MaterializeInc · SangJunBak · Jun 20, 2025 · Jun 24, 2025 · Jun 24, 2025 · Jun 23, 2025
@@ -115,3 +115,42 @@ updates:
       update-types:
         - minor
         - patch
+- package-ecosystem: maven
+  directory: /test/lang/java
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 50
+  labels: [A-dependencies]
+  allow:
+    - dependency-name: "org.postgresql:postgresql"
+- package-ecosystem: nuget
+  directory: /test/lang/csharp/csharp-npgsql.csproj
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 50
+  labels: [A-dependencies]
+  allow:
+    - dependency-name: "npgsql"
+- package-ecosystem: npm
+  directory: /test/lang/js
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 50
+  labels: [A-dependencies]
+  allow:
+    - dependency-name: "pg"
+    - dependency-name: "@types/pg"
+- package-ecosystem: pip
+  directory: /test/lang/python
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 50
+  labels: [A-dependencies]
+- package-ecosystem: bundler
+  directory: /test/lang/ruby
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 50
+  labels: [A-dependencies]
+  allow:
+    - dependency-name: "pg"
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -341,7 +341,7 @@ reqwest-retry = { git = "https://github.com/MaterializeInc/reqwest-middleware.gi
 # Need to upstream a few PRs related to test builders.
 #
 # Note: All changes in our fork of tiberius should be pushed to the `mz_changes` branch.
-tiberius = { git = "https://github.com/MaterializeInc/tiberius", rev = "555076bc80087d21addb929948508c4e1a3c1fa7" }
+tiberius = { git = "https://github.com/MaterializeInc/tiberius", rev="64ca594cc22ed67d072c2d0110455da50539e1cd" }
 
 # BEGIN LINT CONFIG
 # DO NOT EDIT. Automatically generated by bin/gen-lints.

diff --git a/LICENSE b/LICENSE
@@ -13,7 +13,7 @@ Business Source License 1.1
 
 Licensor:                  Materialize, Inc.
 
-Licensed Work:             Materialize Version 20250620
+Licensed Work:             Materialize Version v0.147.13
                            The Licensed Work is © 2025 Materialize, Inc.
 
 Additional Use Grant:      Within a single installation of the Licensed Work,

@@ -117,7 +117,7 @@ sudo journalctl --merge --since "$(cat step_start_timestamp)" > journalctl-merge
 mapfile -t artifacts < <(printf "run.log\nkubectl-get-logs.log\nkubectl-get-logs-previous.log\nkubectl-get-events.log\nkubectl-get-all.log\nkubectl-describe-all.log\nkubectl-pods-with-nodes.log\nkubectl-get-events-kube-system.log\nkubectl-get-all-kube-system.log\nkubectl-describe-all-kube-system.log\njournalctl-merge.log\nkail-output.log\ntrufflehog.log\n"; find . -name 'junit_*.xml')
 artifacts_str=$(IFS=";"; echo "${artifacts[*]}")
 
-bin/ci-builder run stable trufflehog --no-update --no-verification --json --exclude-detectors=coda,dockerhub,box,npmtoken filesystem "${artifacts[@]}" | trufflehog_jq_filter_logs > trufflehog.log
+bin/ci-builder run stable trufflehog --no-update --no-verification --json --exclude-detectors=coda,dockerhub,box,npmtoken,github filesystem "${artifacts[@]}" | trufflehog_jq_filter_logs > trufflehog.log
 
 unset CI_EXTRA_ARGS # We don't want extra args for the annotation
 # Continue even if ci-annotate-errors fails

@@ -90,7 +90,7 @@ mapfile -t artifacts < <(printf "run.log\nservices.log\njournalctl-merge.log\nne
 artifacts_str=$(IFS=";"; echo "${artifacts[*]}")
 
 echo "--- Running trufflehog to scan artifacts for secrets"
-bin/ci-builder run stable trufflehog --no-update --no-verification --json --exclude-detectors=coda,dockerhub,box,npmtoken filesystem "${artifacts[@]}" | trufflehog_jq_filter_logs > trufflehog.log
+bin/ci-builder run stable trufflehog --no-update --no-verification --json --exclude-detectors=coda,dockerhub,box,npmtoken,github filesystem "${artifacts[@]}" | trufflehog_jq_filter_logs > trufflehog.log
 
 echo "Uploading log artifacts"
 unset CI_EXTRA_ARGS # We don't want extra args for the annotation

@@ -29,6 +29,7 @@ steps:
           composition: terraform
           run: aws-temporary
           args: ["--tag=$CI_MZ_VERSION", --no-run-testdrive-files]
+          ci-builder: stable
 
   - id: terraform-gcp-tag
     label: "Terraform + Helm Chart E2E on GCP (tagged)"
@@ -43,6 +44,7 @@ steps:
           composition: terraform
           run: gcp-temporary
           args: ["--tag=$CI_MZ_VERSION", --no-run-testdrive-files]
+          ci-builder: stable
 
