Bump undertow-core from 2.2.10.Final to 2.2.12.Final - #90

…undertow-undertow-core-2.2.12.Final

Bump undertow-core from 2.2.10.Final to 2.2.12.Final

…p ci]

Bumps the go-modules group in /e2e-go with 2 updates: [github.com/moby/go-archive](https://github.com/moby/go-archive) and [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil).
Updates `github.com/moby/go-archive` from 0.2.1 to 0.3.2
Release notes

*Sourced from [github.com/moby/go-archive's releases](https://github.com/moby/go-archive/releases).*

> v0.3.2
> ------
>
> What's Changed
> --------------
>
> Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as `var/run -> /run`. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. [moby/go-archive#93](https://redirect.github.com/moby/go-archive/pull/93)
>
> **Full Changelog**: <moby/go-archive@v0.3.1...v0.3.2>
>
> v0.3.1
> ------
>
> Fixes
> -----
>
> This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting `etc/dnf/` without a preceding `etc/` entry could return `mkdirat etc/dnf: no such file or directory`.
>
> This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries.
>
> What's Changed
> --------------
>
> * archive: create implied parents for directory entries [moby/go-archive#92](https://redirect.github.com/moby/go-archive/pull/92)
> * archive: Tarballer.Go: suppress io.ErrClosedPipe logs on close [moby/go-archive#94](https://redirect.github.com/moby/go-archive/pull/94)
>
> **Full Changelog**: <moby/go-archive@v0.3.0...v0.3.1>
>
> v0.3.0
> ------
>
> Security
> --------
>
> This release fixes **CVE-2026-17106** / **[GHSA-hfg8-hc9c-6c3h](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)**, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.
>
> The issue affected `Unpack`, `UnpackLayer`, `Untar`, `UntarUncompressed`, and the `ApplyLayer` helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.
>
> What's Changed
> --------------
>
> * archive: harden tar extraction against path traversal [moby/go-archive#45](https://redirect.github.com/moby/go-archive/pull/45)
> * archive: do not follow reparse points in chtimes [moby/go-archive#90](https://redirect.github.com/moby/go-archive/pull/90)
> * archive: fix creation time updates on Windows [moby/go-archive#79](https://redirect.github.com/moby/go-archive/pull/79)
> * archive: minor cleanups and godoc touch-up [moby/go-archive#87](https://redirect.github.com/moby/go-archive/pull/87)
> * archive: RebaseArchiveEntries: fix archive path rebasing [moby/go-archive#43](https://redirect.github.com/moby/go-archive/pull/43)
>
> Test and CI changes
> -------------------
>
> * ci: enable dependabot for actions [moby/go-archive#81](https://redirect.github.com/moby/go-archive/pull/81)
> * archive: make breakoutErr unwrap its cause [moby/go-archive#91](https://redirect.github.com/moby/go-archive/pull/91)
> * archive: use filepath for filesystem paths in tests [moby/go-archive#80](https://redirect.github.com/moby/go-archive/pull/80)
> * archive: use filepath for filesystem paths in tests [moby/go-archive#80](https://redirect.github.com/moby/go-archive/pull/80)
>
> **Full Changelog**: <moby/go-archive@v0.2.1...v0.3.0>


Commits

* [`9e6d2c7`](moby/go-archive@9e6d2c7) Merge pull request [#93](https://redirect.github.com/moby/go-archive/issues/93) from thaJeztah/fix\_absolute\_symlinks
* [`4f6cd58`](moby/go-archive@4f6cd58) archive: resolve hardlinks through absolute symlinks
* [`e564ecc`](moby/go-archive@e564ecc) archive: resolve absolute symlinks within extraction root
* [`5bb8a45`](moby/go-archive@5bb8a45) Merge pull request [#94](https://redirect.github.com/moby/go-archive/issues/94) from thaJeztah/denoise
* [`1bec7ec`](moby/go-archive@1bec7ec) archive: Tarballer.Go: suppress io.ErrClosedPipe logs on close
* [`279fa6d`](moby/go-archive@279fa6d) Merge pull request [#92](https://redirect.github.com/moby/go-archive/issues/92) from thaJeztah/fix\_implied\_directories
* [`517985a`](moby/go-archive@517985a) archive: create implied parents for directory entries
* [`1c23372`](moby/go-archive@1c23372) Merge pull request [#43](https://redirect.github.com/moby/go-archive/issues/43) from thaJeztah/fix\_rebase\_from\_root
* [`8829a25`](moby/go-archive@8829a25) RebaseArchiveEntries: fix archive path rebasing
* [`c583b20`](moby/go-archive@c583b20) Merge pull request [#90](https://redirect.github.com/moby/go-archive/issues/90) from thaJeztah/chtimes\_nofollow
* Additional commits viewable in [compare view](moby/go-archive@v0.2.1...v0.3.2)
  
