-
Notifications
You must be signed in to change notification settings - Fork 11
PMM-14577 Fix CVEs by bump versions. #343
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,161 +1,168 @@ | ||
| module pmm-dump | ||
|
|
||
| go 1.24.9 | ||
| go 1.25.5 | ||
|
|
||
| require ( | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.27.1 | ||
| github.com/VictoriaMetrics/metricsql v0.76.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.42.0 | ||
| github.com/VictoriaMetrics/metricsql v0.84.8 | ||
| github.com/alecthomas/kingpin/v2 v2.4.0 | ||
| github.com/compose-spec/compose-go v1.20.2 | ||
| github.com/docker/docker v27.1.1+incompatible | ||
| github.com/docker/go-connections v0.5.0 | ||
| github.com/grafana/grafana v0.0.0-20240319182150-590c657828b5 | ||
| github.com/grafana/grafana-plugin-sdk-go v0.269.1 | ||
| github.com/docker/docker v28.5.2+incompatible | ||
| github.com/docker/go-connections v0.6.0 | ||
| github.com/grafana/grafana v1.9.2-0.20240724181030-49c756d77483 | ||
| github.com/grafana/grafana-plugin-sdk-go v0.284.0 | ||
| github.com/pkg/errors v0.9.1 | ||
| github.com/rs/zerolog v1.33.0 | ||
| github.com/rs/zerolog v1.34.0 | ||
| github.com/shirou/gopsutil/v3 v3.24.5 | ||
| github.com/valyala/fasthttp v1.55.0 | ||
| go.mongodb.org/mongo-driver v1.16.0 | ||
| golang.org/x/sync v0.17.0 | ||
| github.com/valyala/fasthttp v1.68.0 | ||
| go.mongodb.org/mongo-driver v1.17.6 | ||
| golang.org/x/sync v0.19.0 | ||
| gopkg.in/yaml.v2 v2.4.0 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/BurntSushi/toml v1.4.0 // indirect | ||
| github.com/ClickHouse/ch-go v0.61.5 // indirect | ||
| github.com/ClickHouse/ch-go v0.69.0 // indirect | ||
| github.com/Microsoft/go-winio v0.6.2 // indirect | ||
| github.com/VictoriaMetrics/metrics v1.34.0 // indirect | ||
| github.com/alecthomas/units v0.0.0-20231202071711-9a357b53e9c9 // indirect | ||
| github.com/andybalholm/brotli v1.1.1 // indirect | ||
| github.com/apache/arrow-go/v18 v18.0.1-0.20241212180703-82be143d7c30 // indirect | ||
| github.com/VictoriaMetrics/metrics v1.40.2 // indirect | ||
| github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect | ||
| github.com/andybalholm/brotli v1.2.0 // indirect | ||
| github.com/apache/arrow-go/v18 v18.5.0 // indirect | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/cenkalti/backoff/v4 v4.3.0 // indirect | ||
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/cheekybits/genny v1.0.0 // indirect | ||
| github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89 // indirect | ||
| github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect | ||
| github.com/clipperhouse/stringish v0.1.1 // indirect | ||
| github.com/clipperhouse/uax29/v2 v2.3.0 // indirect | ||
| github.com/containerd/errdefs v1.0.0 // indirect | ||
| github.com/containerd/errdefs/pkg v0.3.0 // indirect | ||
| github.com/distribution/reference v0.6.0 // indirect | ||
| github.com/docker/go-units v0.5.0 // indirect | ||
| github.com/elazarl/goproxy v1.7.2 // indirect | ||
| github.com/emicklei/go-restful/v3 v3.11.0 // indirect | ||
| github.com/fatih/color v1.15.0 // indirect | ||
| github.com/emicklei/go-restful/v3 v3.13.0 // indirect | ||
| github.com/fatih/color v1.18.0 // indirect | ||
| github.com/felixge/httpsnoop v1.0.4 // indirect | ||
| github.com/getkin/kin-openapi v0.129.0 // indirect | ||
| github.com/fxamacker/cbor/v2 v2.9.0 // indirect | ||
| github.com/go-faster/city v1.0.1 // indirect | ||
| github.com/go-faster/errors v0.7.1 // indirect | ||
| github.com/go-logr/logr v1.4.2 // indirect | ||
| github.com/go-logr/logr v1.4.3 // indirect | ||
