and reproduce: bench/ab/README.md.}

[github-actions]

✅ Visual smoke: passed with warnings

Base f8dc826bd0 vs PR 0854742efc, Grafana through the proxy builds and Loki on one fresh stack; run.
Core set: 5 capture(s) at 1h. Detailed set: 2 entries (dd-labels, dd-patterns). 11 capture(s), 15m/1h/6h, 24h and 7d stay out of PR runs.

page	range	set	base = PR (data)	vs Loki (PR)	pixel diff	result
dd-fields	1h	core	✅ identical	identical (5 explained, 1 history-dependent)	0.12%	⚠️ history-dependent difference, not gated (1): resource /api/datasources/uid/*/res
dd-landing	1h	core	✅ identical	identical (8 explained)	0.13%	✅
dd-service-logs	1h	core	✅ identical	identical (4 explained, 1 history-dependent)	0.12%	⚠️ history-dependent difference, not gated (1): resource /api/datasources/uid/*/res
explore-logs-plain	1h	core	✅ identical	identical (2 explained)	0.07%	✅
explore-metric-plain	1h	core	✅ identical	identical (1 explained)	0.04%	✅
dd-labels	15m	detailed	✅ identical	identical (4 explained, 1 history-dependent)	0.11%	✅
dd-labels	1h	detailed	✅ identical	identical (4 explained, 1 history-dependent)	0.12%	⚠️ history-dependent difference, not gated (1): resource /api/datasources/uid/*/res
dd-labels	6h	detailed	✅ identical	n/a (beyond the Loki window)	0.11%	✅
dd-patterns	15m	detailed	✅ identical	identical (4 explained, 1 history-dependent)	0.11%	✅
dd-patterns	1h	detailed	✅ identical	identical (4 explained, 1 history-dependent)	6.07%	⚠️ history-dependent difference, not gated (1): resource /api/datasources/uid/*/res
dd-patterns	6h	detailed	✅ identical	n/a (beyond the Loki window)	0.60%	✅

Gate: a base-vs-PR data difference passes when the PR is closer to Loki, and fails when the PR diverges from Loki or Loki cannot decide it (at a range Loki does not hold, a difference passes when the same page proved it closer to Loki at a shorter range; otherwise label the pull request visual-change-expected to accept an intended change). Also failing: a panel empty on the PR but not on the base, an error banner, panel error, error answer or new "No data" panel on the PR, a PR side that never settled, a difference that did not reproduce on the recapture. Pixel differences only warn.

dd-fields-1h: history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3

• history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3A00.000Z&query=%7Bservic: body: content differs (rows 4 vs 2)
• vs Loki, explained: query ('{service_name="otel-collector"} | json | logfmt | drop __error__, __error_details__: ('logsPanelQuery', '', '{}'): content differs (rows 1000 vs 1000) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation)
• vs Loki, explained: query ('sum by (service_name_extracted) (count_over_time({service_name="otel-collector"} | servi: request only on one side (right) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation)
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_fields?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 13 vs 15) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation); the proxy also returns data, status; Loki lists fields in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_labels?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 9 vs 9) -- explained: sampled cardinality: Loki counts every stream its ingesters hold, not the requested window (pkg/ingester/instance.go LabelsWithValues), the proxy the window's last 5 minutes (metadataMaxFieldNamesWindow); the label names match; the proxy also returns data, limit, status; Loki lists labels in no fixed order

dd-service-logs-1h: history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3

• history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3A00.000Z&query=%7Bservic: body: content differs (rows 4 vs 2)
• vs Loki, explained: query ('{service_name="otel-collector"} | json | logfmt | drop __error__, __error_details__: ('logsPanelQuery', '', '{}'): content differs (rows 1000 vs 1000) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation)
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_fields?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 13 vs 15) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation); the proxy also returns data, status; Loki lists fields in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_labels?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 9 vs 9) -- explained: sampled cardinality: Loki counts every stream its ingesters hold, not the requested window (pkg/ingester/instance.go LabelsWithValues), the proxy the window's last 5 minutes (metadataMaxFieldNamesWindow); the label names match; the proxy also returns data, limit, status; Loki lists labels in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/drilldown-limits: body: content differs (rows 0 vs 0) -- explained: configuration probe: each backend publishes its own limits, version and settings (the proxy's pattern persistence)