Updates `github.com/shirou/gopsutil/v4` from 4.26.6 to 4.26.7
Release notes

*Sourced from [github.com/shirou/gopsutil/v4's releases](https://github.com/shirou/gopsutil/releases).*

> v4.26.7
> -------
>
> What's Changed
> --------------
>
> ### cpu
>
> * fix: harden parsers against malformed/truncated input by [`@​shirou`](https://github.com/shirou) in [shirou/gopsutil#2109](https://redirect.github.com/shirou/gopsutil/pull/2109)
> * [cpu][windows]: compute cpu-total times from integer ticks by [`@​skartikey`](https://github.com/skartikey) in [shirou/gopsutil#2111](https://redirect.github.com/shirou/gopsutil/pull/2111)
> * [darwin][process]: fix errno handling and library lifetime on darwin by [`@​shirou`](https://github.com/shirou) in [shirou/gopsutil#2119](https://redirect.github.com/shirou/gopsutil/pull/2119)
> * [cpu][windows]: compute total counters from individual stats to handle processor groups correctly by [`@​srebhan`](https://github.com/srebhan) in [shirou/gopsutil#2125](https://redirect.github.com/shirou/gopsutil/pull/2125)
> * [cpu][windows]: harden the cpu-total computation added in [#2125](https://redirect.github.com/shirou/gopsutil/issues/2125) by [`@​shirou`](https://github.com/shirou) in [shirou/gopsutil#2128](https://redirect.github.com/shirou/gopsutil/pull/2128)
>
> ### net
>
> * fix(net): pad GetExtendedTcpTable buffer to prevent GC thrashing on Windows by [`@​HarshalPatel1972`](https://github.com/HarshalPatel1972) in [shirou/gopsutil#2108](https://redirect.github.com/shirou/gopsutil/pull/2108)
>
> ### process
>
> * process: implement Darwin IOCounters via proc\_pid\_rusage by [`@​DavRack`](https://github.com/DavRack) in [shirou/gopsutil#2117](https://redirect.github.com/shirou/gopsutil/pull/2117)
>
> ### other
>
> * feat: add psutil comparison tests for cpu, mem and load by [`@​shirou`](https://github.com/shirou) in [shirou/gopsutil#2114](https://redirect.github.com/shirou/gopsutil/pull/2114)
>
> New Contributors
> ----------------
>
> * [`@​DavRack`](https://github.com/DavRack) made their first contribution in [shirou/gopsutil#2117](https://redirect.github.com/shirou/gopsutil/pull/2117)
> * [`@​srebhan`](https://github.com/srebhan) made their first contribution in [shirou/gopsutil#2125](https://redirect.github.com/shirou/gopsutil/pull/2125)
>
> **Full Changelog**: <shirou/gopsutil@v4.26.6...v4.26.7>


