Skip to content

Commit fd29374

Browse files
vtataivtatai
authored
build: bump vulnerable Go dependencies on release-8.5 (#1132)
* build: bump vulnerable Go dependencies * build: fix rulefmt.Parse API usage missed in cmd/main.go The prometheus v0.55->v0.312 bump changed the rulefmt.Parse signature and RuleNode->Rule (plain string fields). cmd/main.go was not updated, causing the govulncheck/compile failure reported in review. Also fixes a latent RuleNode cast in pkg/operator/rules.go that would panic at runtime.
1 parent 55bb5d4 commit fd29374

5 files changed

Lines changed: 257 additions & 237 deletions

File tree

‎cmd/main.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
goerrors "errors"
1919
"fmt"
2020
"io/ioutil"
21+
"log/slog"
2122
"net/http"
2223
"os"
2324
"path/filepath"
@@ -32,6 +33,7 @@ import (
3233
"github.com/pkg/errors"
3334
"github.com/prometheus/common/model"
3435
"github.com/prometheus/prometheus/model/rulefmt"
36+
"github.com/prometheus/prometheus/promql/parser"
3537
"github.com/spf13/cobra"
3638
"github.com/tidwall/gjson"
3739
"github.com/tidwall/sjson"
@@ -419,7 +421,7 @@ func exist(path string) bool {
419421
}
420422

421423
func replaceAlertExpr(content []byte) ([]byte, error) {
422-
groups, errs := rulefmt.Parse(content)
424+
groups, errs := rulefmt.Parse(content, false, model.NameValidationScheme, parser.NewParser(parser.Options{}), slog.Default())
423425
if len(errs) > 0 {
424426
return nil, goerrors.Join(errs...)
425427
}
@@ -429,29 +431,29 @@ func replaceAlertExpr(content []byte) ([]byte, error) {
429431
newG := rulefmt.RuleGroup{
430432
Interval: group.Interval,
431433
Name: group.Name,
432-
Rules: make([]rulefmt.RuleNode, 0, len(group.Rules)),
434+
Rules: make([]rulefmt.Rule, 0, len(group.Rules)),
433435
}
434436

435437
stream.OfSlice(group.Rules).Map(func(t streamtypes.T) streamtypes.R {
436-
rule := t.(rulefmt.RuleNode)
438+
rule := t.(rulefmt.Rule)
437439

438440
if time.Duration(rule.For) <= (time.Second * 60) {
439441
rule.For = forConfig
440442
}
441443

442-
newExpr, ok := needToReplaceExpr[strings.ToUpper(rule.Alert.Value)]
444+
newExpr, ok := needToReplaceExpr[strings.ToUpper(rule.Alert)]
443445
if !ok {
444446
return rule
445447
}
446448

447-
rule.Expr.SetString(newExpr)
449+
rule.Expr = newExpr
448450
if _, ok := rule.Labels["expr"]; ok {
449451
rule.Labels["expr"] = newExpr
450452
}
451453

452454
return rule
453455
}).ForEach(func(t streamtypes.T) {
454-
rule := t.(rulefmt.RuleNode)
456+
rule := t.(rulefmt.Rule)
455457
newG.Rules = append(newG.Rules, rule)
456458
})
457459

‎go.mod‎

Lines changed: 38 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,28 @@ module github.com/pingcap/monitoring
33
go 1.25.5
44

55
require (
6-
github.com/fsnotify/fsnotify v1.7.0
6+
github.com/fsnotify/fsnotify v1.10.1
77
github.com/gin-gonic/gin v1.10.0
88
github.com/go-git/go-git/v5 v5.13.0
99
github.com/google/go-github/v66 v66.0.0
10-
github.com/google/go-querystring v1.1.0
11-
github.com/hashicorp/go-version v1.7.0
10+
github.com/google/go-querystring v1.2.0
11+
github.com/hashicorp/go-version v1.9.0
1212
github.com/pkg/errors v0.9.1
13-
github.com/prometheus/common v0.59.1
14-
github.com/prometheus/prometheus v0.55.1
13+
github.com/prometheus/common v0.67.5
14+
github.com/prometheus/prometheus v0.312.0
1515
github.com/rakyll/statik v0.1.7
1616
github.com/spf13/cobra v1.8.1
1717
github.com/tidwall/gjson v1.18.0
1818
github.com/tidwall/sjson v1.2.5
1919
github.com/youthlin/stream v0.0.3
20-
golang.org/x/oauth2 v0.27.0
20+
golang.org/x/oauth2 v0.36.0
2121
gopkg.in/yaml.v3 v3.0.1
22-
k8s.io/client-go v0.31.14
22+
k8s.io/client-go v0.35.3
2323
)
2424

