.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "csharpier": {
-      "version": "0.26.3",
+      "version": "0.26.7",
       "commands": ["dotnet-csharpier"]
     },
     "dotnet-outdated-tool": {

.gitattributes

@@ -3,4 +3,4 @@
 *.shellcheckrc text eol=lf
 *Dockerfile text eol=lf
 
-*.verified.fhir.json text eol=lf working-tree-encoding=UTF-8
+*.verified.json text eol=lf working-tree-encoding=UTF-8

.github/workflows/chaos.yaml

@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
 
       - name: Install Task
         uses: arduino/setup-task@e26d8975574116b0097a1161e0fe16ba75d84c1c # v1.0.3
@@ -38,7 +38,7 @@ jobs:
 
       - name: Upload cluster dump
         if: always()
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: kind-cluster-dump.txt
           path: |

.github/workflows/ci.yaml

@@ -12,7 +12,7 @@ permissions: read-all
 
 jobs:
   build:
-    uses: miracum/.github/.github/workflows/standard-build.yaml@1dd4350bc909156d8af0f1997efcb0f3225dad85 # v1.1.0
+    uses: miracum/.github/.github/workflows/standard-build.yaml@99ea726a6aea9d5e055cadc81cd46527ea6c8d83 # v1.5.4
     permissions:
       contents: read
       id-token: write
@@ -35,15 +35,15 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
 
       - name: Download image
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
         if: ${{ github.event_name == 'pull_request' }}
         with:
-          name: container-image
+          name: ${{ needs.build.outputs.image-slug }}
           path: /tmp
 
       - name: Load image
@@ -54,9 +54,9 @@ jobs:
           docker image ls
 
       - name: Download test image
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
         with:
-          name: test-image
+          name: ${{ needs.build.outputs.image-slug }}-test
           path: /tmp
 
       - name: Load test image
@@ -103,7 +103,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: install iter8 cli
         env:
@@ -120,9 +120,9 @@ jobs:
           cluster_name: kind
 
       - name: Download image
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
         with:
-          name: container-image
+          name: ${{ needs.build.outputs.image-slug }}
           path: /tmp
 
       - name: Load image into KinD
@@ -179,7 +179,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: iter8-report.html
           path: |
@@ -193,14 +193,14 @@ jobs:
 
       - name: Upload cluster dump
         if: always()
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: kind-cluster-dump.txt
           path: |
             kind-cluster-dump.txt
 
   lint:
-    uses: miracum/.github/.github/workflows/standard-lint.yaml@1dd4350bc909156d8af0f1997efcb0f3225dad85 # v1.1.0
+    uses: miracum/.github/.github/workflows/standard-lint.yaml@99ea726a6aea9d5e055cadc81cd46527ea6c8d83 # v1.5.4
     permissions:
       contents: read
       pull-requests: write
@@ -211,11 +211,12 @@ jobs:
       enable-validate-gradle-wrapper: false
       codeql-languages: '["csharp"]'
       enable-codeql: true
+      enable-verify-base-image-signature: false
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}
 
   release:
-    uses: miracum/.github/.github/workflows/standard-release.yaml@1dd4350bc909156d8af0f1997efcb0f3225dad85 # v1.1.0
+    uses: miracum/.github/.github/workflows/standard-release.yaml@99ea726a6aea9d5e055cadc81cd46527ea6c8d83 # v1.5.4
     needs:
       - build
       - test

.github/workflows/schedule.yaml

@@ -10,7 +10,7 @@ permissions: read-all
 
 jobs:
   schedule:
-    uses: miracum/.github/.github/workflows/standard-schedule.yaml@1dd4350bc909156d8af0f1997efcb0f3225dad85 # v1.1.0
+    uses: miracum/.github/.github/workflows/standard-schedule.yaml@99ea726a6aea9d5e055cadc81cd46527ea6c8d83 # v1.5.4
     permissions:
       contents: read
       issues: write

.github/workflows/scorecards.yaml

@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@483ef80eb98fb506c348f7d62e28055e49fe2398 # v2.3.0
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -60,14 +60,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ddccb873888234080b77e9bc2d4764d5ccaaccf9 # v2.21.9
+        uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
         with:
           sarif_file: results.sarif

.mega-linter.yml

@@ -23,7 +23,7 @@ BASH_SHFMT_ARGUMENTS:
   - "--indent=2"
 
 REPOSITORY_TRIVY_ARGUMENTS:
-  - "--severity=MEDIUM,HIGH,CRITICAL"
+  - "--severity=HIGH,CRITICAL"
 
 REPOSITORY_CHECKOV_ARGUMENTS:
   - "--skip-path=tests/iter8"