| github.com/go-logr/stdr v1.2.2 // indirect | ||
| github.com/go-ole/go-ole v1.2.6 // indirect | ||
| github.com/go-openapi/jsonpointer v0.21.0 // indirect | ||
| github.com/go-openapi/jsonreference v0.20.4 // indirect | ||
| github.com/go-openapi/swag v0.23.0 // indirect | ||
| github.com/goccy/go-json v0.10.4 // indirect | ||
| github.com/go-ole/go-ole v1.3.0 // indirect | ||
| github.com/go-openapi/jsonpointer v0.22.4 // indirect | ||
| github.com/go-openapi/jsonreference v0.21.4 // indirect | ||
| github.com/go-openapi/swag v0.25.4 // indirect | ||
| github.com/go-openapi/swag/cmdutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/conv v0.25.4 // indirect | ||
| github.com/go-openapi/swag/fileutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/jsonname v0.25.4 // indirect | ||
| github.com/go-openapi/swag/jsonutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/loading v0.25.4 // indirect | ||
| github.com/go-openapi/swag/mangling v0.25.4 // indirect | ||
| github.com/go-openapi/swag/netutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/stringutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/typeutils v0.25.4 // indirect | ||
| github.com/go-openapi/swag/yamlutils v0.25.4 // indirect | ||
| github.com/goccy/go-json v0.10.5 // indirect | ||
| github.com/gogo/googleapis v1.4.1 // indirect | ||
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/golang/snappy v0.0.4 // indirect | ||
| github.com/google/flatbuffers v24.3.25+incompatible // indirect | ||
| github.com/google/gnostic-models v0.6.8 // indirect | ||
| github.com/golang/snappy v1.0.0 // indirect | ||
| github.com/google/flatbuffers v25.9.23+incompatible // indirect | ||
| github.com/google/gnostic-models v0.7.1 // indirect | ||
| github.com/google/go-cmp v0.7.0 // indirect | ||
| github.com/google/gofuzz v1.2.0 // indirect | ||
| github.com/google/uuid v1.6.0 // indirect | ||
| github.com/gorilla/mux v1.8.1 // indirect | ||
| github.com/grafana/grafana/pkg/apimachinery v0.0.0-20240226124929-648abdbd0ea4 // indirect | ||
| github.com/grafana/grafana/pkg/apimachinery v0.0.0-20251217073634-00ea4024a810 // indirect | ||
| github.com/grafana/otel-profiling-go v0.5.1 // indirect | ||
| github.com/grafana/pyroscope-go/godeltaprof v0.1.8 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.2.0 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect | ||
| github.com/grafana/pyroscope-go/godeltaprof v0.1.9 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect | ||
| github.com/hashicorp/go-hclog v1.6.3 // indirect | ||
| github.com/hashicorp/go-plugin v1.6.3 // indirect | ||
| github.com/hashicorp/yamux v0.1.1 // indirect | ||
| github.com/josharian/intern v1.0.0 // indirect | ||
| github.com/hashicorp/go-plugin v1.7.0 // indirect | ||
| github.com/hashicorp/yamux v0.1.2 // indirect | ||
| github.com/jaegertracing/jaeger-idl v0.6.0 // indirect | ||
| github.com/json-iterator/go v1.1.12 // indirect | ||
| github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6 // indirect | ||
| github.com/klauspost/compress v1.17.11 // indirect | ||
| github.com/klauspost/cpuid/v2 v2.2.9 // indirect | ||
| github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect | ||
| github.com/magefile/mage v1.15.0 // indirect | ||
| github.com/mailru/easyjson v0.7.7 // indirect | ||
| github.com/klauspost/compress v1.18.2 // indirect | ||
| github.com/klauspost/cpuid/v2 v2.3.0 // indirect | ||
| github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect | ||
| github.com/mattetti/filebuffer v1.0.1 // indirect | ||
| github.com/mattn/go-colorable v0.1.13 // indirect | ||
