Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

upgrade github.com/prometheus/client_golang #133

Merged
merged 3 commits into from
Jul 21, 2023
Merged

upgrade github.com/prometheus/client_golang #133

merged 3 commits into from
Jul 21, 2023

Conversation

zwartho
Copy link
Contributor

@zwartho zwartho commented Jun 29, 2023

Resolves #132

@zwartho
Copy link
Contributor Author

zwartho commented Jul 14, 2023

@madhuravius I've updated the go.sum entries. I believe these should allow the build tests to pass. Would you mind re-running the tests? Thank you

@zwartho
Copy link
Contributor Author

zwartho commented Jul 19, 2023

@UserNotFound @krallin Is there anything else I can do to help GTM before the next release? I've got an SLA for this CVE on 7/29 that I would prefer not to miss.

@UserNotFound
Copy link
Member

Hi @zwartho, our security team has reviewed the PR and approved it to help get you going, but if your vulnerability remediation policy requires updating within a specific timeframe, the repository includes build instruction in the Readme, as well as Makefile which you can use to build all of the platform binaries yourself the same as our release process.

Additionally, Prometheus is not core code to Supercronic, and was contributed by a member of the public -- do you use Prometheus? Is there a specific reason you chose prometheus/client_golang v1.15.0, when v1.15.1 and 1.16.0 have been released?

@UserNotFound UserNotFound merged commit d60fb65 into aptible:master Jul 21, 2023
@UserNotFound
Copy link
Member

https://github.com/aptible/supercronic/releases/tag/v0.2.26

arthurgeek referenced this pull request in arthurgeek/vaultwarden-fly Jul 23, 2023
@renovate
fix(github-release): update aptible/supercronic to v0.2.26 (#5)
681a271 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [aptible/supercronic](https://togithub.com/aptible/supercronic) |
patch | `v0.2.25` -> `v0.2.26` |

---

### Release Notes

<details>
<summary>aptible/supercronic (aptible/supercronic)</summary>

###
[`v0.2.26`](https://togithub.com/aptible/supercronic/releases/tag/v0.2.26)

[Compare
Source](https://togithub.com/aptible/supercronic/compare/v0.2.25...v0.2.26)

#### What's Changed

- Latest Go 1.20.x release by
[@&#8203;UserNotFound](https://togithub.com/UserNotFound) in
[https://github.com/aptible/supercronic/pull/134](https://togithub.com/aptible/supercronic/pull/134)
- upgrade github.com/prometheus/client_golang by
[@&#8203;zwartho](https://togithub.com/zwartho) in
[https://github.com/aptible/supercronic/pull/133](https://togithub.com/aptible/supercronic/pull/133)

#### New Contributors

- [@&#8203;zwartho](https://togithub.com/zwartho) made their first
contribution in
[https://github.com/aptible/supercronic/pull/133](https://togithub.com/aptible/supercronic/pull/133)

**Full Changelog**:
aptible/supercronic@v0.2.25...v0.2.26

### Installation Instructions

#### supercronic-linux-amd64

Add the following stanza to your Dockerfile to install
`supercronic-linux-amd64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-amd64
\
        SUPERCRONIC=supercronic-linux-amd64 \
        SUPERCRONIC_SHA1SUM=7a79496cf8ad899b99a719355d4db27422396735

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-386

Add the following stanza to your Dockerfile to install
`supercronic-linux-386`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-386
\
        SUPERCRONIC=supercronic-linux-386 \
        SUPERCRONIC_SHA1SUM=bcc522ec4ead6de0d564670f6499a88e35082d1f

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-arm
\
        SUPERCRONIC=supercronic-linux-arm \
        SUPERCRONIC_SHA1SUM=d8124540ebd8f19cc0d8a286ed47ac132e8d151d

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm64

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-arm64
\
        SUPERCRONIC=supercronic-linux-arm64 \
        SUPERCRONIC_SHA1SUM=e4801adb518ffedfd930ab3a82db042cb78a0a41

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on saturday" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/arthurgeek/vaultwarden-fly).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMS4wIiwidXBkYXRlZEluVmVyIjoiMzYuMTEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
arthurgeek referenced this pull request in arthurgeek/vaultwarden-fly-template Jul 23, 2023
@renovate
fix(github-release): update aptible/supercronic to v0.2.26 (#11)
bf762d8 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [aptible/supercronic](https://togithub.com/aptible/supercronic) |
patch | `v0.2.25` -> `v0.2.26` |

---

### Release Notes

<details>
<summary>aptible/supercronic (aptible/supercronic)</summary>

###
[`v0.2.26`](https://togithub.com/aptible/supercronic/releases/tag/v0.2.26)

[Compare
Source](https://togithub.com/aptible/supercronic/compare/v0.2.25...v0.2.26)

#### What's Changed

- Latest Go 1.20.x release by
[@&#8203;UserNotFound](https://togithub.com/UserNotFound) in
[https://github.com/aptible/supercronic/pull/134](https://togithub.com/aptible/supercronic/pull/134)
- upgrade github.com/prometheus/client_golang by
[@&#8203;zwartho](https://togithub.com/zwartho) in
[https://github.com/aptible/supercronic/pull/133](https://togithub.com/aptible/supercronic/pull/133)

#### New Contributors

- [@&#8203;zwartho](https://togithub.com/zwartho) made their first
contribution in
[https://github.com/aptible/supercronic/pull/133](https://togithub.com/aptible/supercronic/pull/133)

**Full Changelog**:
aptible/supercronic@v0.2.25...v0.2.26

### Installation Instructions

#### supercronic-linux-amd64

Add the following stanza to your Dockerfile to install
`supercronic-linux-amd64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-amd64
\
        SUPERCRONIC=supercronic-linux-amd64 \
        SUPERCRONIC_SHA1SUM=7a79496cf8ad899b99a719355d4db27422396735

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-386

Add the following stanza to your Dockerfile to install
`supercronic-linux-386`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-386
\
        SUPERCRONIC=supercronic-linux-386 \
        SUPERCRONIC_SHA1SUM=bcc522ec4ead6de0d564670f6499a88e35082d1f

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-arm
\
        SUPERCRONIC=supercronic-linux-arm \
        SUPERCRONIC_SHA1SUM=d8124540ebd8f19cc0d8a286ed47ac132e8d151d

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm64

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.26/supercronic-linux-arm64
\
        SUPERCRONIC=supercronic-linux-arm64 \
        SUPERCRONIC_SHA1SUM=e4801adb518ffedfd930ab3a82db042cb78a0a41

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on saturday" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/arthurgeek/vaultwarden-fly-template).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4xMS4wIiwidXBkYXRlZEluVmVyIjoiMzYuMTEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@zwartho
Copy link
Contributor Author

zwartho commented Jul 25, 2023

Thank you @madhuravius and @UserNotFound for getting this merged and released! Our compliance framework is pretty strict, so I appreciate your prompt response. Moving forward, I will be sure to modify my build process so that I can roll out my own remediations for any future vulnerabilities.

Yes, I am looking to explore Prometheus as a monitoring solution for a work-related project. I decided to go with prometheus/client_golang v1.15.0 as this was the minimum version bump required to remediate this specific vulnerability. With hindsight as 20/20, I should have at least used v1.15.1 and most likely could have gotten away with v1.16.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@madhuravius madhuravius madhuravius approved these changes

@krallin krallin Awaiting requested review from krallin krallin is a code owner

@UserNotFound UserNotFound Awaiting requested review from UserNotFound UserNotFound is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

CVE-2023-24535
3 participants
@zwartho @UserNotFound @madhuravius