Commits

* [`52a24c8`](shirou/gopsutil@52a24c8) Merge pull request [#2128](https://redirect.github.com/shirou/gopsutil/issues/2128) from shirou/feat/follow-up-2125
* [`268a953`](shirou/gopsutil@268a953) [cpu][windows]: harden the cpu-total computation added in [#2125](https://redirect.github.com/shirou/gopsutil/issues/2125)
* [`1e34da6`](shirou/gopsutil@1e34da6) Merge pull request [#2125](https://redirect.github.com/shirou/gopsutil/issues/2125) from srebhan/fix\_cpu\_windows\_total
* [`61f8802`](shirou/gopsutil@61f8802) Merge pull request [#2122](https://redirect.github.com/shirou/gopsutil/issues/2122) from shirou/dependabot/github\_actions/actions/checko...
* [`7fb4dcf`](shirou/gopsutil@7fb4dcf) Merge pull request [#2123](https://redirect.github.com/shirou/gopsutil/issues/2123) from shirou/dependabot/github\_actions/actions/setup-...
* [`ae7d91a`](shirou/gopsutil@ae7d91a) Merge pull request [#2119](https://redirect.github.com/shirou/gopsutil/issues/2119) from shirou/fix/darwin-errno-and-libcache
* [`49052a1`](shirou/gopsutil@49052a1) [darwin][process]: use a PID above PID\_MAX in the not-running tests
* [`991b238`](shirou/gopsutil@991b238) [darwin]: pass the remaining Go pointers as unsafe.Pointer on darwin
* [`b9930e2`](shirou/gopsutil@b9930e2) Merge pull request [#2124](https://redirect.github.com/shirou/gopsutil/issues/2124) from shirou/dependabot/github\_actions/actions/labele...
* [`38a01b4`](shirou/gopsutil@38a01b4) [cpu][windows]: compute total counters from individual stats to handle proces...
* Additional commits viewable in [compare view](shirou/gopsutil@v4.26.6...v4.26.7)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions

…l (DECISIONS ArcadeData#90)

ArcadeData#90 supersedes the single-setting half of ArcadeData#81: every timed write runs twice,
once relaxed and once strict. In scope, the six document operations, the three
graph writes, and the cross-model transaction; out of scope, bulk ingest and
every read path.

AN AXIS, NOT A SECOND MEASUREMENT INSIDE A CELL, because most engines cannot
switch per operation: ArcadeDB's txWalFlush is per database, SurrealDB's and
QuestDB's are server flags. So `runner.py --durability strict` is one flag, the
class reaches the client container as BENCH_DURABILITY and the server
containers as patched flags, and the row carries `durability_class`,
`durability_no_setting` and `durability_server_flags` beside the `durability`
string it already carried. The class is part of the run_id and of the canonical
key: without that a strict cell writes the same key as the relaxed one beside
it and the later silently shadows the earlier, which is the shadowing shape
make_paper_tables already documents twice.

READ BACK, NOT ASSERTED, ON BOTH SIDES, because a flag that does not take is
exactly what ArcadeData#81 was written after. ArcadeDB's value comes from
GlobalConfiguration.TX_WAL_FLUSH after the database is open (laptop A/B: the
JVM property gives 0 relaxed and 2 strict, and the engine says so); SQLite's
from PRAGMA journal_mode and PRAGMA synchronous; ArangoDB's from the
collection's own properties()["sync"]; the PostgreSQL family's from SHOW
synchronous_commit. stamp_durability takes the engine's string VERBATIM and
never re-maps it, so a relaxed answer to a strict request survives to the gate
instead of being upgraded into a claim. fairness_check F10b fails that row, and
fails a write cell that exists in only one class.

FOUR ENGINES HAVE NO KNOB, not three. ArcadeData#90 names Neo4j, DuckDB and LadybugDB;
the SurrealDB 3.2.4 server belongs with them and the reason is on the record
(ArcadeData#81's evidence: no SYNC_DATA and no SURREAL_DATASTORE token in the binary, and
none of its 110 SURREAL_* variables names sync, WAL, fsync or durability).
Giving it an invented flag would label its rows strict while changing nothing.
The four run once, declare it, and the page prints their one number in both
columns.

Laptop, l1tpc oltp at micro, one repetition, seven engines, both classes, strict
over relaxed on new-order p50: SQLite 48.4x, PostgreSQL 9.8x, SurrealDB
embedded 9.0x, ArcadeDB embedded 4.6x, MongoDB 1.8x, ArangoDB 1.7x, DuckDB
1.00x. Every one of the six write digests matched across both classes on every
engine, which is the other half of the check: a strict commit changes when a
write becomes durable, not what it wrote.

Also fixed here, found by the smoke: the lifecycle read digest was computed
before the measure() calls, so every row said "issues no read" while
read_action_ms sat beside it.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JB6Hg77dQVqABoTJmiUnV2

…eries (DECISIONS ArcadeData#89 as amended)

The cold question is about the SESSION, so the page prints one cold column per
table rather than one per query. Every lane now records `cold_first_query_ms`
and `cold_first_query_name` from the first query the cell ran after the
database opened; the per-query `cold_<q>_ms` fields stay, because a row
carrying more than the page prints is useful.

record_first_query uses setdefault rather than assignment, so a lane can call
it at the top of every query and only the first call sticks. That makes the
field mean what it says however a lane's loops are arranged, instead of
depending on someone remembering to call it once.

