#1499 chore(deps-dev): bump infrahub-testcontainers from 1.11.9 to 1.11.11

Sourced from infrahub-testcontainers's releases.

Infrahub - v1.11.11

Infrahub - v1.11.11 - 2026-11-06

Security

• Fixed GraphQL subscriptions bypassing authentication and saved-query permissions. WebSocket connections now require a bearer token, API key or session cookie when allow_anonymous_access is disabled, and each run of a subscribed saved query is checked against the permissions of the connected account, or of the anonymous role when no credentials are sent. A subscription ends when its credentials expire or are revoked.
• Fixed an issue where an account signed in with a JWT token could delete an API token that belongs to another account, including an administrator account, if it knew the ID of that token.
• Fixed security vulnerabilities in frontend rendering, tracing, documentation, and development dependencies.

Removed

• Removed the experimental NATS JetStream driver for the message bus and the cache, so a deployment that sets INFRAHUB_BROKER_DRIVER or INFRAHUB_CACHE_DRIVER to nats now fails to load its configuration and must use RabbitMQ and Redis.

Added

• Added the --performance-result-compress, --performance-result-required and --performance-result-file options to the infrahub-testcontainers pytest plugin, which send the performance results gzip-compressed, fail a passing session when the results cannot be stored, and also write them to a file.

Changed

• Reduced the load that the artifact checks of a proposed change put on the API server, which grew with the square of the number of artifacts to check.
• Reduced the load that the user checks of a proposed change put on the API server, which grew with the square of the number of members in the group that a check definition targets.
• Rewrote the key concepts documentation with concise explanations, infrastructure examples, and diagrams.
• Shortened the validation of a proposed change with many checks and reduced the requests it sends to the task manager: Infrahub now reads the state of all the runs a validation waits on together, once a second, instead of reading each run separately.

Fixed

• Fixed proposed change Generator checks that failed when a Generator instance remained after its target object was deleted. (#6293)
• Fixed the JSON schema endpoint returning a 500 error for kinds with a List or Any attribute, such as CoreGraphQLQuery. (#10685)
• Fixed the IPAM tree crashing with "Invalid array length", or hiding prefixes, when scrolling loaded more prefixes. (#10719)
• Fixed branch creation waiting for an unrelated branch merge to finish when it ran on the task worker executing that merge. (#10845)
• Fixed the task worker that ran a branch merge occasionally treating the merged branch as still merging until its next registry refresh. (#10850)
• Fixed the list view search and the IP prefix and IP address filters returning no result when an IPv6 value was typed with leading zeros or in its full form. (#10926)
• Fixed schema loads accepting malformed human-friendly ID paths and reporting unclear errors for invalid stored uniqueness constraints. (#10942)
• Fixed time-range diffs of the default branch reporting a node deleted by a branch merge as updated instead of removed. (#11344)
• Fixed time-range diffs of the default branch reporting the first value ever, instead of the value at the start of the range, as the previous value of a deleted node. (#11345)
• Fixed time-range diffs of the default branch reporting the first value ever, instead of the value at the start of the range, as the previous value of a property of a removed relationship peer. (#11358)
• Fixed flows failing with MaxConnectionsError: Too many connections when many of them used Redis at once: the Redis connection pools of the cache and the locks now hold up to 1000 connections by default, set with INFRAHUB_CACHE_MAX_CONNECTIONS. (#11423)
• Fixed a task worker occasionally using the previous status of a branch until its next registry refresh, after the worker rolled back, flagged or recovered a failed merge of that branch, or migrated the branch to a new graph version.
• Fixed an account's global permissions changing before a branch is merged, when the members of an account group, the roles of a group or the global permissions of a role were changed on that branch. Global permissions and the roles listed at login now come from the default branch, whatever branch the request is sent to.
• Fixed the infrahub-testcontainers pytest plugin losing the performance results after one failed upload: it now retries the upload up to 3 times, a number that --performance-result-retries changes.
• Fixed the artifact checks of a proposed change crashing with httpx.PoolTimeout and staying in progress when the artifact definition targets about a thousand objects.
• Improved performance for queries that look up nodes with the top-level ids filter

Infrahub - v1.11.10

Infrahub - v1.11.10 - 2026-10-30

Security

• Updated the base Python version of the Infrahub container image and the development environment from 3.14.7 to 3.14.10, so the pip bundled in the image no longer ships a certifi version affected by GHSA-6q48-6c7w-9gw2.

... (truncated)

Sourced from infrahub-testcontainers's changelog.

