jcoffey-dev
b7f99b49f2
GHSA-2v4p-qf9q-27wj is a panic in gRPC-Go's xDS routing interceptor: a request arriving with neither `:authority` nor `Host` indexes an empty slice, the per-RPC goroutine does not recover, and the process dies. High, and nine alerts, because nine go.mod files pin the same version -- eight directly, terraform indirectly. Nothing here was reachable. The interceptor is installed by `xds.NewGRPCServer`, which this repo never calls: the one production server is `grpc.NewServer(grpc.Creds(...))` in ingest/internal/grpcserver and the only other is a plain one in a searchclient test. That is also why security-scan has been green throughout -- govulncheck reports on reachability and found nothing on 1.83.1, while Dependabot reports on version ranges and found nine. Both were right. Taken anyway: it is a patch release, and the next advisory in this dependency may well land somewhere we do reach. `go mod tidy` carried the indirect requirements grpc 1.83.2 asks for -- x/net, x/text, x/sys and friends. No CI job builds or tests Go here, so all nine modules were built locally and api, ingest and enterprise tested with -count=1, since a cached pass would not have exercised the new version. The dependabot.yml is the other half. There was no config, so nothing opened a PR against any of this. Go majors stay out of the group, being import path changes rather than bumps.
68 lines
1.6 KiB
YAML
68 lines
1.6 KiB
YAML
version: 2
|
|
updates:
|
|
# Fifteen Go modules, each with its own go.mod and no workspace tying them
|
|
# together, so a single entry cannot reach them: `directories` with a glob
|
|
# is what covers the hack/ fixtures without listing every one by hand.
|
|
# Grouped, because the alternative is what prompted this file -- one
|
|
# advisory in a shared dependency opened nine separate alerts.
|
|
- package-ecosystem: gomod
|
|
directories:
|
|
- "/api"
|
|
- "/ingest"
|
|
- "/alerting"
|
|
- "/enterprise"
|
|
- "/proto"
|
|
- "/cli"
|
|
- "/terraform"
|
|
- "/deploy/operator"
|
|
- "/hack/*"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
# Majors stay out: a Go major is an import path change, never a bump.
|
|
go-minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
- package-ecosystem: cargo
|
|
directories:
|
|
- "/agent"
|
|
- "/search"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
groups:
|
|
cargo-minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
- package-ecosystem: npm
|
|
directory: "/web"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
groups:
|
|
npm-minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- "*"
|