| github.com/mattn/go-isatty v0.0.19 // indirect | ||
| github.com/mattn/go-runewidth v0.0.13 // indirect | ||
| github.com/mattn/go-colorable v0.1.14 // indirect | ||
| github.com/mattn/go-isatty v0.0.20 // indirect | ||
| github.com/mattn/go-runewidth v0.0.19 // indirect | ||
| github.com/moby/docker-image-spec v1.3.1 // indirect | ||
| github.com/moby/sys/atomicwriter v0.1.0 // indirect | ||
| github.com/moby/term v0.5.2 // indirect | ||
| github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect | ||
| github.com/modern-go/reflect2 v1.0.2 // indirect | ||
| github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect | ||
| github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect | ||
| github.com/montanaflynn/stats v0.7.1 // indirect | ||
| github.com/morikuni/aec v1.1.0 // indirect | ||
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||
| github.com/oasdiff/yaml v0.0.0-20241210131133-6b86fb107d80 // indirect | ||
| github.com/oasdiff/yaml3 v0.0.0-20241210130736-a94c01f36349 // indirect | ||
| github.com/oklog/run v1.1.0 // indirect | ||
| github.com/oklog/run v1.2.0 // indirect | ||
| github.com/olekukonko/tablewriter v0.0.5 // indirect | ||
| github.com/opencontainers/go-digest v1.0.0 // indirect | ||
| github.com/opencontainers/image-spec v1.1.0 // indirect | ||
| github.com/paulmach/orb v0.11.1 // indirect | ||
| github.com/perimeterx/marshmallow v1.1.5 // indirect | ||
| github.com/pierrec/lz4/v4 v4.1.21 // indirect | ||
| github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect | ||
| github.com/prometheus/client_golang v1.20.5 // indirect | ||
| github.com/prometheus/client_model v0.6.1 // indirect | ||
| github.com/prometheus/common v0.62.0 // indirect | ||
| github.com/prometheus/procfs v0.15.1 // indirect | ||
| github.com/rivo/uniseg v0.3.4 // indirect | ||
| github.com/russross/blackfriday/v2 v2.1.0 // indirect | ||
| github.com/segmentio/asm v1.2.0 // indirect | ||
| github.com/opencontainers/image-spec v1.1.1 // indirect | ||
| github.com/paulmach/orb v0.12.0 // indirect | ||
| github.com/pierrec/lz4/v4 v4.1.22 // indirect | ||
| github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect | ||
| github.com/prometheus/client_golang v1.23.2 // indirect | ||
| github.com/prometheus/client_model v0.6.2 // indirect | ||
| github.com/prometheus/common v0.67.4 // indirect | ||
| github.com/prometheus/procfs v0.19.2 // indirect | ||
| github.com/segmentio/asm v1.2.1 // indirect | ||
| github.com/shopspring/decimal v1.4.0 // indirect | ||
| github.com/sirupsen/logrus v1.9.3 // indirect | ||
| github.com/spyzhov/ajson v0.9.0 // indirect | ||
| github.com/tklauser/go-sysconf v0.3.12 // indirect | ||
| github.com/tklauser/numcpus v0.6.1 // indirect | ||
| github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 // indirect | ||
| github.com/unknwon/com v1.0.1 // indirect | ||
| github.com/unknwon/log v0.0.0-20150304194804-e617c87089d3 // indirect | ||
| github.com/urfave/cli v1.22.16 // indirect | ||
| github.com/spyzhov/ajson v0.9.6 // indirect | ||
| github.com/tklauser/go-sysconf v0.3.16 // indirect | ||
| github.com/tklauser/numcpus v0.11.0 // indirect | ||
| github.com/valyala/bytebufferpool v1.0.0 // indirect | ||
| github.com/valyala/fastrand v1.1.0 // indirect | ||
| github.com/valyala/histogram v1.2.0 // indirect | ||
| github.com/x448/float16 v0.8.4 // indirect | ||
| github.com/xdg-go/pbkdf2 v1.0.0 // indirect | ||
| github.com/xdg-go/scram v1.1.2 // indirect | ||
| github.com/xdg-go/scram v1.2.0 // indirect | ||
| github.com/xdg-go/stringprep v1.0.4 // indirect | ||
| github.com/xhit/go-str2duration/v2 v2.1.0 // indirect | ||