Two lanes needed a decision rather than a line. On the two vector lanes the
first query after the database opens is a WARMUP query, not the first timed
one, because the timed pass deliberately runs against an engine the warmup has
already touched; the warmup query is therefore the honest cold number and is
recorded as such while staying out of the percentiles. The cross-model
atomicity workload times an interrupted write and no query at all, and records
the reason; the lifecycle lane is itself the cold measurement and records that.

Also written down: no aggregated per-table statistic is published, on any
table. An arithmetic mean across queries whose times span five orders of
magnitude is the slowest query in disguise, a median across them moves when a
query is added, and the summary figure already carries the cross-table ratio
view.

CAMPAIGN.md gains the two-line queue recipe for ArcadeData#90's second cell, so a queue
script author does not have to derive it from the runner's help.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JB6Hg77dQVqABoTJmiUnV2

…decision

PROTOCOL: the numeric-measure declaration and the exact counts on the two
queries that could not see a lost row (ArcadeData#94); the query rules that follow from
ArcadeData#7609, ArcadeData#7610, and ArcadeData#7611; the pymongo attribute guard (F47); what answer
checking cannot prove when three engines share a dialect; writes at both
durability settings with ingest at one (ArcadeData#90, #90a) and the per-commit tax that
makes the ratio inverse to the relaxed path.

FAIRNESS: the two SurrealDB spellings of the triangle count under F4 (ArcadeData#93),
both classes measured under F10, and F9 corrected now that every row carries
the thermal fields.

CAMPAIGN, PAGE-SPEC, READING-RESULTS: the thermal fields, the power mode left
as it ships, and no protocol change pending (F45); the withheld served
time-series grouping; the row counts on the revenue queries.

COMPARATORS: the upstream issue numbers on the withdrawn analytics rows, the
SurrealDB embedded single-core and version facts, and the laptop durability
ratios with their caveat. PUBLISHING and RESULTS-MAP: KNOWN disagreements and
who reads what.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JB6Hg77dQVqABoTJmiUnV2

…, ts) index

Three comparator arms for the time-series lane, on SQLite's footing: no
time-series type, one table with a datetime field, the tag, the three
metrics, and a composite (host, ts) index defined before the load.

surrealdb_ts (SDK 2.0.0, core 2.3.10, SurrealKV) and surrealdb_ts_server
(3.2.4 on RocksDB, the pinned digest) run one SurrealQL text: time::floor
for the minute and hour buckets, d'...' datetime literals for the ranges,
and the grouped-ordered-limited query as a subquery, because core 2.3.10
sorts by the group key ascending after GROUP BY and would take the wrong
five buckets (BUGS F31 again); 3.2.4 answers both spellings in the same
time. The served arm goes through the reconnecting client (DECISIONS ArcadeData#91),
the timed loop drops a sample taken across a reconnect, and every SurrealDB
row records `reconnects`.

arangodb_ts (3.12.11, the pinned digest) holds ts as epoch milliseconds,
a persistent index over ["host", "ts"], DATE_TRUNC for the buckets, and
the collection is created with waitForSync at the cell's class and read
back (DECISIONS ArcadeData#90, ArcadeData#81).

Laptop smoke through runner.py (ts100, one rep, BENCH_QITER=3, cpuset
0-11, results/runs_ts_plain.jsonl, untracked): all three cells ok, every
query returned the expected shape (1 / 60 / 12 / 1200 / 32,944 / 5 rows,
100 hosts x 12 buckets), and equivalence_check over these rows plus the
skeleton's reports every digest equal to the engines already on the table
(32 groups agreeing, 0 failures; the one KNOWN entry is the pre-existing
arcadedb_ts_native_server q_groupby). Laptop numbers are smoke, not record.

Registries: runner BACKENDS and LANES["l4"], export_web display names,
L4_CANON_LABELS, order and deployment, fairness_check UNVERIFIED_ALLOWED
for the served SurrealDB arm, and one COMPARATORS.md role per engine.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JB6Hg77dQVqABoTJmiUnV2