5th October 2026 - GitProxy Meeting Minutes #1797

Date

20261005 - 4pm BST / 11am EDT

Meeting info

• Meeting link

• Register for future meetings

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide and review Meeting Notices (see above)
• Approve past meeting minutes
  • 21st Sept 2026 - GitProxy Meeting Minutes #1729
• Release status and Roadmap Planning
  • feat: PostgreSQL sink backend #1687 review status
  • GitProxy Roadmap: v3 #1750
• fix(config): honor MongoDB connection string environment override #1796 and correct handling of env var overrides of configs
• CI issue: build-windows CI task is regularly failing/flaky #1776
  • test: remove unused performance tests #1792
• Reduce stored push document size and rollup scan cost across sink backends #1691
  • perf: reduce duplicate push audit storage #1795
• fix: failing patch release bumper on missing package-lock.json #1730
• chore: add roadmap template #1751
• Checkout depth issues
  • n.b. checkHiddenCommit issues (originally thought to be related) were fixed already in fix: exempt push parent from checkHiddenCommits hidden-commit detection #1773 and are pending release.
• AOB, Q&A & Adjourn (5mins)

Meeting Minutes

Approve Past Meeting Minutes

• Previous meeting minutes (21st Sept 2026 - GitProxy Meeting Minutes #1729) approved.

Release Status and Roadmap Planning

• Patch releases (2.0, 2.1) were issued: all urgent vulnerability fixes included except one that was difficult to backport; 2.2 contains all fixes.
• Migration/upgrade notes and troubleshooting for v2.2 were documented.
• Most users now on 2.2 based on download statistics.
• All CVEs requested and credits acknowledged; version matrix on advisories still to be updated (@coopernetes volunteered).
• Roadmap v3 (GitProxy Roadmap: v3 #1750) issue is in place; further dedicated meeting on roadmap is suggested after 2.3 release.
• Plugin architecture and security event hooks identified as a priority for v2.4; discussion scheduled for next meeting.
• Milestones and issue tracking for roadmap to be consolidated; @kriswest and @jescalada to coordinate, pending a clear mapping of issues to avoid duplication.

feat: PostgreSQL sink backend #1687 Review Status

• Final review underway; all blocking comments addressed.
• Merge is imminent following final checks by @kriswest.
• This will enable a 2.3 release.
• Testing confirmed by @dcoric.

fix(config): Honor MongoDB Connection String Environment Override #1796

• Ready for review and merge.
• Fixes config/env var precedence issue for MongoDB connection strings.

Correct Handling of Env Var Overrides of Configs

• Environment variables will correctly override config options following merge of fix(config): honor MongoDB connection string environment override #1796.

CI: build-windows CI Task Flaky #1776

• Flaky performance test file identified as root cause.
• Unused performance test to be deleted (test: remove unused performance tests #1792) to resolve CI flakiness.

Reduce Stored Push Document Size and Rollup Scan Cost Across Sink Backends #1691

• Large PR under review; further review required due to scale.
• Performance improvements (storage and rollup scans) focused on MongoDB and FS backends; PostgreSQL to follow after its merge.
• Plan: merge PostgreSQL, then update performance fixes for parity, potentially in the subsequent release.

fix: Failing Patch Release Bumper on Missing package-lock.json #1730

• PR ready to merge; @jescalada to update and merge.

chore: Add Roadmap Template #1751

• New roadmap template available for FINOS and project use.
• Demonstrates feature tiering for prioritisation; output examples linked in GitProxy Roadmap: v3 #1750.
• Encourages more transparent and democratic feature ranking.

Checkout Depth Issues

• Topic deferred; @andypols absent.
• Related issue with checkHiddenCommit already fixed and pending release.

AOB/Q&A

• No additional topics raised.

Action Items

Outstanding or Rolled Over Actions

• @Andreybest: Submit initial PR for ORPC-based REST API documentation/control, replacing the previous TS REST API effort. Testing in progress.
• @kriswest: Follow up with FINOS and Andy Block (Red Hat) for OpenSSF/OSSF partnership opportunity; coordinate group call, loop in @tabathad as contact for OpenSSF.
• @kriswest & @jescalada: Convert roadmap summary into GitHub milestones and tie to individual issues; avoid duplication, coordinate on issue creation.
• @dcoric: Revisit PR fix(config): recover cached git sources after history changes #1587 (Recovering cached Git sources on detached head), comment on validity and whether it should be scheduled or closed.
• @re-vlad / @Andreybest: Review open PR assigned to Vlad regarding merge readiness; update milestone/tag if appropriate.
• @kriswest: Finalise review of PostgreSQL sink backend (feat: PostgreSQL sink backend #1687), merge if satisfied.

New Actions

• @jescalada: Update and merge fix for failing patch release bumper (fix: failing patch release bumper on missing package-lock.json #1730).
• @jescalada / @dcoric / @fabiovincenzi: On merge of PostgreSQL backend, update and apply storage/rollup optimisations to PostgreSQL backend in a new PR.
• @jescalada: Merge MongoDB config PR (fix(config): honor MongoDB connection string environment override #1796) immediately after PostgreSQL backend is merged.
• @ALL: Review and merge "remove unused performance tests" PR (test: remove unused performance tests #1792) to resolve CI flakiness.
• @coopernetes: Update the version matrix for the three OSTIF advisories so that CVEs are published with the correct coordinates.
• @kriswest & @jescalada: Schedule further roadmap/architecture session after 2.3 release, with focus on plugin system and event hooks.
• @ALL: Suggest and prioritise topics/sub-issues for next roadmap review meeting.