2525
require (
2626
dario.cat/mergo v1.0.0 // indirect
27-
github.com/Microsoft/go-winio v0.6.1 // indirect
27+
github.com/Microsoft/go-winio v0.6.2 // indirect
2828
github.com/ProtonMail/go-crypto v1.1.3 // indirect
2929
github.com/beorn7/perks v1.0.1 // indirect
3030
github.com/bytedance/sonic v1.11.6 // indirect
@@ -36,26 +36,22 @@ require (
3636
github.com/cyphar/filepath-securejoin v0.2.5 // indirect
3737
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
3838
github.com/dennwc/varint v1.0.0 // indirect
39-
github.com/edsrzf/mmap-go v1.1.0 // indirect
39+
github.com/edsrzf/mmap-go v1.2.1-0.20241212181136-fad1cd13edbd // indirect
4040
github.com/emirpasic/gods v1.18.1 // indirect
4141
github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb // indirect
42-
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
42+
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
4343
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
4444
github.com/gin-contrib/sse v0.1.0 // indirect
4545
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
4646
github.com/go-git/go-billy/v5 v5.6.0 // indirect
47-
github.com/go-kit/log v0.2.1 // indirect
48-
github.com/go-logfmt/logfmt v0.6.0 // indirect
49-
github.com/go-logr/logr v1.4.2 // indirect
47+
github.com/go-logr/logr v1.4.3 // indirect
5048
github.com/go-logr/stdr v1.2.2 // indirect
5149
github.com/go-playground/locales v0.14.1 // indirect
5250
github.com/go-playground/universal-translator v0.18.1 // indirect
5351
github.com/go-playground/validator/v10 v10.20.0 // indirect
5452
github.com/goccy/go-json v0.10.2 // indirect
55-
github.com/gogo/protobuf v1.3.2 // indirect
5653
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
57-
github.com/google/gofuzz v1.2.0 // indirect
58-
github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect
54+
github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853 // indirect
5955
github.com/inconshreveable/mousetrap v1.1.0 // indirect
6056
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
6157
github.com/json-iterator/go v1.1.12 // indirect
@@ -64,44 +60,45 @@ require (
6460
github.com/leodido/go-urn v1.4.0 // indirect
6561
github.com/mattn/go-isatty v0.0.20 // indirect
6662
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
67-
github.com/modern-go/reflect2 v1.0.2 // indirect
63+
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
6864
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
6965
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
7066
github.com/pjbgf/sha1cd v0.3.0 // indirect
71-
github.com/prometheus/client_golang v1.20.3 // indirect
72-
github.com/prometheus/client_model v0.6.1 // indirect
73-
github.com/prometheus/procfs v0.15.1 // indirect
67+
github.com/prometheus/client_golang v1.23.2 // indirect
68+
github.com/prometheus/client_model v0.6.2 // indirect
69+
github.com/prometheus/procfs v0.16.1 // indirect
7470
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
7571
github.com/skeema/knownhosts v1.3.0 // indirect
76-
github.com/spf13/pflag v1.0.5 // indirect
72+
github.com/spf13/pflag v1.0.10 // indirect
7773
github.com/tidwall/match v1.1.1 // indirect
7874
github.com/tidwall/pretty v1.2.0 // indirect
7975
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
8076
github.com/ugorji/go/codec v1.2.12 // indirect
8177
github.com/x448/float16 v0.8.4 // indirect
8278
github.com/xanzy/ssh-agent v0.3.3 // indirect
83-
go.opentelemetry.io/otel v1.29.0 // indirect
84-
go.opentelemetry.io/otel/metric v1.29.0 // indirect
85-
go.opentelemetry.io/otel/trace v1.29.0 // indirect
79+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
80+
go.opentelemetry.io/otel v1.44.0 // indirect
81+
go.opentelemetry.io/otel/metric v1.44.0 // indirect
82+
go.opentelemetry.io/otel/trace v1.44.0 // indirect
8683
go.uber.org/atomic v1.11.0 // indirect
84+
go.yaml.in/yaml/v2 v2.4.4 // indirect
85+
go.yaml.in/yaml/v3 v3.0.4 // indirect
8786
golang.org/x/arch v0.8.0 // indirect
88-
golang.org/x/crypto v0.36.0 // indirect
89-
golang.org/x/mod v0.20.0 // indirect
90-
golang.org/x/net v0.38.0 // indirect
91-
golang.org/x/sync v0.12.0 // indirect
92-
golang.org/x/sys v0.31.0 // indirect
93-
golang.org/x/term v0.30.0 // indirect
94-
golang.org/x/text v0.23.0 // indirect
95-
golang.org/x/time v0.6.0 // indirect
96-
golang.org/x/tools v0.24.0 // indirect
97-
google.golang.org/protobuf v1.34.2 // indirect
87+
golang.org/x/crypto v0.52.0 // indirect
88+
golang.org/x/net v0.55.0 // indirect
89+
golang.org/x/sys v0.45.0 // indirect
90+
golang.org/x/term v0.43.0 // indirect
91+
golang.org/x/text v0.37.0 // indirect
92+
golang.org/x/time v0.15.0 // indirect
93+
google.golang.org/protobuf v1.36.11 // indirect
9894
gopkg.in/inf.v0 v0.9.1 // indirect
9995
gopkg.in/warnings.v0 v0.1.2 // indirect
100-
gopkg.in/yaml.v2 v2.4.0 // indirect
101-
k8s.io/apimachinery v0.31.14 // indirect
102-
k8s.io/klog/v2 v2.130.1 // indirect
103-
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
104-
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
105-
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
106-
sigs.k8s.io/yaml v1.4.0 // indirect
96+
k8s.io/apimachinery v0.35.3 // indirect
97+
k8s.io/klog/v2 v2.140.0 // indirect
98+
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
99+
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
100+
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
101+
sigs.k8s.io/randfill v1.0.0 // indirect
102+
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
103+
sigs.k8s.io/yaml v1.6.0 // indirect
107104
)

0 commit comments

Comments
 (0)