.releaserc.json

@@ -60,22 +60,38 @@
           },
           {
             "files": ["Dockerfile"],
-            "from": "VERSION=.*",
-            "to": "VERSION=${nextRelease.version}",
+            "from": "ARG VERSION=.*",
+            "to": "ARG VERSION=${nextRelease.version}",
             "results": [
               {
                 "file": "Dockerfile",
                 "hasChanged": true
               }
             ]
+          },
+          {
+            "files": ["tests/chaos/fhir-pseudonymizer-values.yaml"],
+            "from": "tag: .*",
+            "to": "tag: v${nextRelease.version}",
+            "results": [
+              {
+                "file": "tests/chaos/fhir-pseudonymizer-values.yaml",
+                "hasChanged": true
+              }
+            ]
           }
         ]
       }
     ],
     [
       "@semantic-release/git",
       {
-        "assets": ["README.md", "compose/compose.yaml"]
+        "assets": [
+          "README.md",
+          "compose/compose.yaml",
+          "Dockerfile",
+          "tests/chaos/fhir-pseudonymizer-values.yaml"
+        ]
       }
     ]
   ]

Dockerfile

@@ -1,14 +1,14 @@
 # kics false positive "Missing User Instruction": <https://docs.kics.io/latest/queries/dockerfile-queries/fd54f200-402c-4333-a5a4-36ef6709af2f/>
 # kics-scan ignore-line
-FROM mcr.microsoft.com/dotnet/aspnet:8.0.0-jammy-chiseled@sha256:2f9b3da0c3de6b0db88a0f53356dd7022ce983609a3255aeefaf617c5ed32fa7 AS runtime
+FROM mcr.microsoft.com/dotnet/aspnet:8.0.1-jammy-chiseled@sha256:fd65dd3a9fef62b12873e1f3db1d0cf4bffd3984c1656971a2bfcaab14224b67 AS runtime
 WORKDIR /opt/fhir-pseudonymizer
 EXPOSE 8080/tcp 8081/tcp
 USER 65532:65532
 ENV ASPNETCORE_ENVIRONMENT="Production" \
     DOTNET_CLI_TELEMETRY_OPTOUT=1 \
     ASPNETCORE_URLS="http://*:8080"
 
-FROM mcr.microsoft.com/dotnet/sdk:8.0.100-jammy@sha256:7aacf0debfa3c612176a76c7d0be817e588b7cb5ca8f74e20484bb66e6ef1f79 AS build
+FROM mcr.microsoft.com/dotnet/sdk:8.0.101-jammy@sha256:76ef2395f453da03a90be9a9643cf75da3365503c9cde7bde7a98bee8f61900f AS build
 ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
 WORKDIR /build
 COPY src/Directory.Build.props .
@@ -17,7 +17,7 @@ COPY src/FhirPseudonymizer/packages.lock.json .
 RUN dotnet restore --locked-mode
 COPY . .
 
-ARG VERSION=0.0.0
+ARG VERSION=2.21.5
 RUN dotnet publish \
     -c Release \
     -p:Version=${VERSION} \
@@ -57,7 +57,7 @@ WORKDIR /opt/fhir-pseudonymizer-stress
 
 # https://github.com/hadolint/hadolint/pull/815 isn't yet in mega-linter
 # hadolint ignore=DL3022
-COPY --from=docker.io/bitnami/kubectl:1.28.3@sha256:0defec793112fa610a850a991ed4ad849c853c54fb2136b95bcdf41ff6f96c38 /opt/bitnami/kubectl/bin/kubectl /usr/bin/kubectl
+COPY --from=docker.io/bitnami/kubectl:1.29.0@sha256:121fa926a1304f34439082df44b0bdbe6eee583760abd2ae67949a2987322fe9 /opt/bitnami/kubectl/bin/kubectl /usr/bin/kubectl
 
 COPY tests/chaos/chaos.yaml /tmp/
 COPY --from=build-stress-test /build/publish .

README.md

@@ -15,7 +15,7 @@ Based on the brilliant [Tools for Health Data Anonymization](https://github.com/
 docker run --rm -i -p 8080:8080 \
   -e PseudonymizationService="None" \
   -e UseSystemTextJsonFhirSerializer="true" \
-  ghcr.io/miracum/fhir-pseudonymizer:v2.21.4
+  ghcr.io/miracum/fhir-pseudonymizer:v2.21.5
 
 curl -X POST -H "Content-Type:application/fhir+json" "http://localhost:8080/fhir/\$de-identify" -d @benchmark/observation.json
 ```
@@ -431,7 +431,7 @@ Prerequisites:
 All released container images are signed using [cosign](https://github.com/sigstore/cosign) and SLSA Level 3 provenance is available for verification.
 