dd-labels-1h: history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3

• history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3A00.000Z&query=%7Bservic: body: content differs (rows 4 vs 2)
• vs Loki, explained: query ('{service_name="otel-collector"} | json | logfmt | drop __error__, __error_details__: ('logsPanelQuery', '', '{}'): content differs (rows 1000 vs 1000) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation)
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_fields?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 13 vs 15) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation); the proxy also returns data, status; Loki lists fields in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_labels?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 9 vs 9) -- explained: sampled cardinality: Loki counts every stream its ingesters hold, not the requested window (pkg/ingester/instance.go LabelsWithValues), the proxy the window's last 5 minutes (metadataMaxFieldNamesWindow); the label names match; the proxy also returns data, limit, status; Loki lists labels in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/drilldown-limits: body: content differs (rows 0 vs 0) -- explained: configuration probe: each backend publishes its own limits, version and settings (the proxy's pattern persistence)

dd-patterns-1h: history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3

• history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-06T06%3A16%3A00.000Z&query=%7Bservic: body: content differs (rows 4 vs 2)
• pixel diff 6.1%
• vs Loki, explained: query ('{service_name="otel-collector"} | json | logfmt | drop __error__, __error_details__: ('logsPanelQuery', '', '{}'): content differs (rows 1000 vs 1000) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation)
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_fields?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 13 vs 15) -- explained: Loki's _extracted suffix for a key named like a stream label (structured metadata: open, owner decision pending, profiles/structured-metadata-label-collision; detected_fields: documented deviation); the proxy also returns data, status; Loki lists fields in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_labels?end=2026-10-06T06%3A16%3A00.000Z&query=%7: body: content differs (rows 9 vs 9) -- explained: sampled cardinality: Loki counts every stream its ingesters hold, not the requested window (pkg/ingester/instance.go LabelsWithValues), the proxy the window's last 5 minutes (metadataMaxFieldNamesWindow); the label names match; the proxy also returns data, limit, status; Loki lists labels in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/drilldown-limits: body: content differs (rows 0 vs 0) -- explained: configuration probe: each backend publishes its own limits, version and settings (the proxy's pattern persistence)

Core set montages (3): base | PR | Loki

dd-landing-1h

explore-logs-plain-1h

explore-metric-plain-1h

All montages of this run: pr-visuals/pr-663.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	8274	8274	0
Coverage	90.6%	90.6%	0.0% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Lower CPU cost (ns/op) is better. Lower benchmark memory cost (B/op, allocs/op) is better. Higher throughput is better. Lower load-test memory growth is better. Benchmark rows are medians from repeated samples.

Signal	Base	PR	Delta
QueryRange cache-hit CPU cost	3421.0 ns/op	3334.0 ns/op	-2.5% (stable)
QueryRange cache-hit memory	1240.0 B/op	1240.0 B/op	0.0% (stable)
QueryRange cache-hit allocations	27.0 allocs/op	27.0 allocs/op	0.0% (stable)
QueryRange cache-bypass CPU cost	4064.0 ns/op	3978.0 ns/op	-2.1% (stable)
QueryRange cache-bypass memory	1302.0 B/op	1300.0 B/op	-0.2% (stable)
QueryRange cache-bypass allocations	27.0 allocs/op	27.0 allocs/op	0.0% (stable)
Labels cache-hit CPU cost	891.7 ns/op	891.5 ns/op	-0.0% (stable)
Labels cache-hit memory	48.0 B/op	48.0 B/op	0.0% (stable)
Labels cache-hit allocations	3.0 allocs/op	3.0 allocs/op	0.0% (stable)
Labels cache-bypass CPU cost	1505.0 ns/op	1468.0 ns/op	-2.5% (stable)
Labels cache-bypass memory	392.0 B/op	392.0 B/op	0.0% (stable)
Labels cache-bypass allocations	14.0 allocs/op	14.0 allocs/op	0.0% (stable)

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance is a smoke comparison, not a full benchmark lab run.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.