[mashkovd]

Implements accepted proposal mctl-gitops/grafana-sql-rce-patch.

Spec: https://github.com/mctlhq/mctl-gitops/tree/main/platform-gitops/agents-state/mctl-gitops/proposals/grafana-sql-rce-patch/

Generated by mctl-agents Tier 2 implementer. Review carefully — this PR was opened automatically and the spec may have gaps.

[mashkovd]

@codex review

[mashkovd]

@copilot review

[Copilot]

@copilot review

Here's the review of the two changes in fb9a708:

platform-gitops/bootstrap/templates/observability/monitoring.yaml

✅ Correct file — Grafana is deployed via the victoria-metrics-k8s-stack chart here, not under platform-gitops/services/ as the design assumed.

✅ image.tag: "12.4.2" — right patch for the 12.4.x line per the CVE advisory (fixed in v12.1.10, v12.2.8, v12.3.6, v12.4.2, v13.0.0+).

✅ feature_toggles.sqlExpressions: "false" — correct Phase 1 mitigation placement inside the grafana.ini: block. Note: since the image pin is also in the same commit, the pod will restart on sync, so both changes take effect together.

⚠️ One minor: the commit bundles both Phase 1 (toggle) and Phase 2 (image bump) in a single commit. That's fine operationally, but means you can't independently roll back just the toggle. Low risk given they're tightly related.

Proposal state

🐛 Gap: .status.yaml was left as status: accepted — fixed in 6b1445e, now marked status: implemented.

Overall: the security change is correct and complete. Safe to merge.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".