Infrahub - v1.11.11 - 2026-11-06

Security

• Fixed GraphQL subscriptions bypassing authentication and saved-query permissions. WebSocket connections now require a bearer token, API key or session cookie when allow_anonymous_access is disabled, and each run of a subscribed saved query is checked against the permissions of the connected account, or of the anonymous role when no credentials are sent. A subscription ends when its credentials expire or are revoked.
• Fixed an issue where an account signed in with a JWT token could delete an API token that belongs to another account, including an administrator account, if it knew the ID of that token.
• Fixed security vulnerabilities in frontend rendering, tracing, documentation, and development dependencies.

Removed

• Removed the experimental NATS JetStream driver for the message bus and the cache, so a deployment that sets INFRAHUB_BROKER_DRIVER or INFRAHUB_CACHE_DRIVER to nats now fails to load its configuration and must use RabbitMQ and Redis.

Added

• Added the --performance-result-compress, --performance-result-required and --performance-result-file options to the infrahub-testcontainers pytest plugin, which send the performance results gzip-compressed, fail a passing session when the results cannot be stored, and also write them to a file.

Changed

• Reduced the load that the artifact checks of a proposed change put on the API server, which grew with the square of the number of artifacts to check.
• Reduced the load that the user checks of a proposed change put on the API server, which grew with the square of the number of members in the group that a check definition targets.
• Rewrote the key concepts documentation with concise explanations, infrastructure examples, and diagrams.
• Shortened the validation of a proposed change with many checks and reduced the requests it sends to the task manager: Infrahub now reads the state of all the runs a validation waits on together, once a second, instead of reading each run separately.

Fixed

• Fixed proposed change Generator checks that failed when a Generator instance remained after its target object was deleted. (#6293)
• Fixed the JSON schema endpoint returning a 500 error for kinds with a List or Any attribute, such as CoreGraphQLQuery. (#10685)
• Fixed the IPAM tree crashing with "Invalid array length", or hiding prefixes, when scrolling loaded more prefixes. (#10719)
• Fixed branch creation waiting for an unrelated branch merge to finish when it ran on the task worker executing that merge. (#10845)
• Fixed the task worker that ran a branch merge occasionally treating the merged branch as still merging until its next registry refresh. (#10850)
• Fixed the list view search and the IP prefix and IP address filters returning no result when an IPv6 value was typed with leading zeros or in its full form. (#10926)
• Fixed schema loads accepting malformed human-friendly ID paths and reporting unclear errors for invalid stored uniqueness constraints. (#10942)
• Fixed time-range diffs of the default branch reporting a node deleted by a branch merge as updated instead of removed. (#11344)
• Fixed time-range diffs of the default branch reporting the first value ever, instead of the value at the start of the range, as the previous value of a deleted node. (#11345)
• Fixed time-range diffs of the default branch reporting the first value ever, instead of the value at the start of the range, as the previous value of a property of a removed relationship peer. (#11358)
• Fixed flows failing with MaxConnectionsError: Too many connections when many of them used Redis at once: the Redis connection pools of the cache and the locks now hold up to 1000 connections by default, set with INFRAHUB_CACHE_MAX_CONNECTIONS. (#11423)
• Fixed a task worker occasionally using the previous status of a branch until its next registry refresh, after the worker rolled back, flagged or recovered a failed merge of that branch, or migrated the branch to a new graph version.
• Fixed an account's global permissions changing before a branch is merged, when the members of an account group, the roles of a group or the global permissions of a role were changed on that branch. Global permissions and the roles listed at login now come from the default branch, whatever branch the request is sent to.
• Fixed the infrahub-testcontainers pytest plugin losing the performance results after one failed upload: it now retries the upload up to 3 times, a number that --performance-result-retries changes.
• Fixed the artifact checks of a proposed change crashing with httpx.PoolTimeout and staying in progress when the artifact definition targets about a thousand objects.
• Improved performance for queries that look up nodes with the top-level ids filter

Infrahub - v1.11.10 - 2026-10-30

Security

• Updated the base Python version of the Infrahub container image and the development environment from 3.14.7 to 3.14.10, so the pip bundled in the image no longer ships a certifi version affected by GHSA-6q48-6c7w-9gw2.

Added

... (truncated)

• a83c383 chore: release 1.11.11
• e6dda32 chore: update docker-compose for release 1.11.11
• f29e3a5 fix: size each Redis connection pool at 1000 connections by default (#11432)
• 31f62a6 docs: fix unresolvable type import in release-notes sidebar (#11321)
• 4b568e4 fix: return the JSON schema for kinds with a List or Any attribute #10685 (...
• 05b5fed chore: align invoke format/lint with CI and fix stale AGENTS.md facts (#11373)
• eebfbd8 docs(dev): point the migration checklist at the batching and per-item failure...
• 9f081cb fix(branch): cache the branch a merge rollback, recovery or migration saves t...
• f5ab3ca fix(merge): cache a copy of the merging branch so a registry refresh keeps th...
• 4a45a53 fix(branch): stop merges and rebases waiting for a registry refresh to cache ...
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)