 ```sh
-IMAGE=ghcr.io/miracum/fhir-pseudonymizer:v2.21.4
+IMAGE=ghcr.io/miracum/fhir-pseudonymizer:v2.21.5
 DIGEST=$(crane digest "${IMAGE}")
 IMAGE_DIGEST_PINNED="ghcr.io/miracum/fhir-pseudonymizer@${DIGEST}"
 IMAGE_TAG="${IMAGE#*:}"

Taskfile.yaml

@@ -3,6 +3,8 @@ version: "3"
 tasks:
   build-stress-test-image:
     desc: build the container image used for stress testing
+    vars:
+      BUILDKIT_PROGRESS: plain
     cmds:
       - docker build -t ghcr.io/miracum/fhir-pseudonymizer/stress-test:v1 --target=stress-test --iidfile=./stress-test-iid.txt .
     sources:
@@ -14,7 +16,7 @@ tasks:
     desc: download and install the argo workflows cli
     dir: tests/chaos
     cmds:
-      - curl -sL -o - https://github.com/argoproj/argo-workflows/releases/download/v3.4.9/argo-linux-amd64.gz | gunzip > argo
+      - curl -sL -o - https://github.com/argoproj/argo-workflows/releases/download/v3.5.2/argo-linux-amd64.gz | gunzip > argo
       - chmod +x ./argo
       - ./argo version
     status:

compose.dev.yaml

@@ -1,6 +1,6 @@
 services:
   jaeger:
-    image: docker.io/jaegertracing/all-in-one:1.50@sha256:d589499a01e1e2f9d302db8e210af09688076fd8a93278fa024824a755c1a0f1
+    image: docker.io/jaegertracing/all-in-one:1.53@sha256:60e65bfffe1f66aee96d6fc8b6bf65afd42016be5dcc09d2e15d8462f7d9409c
     restart: unless-stopped
     deploy:
       resources:
@@ -21,7 +21,7 @@ services:
       - "127.0.0.1:16686:16686"
 
   vfps-db:
-    image: docker.io/library/postgres:15.4@sha256:d1168ad5397bf9c94cc417c530469805a8767ed585481d93f174461ac8557e3a
+    image: docker.io/library/postgres:16.1@sha256:49c276fa02e3d61bd9b8db81dfb4784fe814f50f778dce5980a03817438293e3
     restart: unless-stopped
     deploy:
       resources:
@@ -41,7 +41,7 @@ services:
       POSTGRES_DB: vfps
 
   vfps:
-    image: ghcr.io/miracum/vfps:v1.3.0@sha256:16d723600764eeebb49c88c4bfdf2bd7f84e3d5f9602c25b307bf52cf50e7e37
+    image: ghcr.io/miracum/vfps:v1.3.2@sha256:3f53189024ab609b3b25f08b8270f9880a2d710d68e46d2d7a5e6258085de3d4
     restart: unless-stopped
     deploy:
       resources:
@@ -101,7 +101,7 @@ services:
       - ./hack/mocks:/config:ro
 
   keycloak:
-    image: quay.io/keycloak/keycloak:22.0.5@sha256:bfa8852e52c279f0857fe8da239c0ad6bbd2cc07793a28a6770f7e24c1e25444
+    image: quay.io/keycloak/keycloak:23.0.4@sha256:4281aa5007b370de736969d991e0b63b45c389319f08948e834418b950c07155
     restart: unless-stopped
     profiles:
       - keycloak

compose/compose.yaml

@@ -1,6 +1,6 @@
 services:
   fhir-pseudonymizer:
-    image: ghcr.io/miracum/fhir-pseudonymizer:v2.21.4
+    image: ghcr.io/miracum/fhir-pseudonymizer:v2.21.5
     restart: unless-stopped
     cap_drop:
       - ALL

src/FhirPseudonymizer.StressTests/FhirPseudonymizer.StressTests.csproj

@@ -6,11 +6,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.1" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
     <PackageReference Include="NBomber.Http" Version="5.0.1" />
-    <PackageReference Include="xunit" Version="2.6.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.4">
+    <PackageReference Include="xunit" Version="2.6.5" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.6">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>

src/FhirPseudonymizer.StressTests/StressTests.cs

@@ -165,12 +165,7 @@ double failPercentageThreshold
             .WithWarmUpDuration(TimeSpan.FromSeconds(10))
             .WithLoadSimulations(
                 Simulation.RampingConstant(copies: 10, during: TimeSpan.FromMinutes(5)),
-                Simulation.KeepConstant(copies: 100, during: TimeSpan.FromMinutes(5)),
-                Simulation.RampingInject(
-                    rate: 10,
-                    TimeSpan.FromMinutes(1),
-                    during: TimeSpan.FromMinutes(10)
-                )
+                Simulation.KeepConstant(copies: 100, during: TimeSpan.FromMinutes(10))
             );
 
         var stats = NBomberRunner

src/FhirPseudonymizer.Tests/FhirPseudonymizer.Tests.csproj

@@ -7,13 +7,13 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.msbuild" Version="6.0.0" />
-    <PackageReference Include="FakeItEasy" Version="8.0.0" />
+    <PackageReference Include="FakeItEasy" Version="8.1.0" />
     <PackageReference Include="FluentAssertions" Version="6.12.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.1" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
-    <PackageReference Include="Verify.Xunit" Version="22.8.0" />
-    <PackageReference Include="xunit" Version="2.6.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.4">
+    <PackageReference Include="Verify.Xunit" Version="22.11.5" />
+    <PackageReference Include="xunit" Version="2.6.5" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.6">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>