   - id: terraform-azure-tag
     label: "Terraform + Helm Chart E2E on Azure (tagged)"
@@ -57,6 +59,7 @@ steps:
           composition: terraform
           run: azure-temporary
           args: ["--tag=$CI_MZ_VERSION", --no-run-testdrive-files]
+          ci-builder: stable
 
   - wait: ~
 

diff --git a/misc/helm-charts/operator/Chart.yaml b/misc/helm-charts/operator/Chart.yaml
@@ -12,6 +12,6 @@ name: materialize-operator
 description: Materialize Kubernetes Operator Helm Chart
 type: application
 version: v25.2.0-beta.1
-appVersion: v0.147.0-dev.0
+appVersion: v0.147.13
 icon: https://materialize.com/favicon.ico
 home: https://materialize.com
diff --git a/misc/helm-charts/operator/README.md b/misc/helm-charts/operator/README.md
@@ -1,6 +1,6 @@
 # Materialize Kubernetes Operator Helm Chart
 
-![Version: v25.2.0-beta.1](https://img.shields.io/badge/Version-v25.2.0--beta.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.147.0-dev.0](https://img.shields.io/badge/AppVersion-v0.147.0--dev.0-informational?style=flat-square)
+![Version: v25.2.0-beta.1](https://img.shields.io/badge/Version-v25.2.0--beta.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.147.13](https://img.shields.io/badge/AppVersion-v0.147.13-informational?style=flat-square)
 
 Materialize Kubernetes Operator Helm Chart
 
@@ -151,7 +151,7 @@ The following table lists the configurable parameters of the Materialize operato
 | `operator.clusters.defaultSizes.system` |  | ``"25cc"`` |
 | `operator.image.pullPolicy` | Policy for pulling the image: "IfNotPresent" avoids unnecessary re-pulling of images | ``"IfNotPresent"`` |
 | `operator.image.repository` | The Docker repository for the operator image | ``"materialize/orchestratord"`` |
-| `operator.image.tag` | The tag/version of the operator image to be used | ``"v0.146.0"`` |
+| `operator.image.tag` | The tag/version of the operator image to be used | ``"v0.147.13"`` |
 | `operator.nodeSelector` | Node selector to use for the operator pod | ``nil`` |
 | `operator.resources.limits` | Resource limits for the operator's CPU and memory | ``{"memory":"512Mi"}`` |
 | `operator.resources.requests` | Resources requested by the operator for CPU and memory | ``{"cpu":"100m","memory":"512Mi"}`` |
@@ -177,7 +177,7 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm
 
 ```shell
 helm install my-materialize-operator \
-  --set operator.image.tag=v0.147.0-dev.0 \
+  --set operator.image.tag=v0.147.13 \
   materialize/materialize-operator
 ```
 
@@ -212,7 +212,7 @@ metadata:
   name: 12345678-1234-1234-1234-123456789012
   namespace: materialize-environment
 spec:
-  environmentdImageRef: materialize/environmentd:v0.147.0-dev.0
+  environmentdImageRef: materialize/environmentd:v0.147.13
   backendSecretName: materialize-backend
   environmentdResourceRequirements:
     limits:

diff --git a/misc/helm-charts/operator/templates/deployment.yaml b/misc/helm-charts/operator/templates/deployment.yaml
@@ -25,6 +25,10 @@ spec:
       labels:
         {{- include "materialize-operator.selectorLabels" . | nindent 8 }}
     spec:
+      securityContext:
+        fsGroup: 999
+        runAsGroup: 999
+        runAsUser: 999
       serviceAccountName: {{ include "materialize-operator.serviceAccountName" . }}
       {{- if .Values.operator.nodeSelector }}
       nodeSelector:
@@ -81,7 +85,7 @@ spec:
         {{- if .Values.console.enabled }}
         - "--create-console"
         {{- end }}
-        - "--console-image-tag-default=25.2.1"
+        - "--console-image-tag-default=25.2.3"
         {{- range $key, $value := .Values.console.imageTagMapOverride }}
         - "--console-image-tag-map={{ $key }}={{ $value }}"
         {{- end }}
@@ -222,3 +226,12 @@ spec:
         {{- end }}
         resources:
           {{- toYaml .Values.operator.resources | nindent 10 }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          privileged: false
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
diff --git a/misc/helm-charts/operator/tests/deployment_test.yaml b/misc/helm-charts/operator/tests/deployment_test.yaml
@@ -17,7 +17,7 @@ tests:
       of: Deployment
   - equal:
       path: spec.template.spec.containers[0].image
-      value: materialize/orchestratord:v0.146.0
+      value: materialize/orchestratord:v0.147.13
   - equal:
       path: spec.template.spec.containers[0].imagePullPolicy
       value: IfNotPresent

