cea-sec · istairbn · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -3,8 +3,18 @@ updates:
 - package-ecosystem: cargo
   directory: "/"
   schedule:
-    interval: daily
-  open-pull-requests-limit: 10
-  ignore:
-    - dependency-name: "*"
-      update-types: ["version-update:semver-patch"]
+    interval: weekly
+  open-pull-requests-limit: 1
+  groups:
+    rust:
+      patterns:
+        - "*"
+- package-ecosystem: "github-actions"
+  directory: "/"
+  target-branch: "main"
+  schedule:
+    interval: "weekly"
+  groups:
+    actions:
+      patterns:
+        - "*"
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
@@ -5,6 +5,12 @@ name: Create and publish a Docker image
 on:
   workflow_dispatch:
   push:
+    paths-ignore:
+      - .git*
+      - "**/*.md"
+      - .dockerignore
+      - LICENSE
+      - .github/**
     branches: ['main']
     tags:
       - 'v*'
@@ -43,7 +49,7 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349
@@ -83,7 +89,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: digests-${{ matrix.base-image }}-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
@@ -113,7 +119,7 @@ jobs:
           fi
 
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: /tmp/digests
           pattern: digests-${{ matrix.base-image }}-*

diff --git a/.github/workflows/release-draft.yml b/.github/workflows/release-draft.yml
@@ -10,54 +10,64 @@ env:
 
 jobs:
   build:
-    name: build packages
+    name: Build ${{ matrix.target }} package
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: debian-bookworm
+            dockerfile: Dockerfile-debian-bookworm
+            artifact-name: openwec-deb-bookworm-package
+            artifact-path: ./target/debian/*.deb
+            deb-suffix: _deb12
+          - target: debian-trixie
+            dockerfile: Dockerfile-debian-trixie
+            artifact-name: openwec-deb-trixie-package
+            artifact-path: ./target/debian/*.deb
+            deb-suffix: _deb13
+          - target: almalinux-9
+            dockerfile: Dockerfile-almalinux-9
+            artifact-name: openwec-alma-9-package
+            artifact-path: ./target/generate-rpm/*.rpm
+
     steps:
-    - uses: actions/checkout@v4
-    - name: Make debian bookworm package
-      run: |
-          cd build-pkg && \
-          docker build -t openwec-builder:debian-bookworm -f Dockerfile-debian-bookworm . && \
-          docker run -t -u $(id -u):$(id -g) -v $(pwd)/../:/SRC  \
-            --env CARGO_HOME=/SRC/target/.cargo openwec-builder:debian-bookworm \
-            sh -c "cargo build --release --locked && \
-                   cargo deb --no-build --manifest-path=./common/Cargo.toml" && \
-          for i in ../target/debian/*.deb; do mv "$i" "${i/.deb/_deb12.deb}"; done;
-    - name: Upload debian bookworm package
-      uses: actions/upload-artifact@v4
-      with:
-        name: openwec-deb-bookworm-package
-        path: ./target/debian/*.deb
-    - name: Make debian bullseye package
-      run: |
-          cargo clean && \
-          cd build-pkg && \
-          docker build -t openwec-builder:debian-bullseye -f Dockerfile-debian-bullseye . && \
-          docker run -t -u $(id -u):$(id -g) -v $(pwd)/../:/SRC  \
-            --env CARGO_HOME=/SRC/target/.cargo openwec-builder:debian-bullseye \
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Build Docker image
+        working-directory: build-pkg
+        run: docker build -t openwec-builder:${{ matrix.target }} -f ${{ matrix.dockerfile }} .
+
+      - name: Build Debian package
+        if: startsWith(matrix.target, 'debian')
+        run: |
+          docker run -t -u $(id -u):$(id -g) \
+            -v ${{ github.workspace }}:/SRC \
+            --env CARGO_HOME=/SRC/target/.cargo \
+            openwec-builder:${{ matrix.target }} \
             sh -c "cargo build --release --locked && \
-                   cargo deb --no-build --manifest-path=./common/Cargo.toml" && \
-          for i in ../target/debian/*.deb; do mv "$i" "${i/.deb/_deb11.deb}"; done;
-    - name: Upload debian bullseye package
-      uses: actions/upload-artifact@v4
-      with:
-        name: openwec-deb-bullseye-package
-        path: ./target/debian/*.deb
-    - name: Make almalinux 9 package
-      run: |
-          cargo clean && \
-          cd build-pkg && \
-          docker build -t openwec-builder:almalinux-9 -f Dockerfile-almalinux-9 . && \
-          docker run -t -u $(id -u):$(id -g) -v $(pwd)/../:/SRC  \
-            --env CARGO_HOME=/SRC/target/.cargo openwec-builder:almalinux-9 \
+                   cargo deb --no-build --manifest-path=./common/Cargo.toml"
+          for i in ./target/debian/*.deb; do mv "$i" "${i/.deb/${{ matrix.deb-suffix }}.deb}"; done
+
+      - name: Build RPM package
+        if: matrix.target == 'almalinux-9'
+        run: |
+          docker run -t -u $(id -u):$(id -g) \
+            -v ${{ github.workspace }}:/SRC \
+            --env CARGO_HOME=/SRC/target/.cargo \
+            openwec-builder:${{ matrix.target }} \
             sh -c "cargo build --release --locked && \
                    strip -s target/release/openwec{d,} && \
-                   cargo generate-rpm --package common --metadata-overwrite=./common/Cargo.toml --set-metadata=\"release='1.el9'\""
-    - name: Upload almalinux 9 package
-      uses: actions/upload-artifact@v4
-      with:
-        name: openwec-alma-9-package
-        path: ./target/generate-rpm/*.rpm
+                   cargo generate-rpm --package common \
+                     --metadata-overwrite=./common/Cargo.toml \
+                     --set-metadata=\"release='1.el9'\""
+
+      - name: Upload package
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${{ matrix.artifact-name }}
+          path: ${{ matrix.artifact-path }}
+
   # Need to select "Read and write permissions" under Actions / General / Workflow Permissions
   release:
     name: Github release draft
@@ -68,28 +78,28 @@ jobs:
       contents: write
     steps:
       - name: Download debian bookworm package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: openwec-deb-bookworm-package
-      - name: Download debian bullseye package
-        uses: actions/download-artifact@v4
+      - name: Download debian trixie package
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
-          name: openwec-deb-bullseye-package
+          name: openwec-deb-trixie-package
       - name: Download almalinux 9 package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: openwec-alma-9-package
       - name: Get artifacts names
         id: artifacts_names
         run: |
           echo "U_PKG_DEB_BOOKWORM=$(ls openwec*_deb12.deb)" >> "$GITHUB_OUTPUT" && \
-          echo "U_PKG_DEB_BULLSEYE=$(ls openwec*_deb11.deb)" >> "$GITHUB_OUTPUT" && \
+          echo "U_PKG_DEB_TRIXIE=$(ls openwec*_deb13.deb)" >> "$GITHUB_OUTPUT" && \
           echo "U_PKG_ALMA_9=$(ls openwec*el9*.rpm)" >> "$GITHUB_OUTPUT"
       - name: Create draft release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           draft: true
           files: |
             ${{ steps.artifacts_names.outputs.U_PKG_DEB_BOOKWORM }}
-            ${{ steps.artifacts_names.outputs.U_PKG_DEB_BULLSEYE }}
+            ${{ steps.artifacts_names.outputs.U_PKG_DEB_TRIXIE }}
             ${{ steps.artifacts_names.outputs.U_PKG_ALMA_9 }}
diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml
@@ -3,8 +3,20 @@ name: Build and run tests
 on:
   push:
     branches: [ main ]
+    paths-ignore:
+      - .git*
+      - "**/*.md"
+      - .dockerignore
+      - LICENSE
+      - .github/**
   pull_request:
     branches: [ main ]
+    paths-ignore:
+      - .git*
+      - "**/*.md"
+      - .dockerignore
+      - LICENSE
+      - .github/**
 
