Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update github.com/grafana/loki digest to f67fff3 [security] (release-2.9.x) #11262

Closed
wants to merge 1 commit into from
Closed

fix(deps): update github.com/grafana/loki digest to f67fff3 [security] (release-2.9.x) #11262

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 20, 2023 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/grafana/loki require digest 4e4359e -> f67fff3
github.com/grafana/loki require digest 90888a0 -> f67fff3

GitHub Vulnerability Alerts

CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from a team as a code owner November 20, 2023 10:06
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Nov 20, 2023
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 30d0030 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 5535267 [security] (release-2.9.x) Nov 20, 2023
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from 9e0a989 to 56667de Compare November 20, 2023 12:01
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5535267 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 6a62b8c [security] (release-2.9.x) Nov 20, 2023
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from 56667de to 762e723 Compare November 20, 2023 12:59
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 6a62b8c [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 6a62b8c [security] (release-2.9.x) - autoclosed Nov 20, 2023
@renovate renovate bot closed this Nov 20, 2023
@renovate renovate bot deleted the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch November 20, 2023 14:52
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 6a62b8c [security] (release-2.9.x) - autoclosed fix(deps): update github.com/grafana/loki digest to 6a62b8c [security] (release-2.9.x) Nov 20, 2023
@renovate renovate bot reopened this Nov 20, 2023
@renovate renovate bot restored the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch November 20, 2023 15:22
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from 762e723 to a47dd36 Compare November 20, 2023 15:25
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 6a62b8c [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 8d34f85 [security] (release-2.9.x) Nov 20, 2023
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from a47dd36 to 01ee193 Compare November 20, 2023 16:20
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 8d34f85 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 8d34f85 [security] (release-2.9.x) - autoclosed Nov 20, 2023
@renovate renovate bot closed this Nov 20, 2023
@renovate renovate bot deleted the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch November 20, 2023 20:14
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 8d34f85 [security] (release-2.9.x) - autoclosed fix(deps): update github.com/grafana/loki digest to 8d34f85 [security] (release-2.9.x) Nov 20, 2023
@renovate renovate bot reopened this Nov 20, 2023
@renovate renovate bot restored the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch November 20, 2023 21:47
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 8d34f85 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 5f4a719 [security] (release-2.9.x) Nov 20, 2023
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from 01ee193 to ce2a5ac Compare November 20, 2023 21:52
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5f4a719 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 5f4a719 [security] (release-2.9.x) - autoclosed Nov 20, 2023
@renovate renovate bot closed this Nov 20, 2023
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from 013bcaf to b754e59 Compare December 9, 2023 13:55
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) - autoclosed Dec 9, 2023
@renovate renovate bot closed this Dec 9, 2023
@renovate renovate bot deleted the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 9, 2023 22:40
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) - autoclosed fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) Dec 10, 2023
@renovate renovate bot reopened this Dec 10, 2023
@renovate renovate bot restored the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 10, 2023 06:56
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from b754e59 to cfdef71 Compare December 10, 2023 06:57
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) - autoclosed Dec 10, 2023
@renovate renovate bot closed this Dec 10, 2023
@renovate renovate bot deleted the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 10, 2023 15:53
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) - autoclosed fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) Dec 10, 2023
@renovate renovate bot restored the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 10, 2023 22:54
@renovate renovate bot reopened this Dec 10, 2023
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from cfdef71 to 12862a1 Compare December 10, 2023 22:55
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) - autoclosed Dec 11, 2023
@renovate renovate bot closed this Dec 11, 2023
@renovate renovate bot deleted the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 11, 2023 04:37
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) - autoclosed fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) Dec 11, 2023
@renovate renovate bot reopened this Dec 11, 2023
@renovate renovate bot restored the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 11, 2023 12:32
@renovate renovate bot force-pushed the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch from 12862a1 to b3ac7d4 Compare December 11, 2023 12:34
@renovate renovate bot changed the title fix(deps): update github.com/grafana/loki digest to 5e34967 [security] (release-2.9.x) fix(deps): update github.com/grafana/loki digest to f67fff3 [security] (release-2.9.x) Dec 11, 2023
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Dec 11, 2023

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: tools/lambda-promtail/go.sum
Command failed: go mod tidy
go: finding module for package github.com/googleapis/gnostic/openapiv2
go: finding module for package k8s.io/apimachinery/pkg/util/clock
go: found github.com/googleapis/gnostic/openapiv2 in github.com/googleapis/gnostic v0.7.0
go: main/lambda-promtail imports
	github.com/grafana/loki/pkg/logproto imports
	github.com/grafana/loki/pkg/querier/plan imports
	github.com/grafana/loki/pkg/logql/syntax imports
	github.com/prometheus/prometheus/promql imports
	github.com/prometheus/prometheus/util/teststorage imports
	github.com/prometheus/prometheus/tsdb imports
	github.com/prometheus/prometheus/config tested by
	github.com/prometheus/prometheus/config.test imports
	github.com/prometheus/prometheus/discovery/kubernetes imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/discovery imports
	github.com/googleapis/gnostic/openapiv2: github.com/googleapis/[email protected]: parsing go.mod:
	module declares its path as: github.com/google/gnostic
	        but was required as: github.com/googleapis/gnostic

@periklis periklis closed this Dec 11, 2023
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Dec 11, 2023

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the github.com/grafana/loki f67fff3 update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the deps-update/release-2.9.x-go-github.com/grafana/loki-vulnerability branch December 11, 2023 14:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@periklis periklis Awaiting requested review from periklis periklis is a code owner

@xperimental xperimental Awaiting requested review from xperimental xperimental is a code owner

Assignees
No one assigned
Labels
area/security dependencies Pull requests that update a dependency file sig/operator size/XL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@periklis