diff --git a/misc/helm-charts/operator/values.yaml b/misc/helm-charts/operator/values.yaml
@@ -13,7 +13,7 @@ operator:
     # -- The Docker repository for the operator image
     repository: materialize/orchestratord
     # -- The tag/version of the operator image to be used
-    tag: v0.146.0
+    tag: v0.147.13
     # -- Policy for pulling the image: "IfNotPresent" avoids unnecessary re-pulling of images
     pullPolicy: IfNotPresent
 

diff --git a/misc/helm-charts/testing/materialize.yaml b/misc/helm-charts/testing/materialize.yaml
@@ -28,7 +28,7 @@ metadata:
   name: 12345678-1234-1234-1234-123456789012
   namespace: materialize-environment
 spec:
-  environmentdImageRef: materialize/environmentd:v0.147.0-dev.0
+  environmentdImageRef: materialize/environmentd:v0.147.13
   backendSecretName: materialize-backend
   authenticatorKind: None
   #balancerdExternalCertificateSpec:

diff --git a/misc/images/materialized-base/Dockerfile b/misc/images/materialized-base/Dockerfile
@@ -15,7 +15,7 @@
 # deployed to production, but the version needs to be bumped whenever features
 # that the console depends upon are removed (to a version of the console that
 # doesn't depend on those features).
-FROM materialize/console:25.2.1 AS console
+FROM materialize/console:25.2.3 AS console
 
 MZFROM ubuntu-base
 

@@ -189,6 +189,7 @@
 PRODUCT_LIMITS_FIND_IGNORE_RE = re.compile(
     rb"""
     ( Memory\ cgroup\ out\ of\ memory
+    | [Oo]ut\ [Oo]f\ [Mm]emory
     | limits-materialized .* \| .* fatal\ runtime\ error:\ stack\ overflow
     | limits-materialized .* \| .* has\ overflowed\ its\ stack
     )

diff --git a/misc/python/materialize/cli/helm_chart_version_bump.py b/misc/python/materialize/cli/helm_chart_version_bump.py
@@ -39,6 +39,7 @@ def main() -> int:
 
     yaml = YAML()
     yaml.preserve_quotes = True
+    yaml.width = 4096  # Don't introduce line breaks
 
     mods = [
         (

@@ -363,6 +363,7 @@ def env_vars(self) -> list[V1EnvVar]:
         )
 
         env = [
+            V1EnvVar(name="MZ_TEST_ONLY_DUMMY_SEGMENT_CLIENT", value="true"),
             V1EnvVar(name="MZ_SOFT_ASSERTIONS", value="1"),
             V1EnvVar(name="MZ_POD_NAME", value_from=value_from),
             V1EnvVar(name="AWS_REGION", value="minio"),

diff --git a/misc/python/materialize/mzcompose/services/materialized.py b/misc/python/materialize/mzcompose/services/materialized.py
@@ -114,6 +114,7 @@ def __init__(
 
         environment = [
             "MZ_NO_TELEMETRY=1",
+            "MZ_TEST_ONLY_DUMMY_SEGMENT_CLIENT=true",
             f"MZ_SOFT_ASSERTIONS={int(soft_assertions)}",
             # The following settings can not be baked in the default image, as they
             # are enabled for testing purposes only

diff --git a/misc/python/materialize/mzcompose/services/sql_server.py b/misc/python/materialize/mzcompose/services/sql_server.py
@@ -23,8 +23,10 @@ def __init__(
         # lowercase letters, base-10 digits and/or non-alphanumeric symbols.
         sa_password: str = DEFAULT_SA_PASSWORD,
         name: str = "sql-server",
-        image: str = "mcr.microsoft.com/mssql/server",
+        # 2017 mssql images core on OSx, 2019 is the earliest that has passed
+        image: str = "mcr.microsoft.com/mssql/server:2019-CU32-ubuntu-20.04",
         environment_extra: list[str] = [],
+        volumes_extra: list[str] = [],
     ) -> None:
         super().__init__(
             name=name,
@@ -34,6 +36,7 @@ def __init__(
                 # See See https://github.com/microsoft/mssql-docker/issues/802 for current status
                 "platform": "linux/amd64",
                 "ports": [1433],
+                "volumes": volumes_extra,
                 "environment": [
                     "ACCEPT_EULA=Y",
                     "MSSQL_PID=Developer",

@@ -135,4 +135,5 @@
     "exceeded recursion limit of 2048",
     "key cannot be null",  # expected, see PR materialize#25941
     "regexp_extract must specify at least one capture group",
+    "array_fill with arrays not yet supported",
 ]
diff --git a/misc/shlib/shlib.bash b/misc/shlib/shlib.bash
@@ -297,6 +297,8 @@ trufflehog_jq_filter_logs() {
     (.Raw | contains("jdbc:postgresql://127.0.0") | not) and
     (.Raw | contains("jdbc:postgresql://cockroach") | not) and
     (.Raw | contains("materialize:materialize") | not) and
+    (.Raw | contains("ExpirationReaper") | not) and
+    (.Raw | contains("[email protected]") | not) and
     .Raw != "[REDACTED]"
   )'
 }