 env:
   CARGO_TERM_COLOR: always
@@ -37,7 +49,7 @@ jobs:
           - 5432:5432
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Install dependencies
       run: |
         apt-get update && \

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,19 +9,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- OTLP/gRPC output driver: forward Windows events to any OpenTelemetry-compatible collector endpoint, with optional gzip/zstd compression and configurable timeout
+- Support for multiple CA certificates in TLS configuration
+
+### Changed
+
+- Release package build pipeline refactored to run Debian and RPM builds in parallel (matrix strategy), reducing release wall-clock time
+- Debian Bullseye (11) build target replaced by Debian Trixie (13); Bullseye reached end-of-life August 2024
+- Alpine Docker base image upgraded to 3.24
+
+### Fixed
+
+- Upgraded dependencies to resolve RustSec security advisories
+- Adapted to breaking API changes in libgssapi 0.11 and redis 1.7
+- SQLite heartbeat UPSERT was not updating the client IP address on conflict
+
+## [v0.4.0]
+
+### Added
+
 - Add `max_elements` subscription parameter (#185)
 - Add an optional Prometheus endpoint that exposes metrics (#190)
 - Optionally wrap TCP stream in a TLS session in TCP driver (#203)
 - Support for SPNEGO authentication (#307)
 
-## Changed
+### Changed
 
 - Rework subscription filters (#186) (**Warning: this require a databatase migration**)
 - In formats `Json`, `Nxlog` and `RawJson`, `OpenWEC.Principal` is replaced by `OpenWEC.Client` (#186)
 - In `Files` driver, `{principal}` is replaced by `{client}` in `path` config (#186)
 - In access log pattern, `{X(principal)}` is replaced by `{X(client)}` (#186)
 
-## Removed
+### Removed
 
 - Subscription filters can no longer be created nor edited using the cli (#186)