| github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirect | ||
| github.com/xyproto/randomstring v1.2.0 // indirect | ||
| github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect | ||
| github.com/yusufpapurcu/wmi v1.2.4 // indirect | ||
| github.com/zeebo/assert v1.3.1 // indirect | ||
| github.com/zeebo/xxh3 v1.0.2 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.1.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.59.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect | ||
| go.opentelemetry.io/contrib/propagators/jaeger v1.34.0 // indirect | ||
| go.opentelemetry.io/contrib/samplers/jaegerremote v0.28.0 // indirect | ||
| go.opentelemetry.io/otel v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.34.0 // indirect | ||
| go.opentelemetry.io/proto/otlp v1.5.0 // indirect | ||
| golang.org/x/crypto v0.42.0 // indirect | ||
| golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect | ||
| golang.org/x/mod v0.27.0 // indirect | ||
| golang.org/x/net v0.44.0 // indirect | ||
| golang.org/x/sys v0.36.0 // indirect | ||
| golang.org/x/text v0.29.0 // indirect | ||
| golang.org/x/tools v0.36.0 // indirect | ||
| golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect | ||
| google.golang.org/grpc v1.70.0 // indirect | ||
| google.golang.org/protobuf v1.36.5 // indirect | ||
| gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.64.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect | ||
| go.opentelemetry.io/contrib/propagators/jaeger v1.39.0 // indirect | ||
| go.opentelemetry.io/contrib/samplers/jaegerremote v0.33.0 // indirect | ||
| go.opentelemetry.io/otel v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.39.0 // indirect | ||
| go.opentelemetry.io/proto/otlp v1.9.0 // indirect | ||
| go.yaml.in/yaml/v2 v2.4.3 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.46.0 // indirect | ||
| golang.org/x/exp v0.0.0-20251209150349-8475f28825e9 // indirect | ||
| golang.org/x/mod v0.31.0 // indirect | ||
| golang.org/x/net v0.48.0 // indirect | ||
| golang.org/x/sys v0.39.0 // indirect | ||
| golang.org/x/telemetry v0.0.0-20251215142616-e75fd47794af // indirect | ||
| golang.org/x/text v0.32.0 // indirect | ||
| golang.org/x/time v0.14.0 // indirect | ||
| golang.org/x/tools v0.40.0 // indirect | ||
| golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20251213004720-97cd9d5aeac2 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect | ||
| google.golang.org/grpc v1.77.0 // indirect | ||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| k8s.io/apimachinery v0.29.2 // indirect | ||
| gotest.tools/v3 v3.5.2 // indirect | ||
| k8s.io/apimachinery v0.34.3 // indirect | ||
| k8s.io/klog/v2 v2.130.1 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect | ||
| k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect | ||
| sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect | ||
| sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect | ||
| sigs.k8s.io/yaml v1.4.0 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect | ||
| k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect | ||
| sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect | ||
| sigs.k8s.io/randfill v1.0.0 // indirect | ||
| sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect | ||
| ) | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nicee, this resolves cves?
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is latest one I was able to find and it is working. One mentioned in CVE report: 1.9.2-0.20250521205822-0ba0b99665a9 is not existing for me. So I am going to check report if this one is fine.