public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[release-11.2.9] Go: Bump to 1.24.2 (#103529)

Browse Source 
* Go: Bump to 1.24.2

It is not likely we are actually affected by the CVEs, but updating proactively is not a bad idea nonetheless.

Fixes: CVE-2025-22871
Fixes: https://github.com/grafana/grafana-operator-experience-squad/issues/1311

* CI: Update golangci-lint

(cherry picked from commit 1c4284a8b4)
This commit is contained in:
Mariell Hoversholm
2025-04-09 09:16:47 +02:00
committed by GitHub
parent 764c23ce65
commit ea451c645b
30 changed files with 268 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/datasources.go
+1 -1
View File
@@ -407,7 +407,7 @@ func validateLBACHeader(headervalue string) bool {
return false
}
match := pattern.FindSubmatch([]byte(strings.TrimSpace(headervalue)))
if match == nil || len(match) < 2 {
if len(match) < 2 {
return false
}
_, err = parser.ParseMetricSelector(string(match[1]))
pkg/apimachinery/go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/apimachinery
go 1.23.7
go 1.24.2
require (
github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1
pkg/apiserver/go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/apiserver
go 1.23.7
go 1.24.2
require (
github.com/google/go-cmp v0.6.0
pkg/apiserver/go.sum
-2
View File
@@ -51,8 +51,6 @@ github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZ
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo=
github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
pkg/build/go.mod
+2 -5
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/build
go 1.23.7
go 1.24.2
// Override docker/docker to avoid:
// go: github.com/drone-runners/drone-runner-docker@v1.8.2 requires
@@ -91,10 +91,7 @@ require (
gopkg.in/yaml.v2 v2.4.0 // indirect
)
require (
dagger.io/dagger v0.11.8-rc.2
docker.io/go-docker v1.0.0
)
require dagger.io/dagger v0.11.8-rc.2
require (
cloud.google.com/go/longrunning v0.5.12 // indirect
pkg/build/go.sum
-2
View File
@@ -15,8 +15,6 @@ cloud.google.com/go/storage v1.43.0 h1:CcxnSohZwizt4LCzQHWvBf1/kvtHUn7gk9QERXPyX
cloud.google.com/go/storage v1.43.0/go.mod h1:ajvxEa7WmZS1PxvKRq4bq0tFT3vMd502JwstCcYv0Q0=
dagger.io/dagger v0.11.8-rc.2 h1:HCP3gXgAfJJBFitJm0jRdKWJsIKgSWNmVN9UV+CkOdk=
dagger.io/dagger v0.11.8-rc.2/go.mod h1:kIzxLfN8N8FXUCN9u5EHLBJUJMJm0t6XynecUzp0A5w=
docker.io/go-docker v1.0.0 h1:VdXS/aNYQxyA9wdLD5z8Q8Ro688/hG8HzKxYVEVbE6s=
docker.io/go-docker v1.0.0/go.mod h1:7tiAn5a0LFmjbPDbyTPOaTTOuG1ZRNXdPA6RvKY+fpY=
github.com/99designs/basicauth-go v0.0.0-20160802081356-2a93ba0f464d/go.mod h1:3cARGAK9CfW3HoxCy1a0G4TKrdiKke8ftOMEOHyySYs=
github.com/99designs/gqlgen v0.17.44 h1:OS2wLk/67Y+vXM75XHbwRnNYJcbuJd4OBL76RX3NQQA=
github.com/99designs/gqlgen v0.17.44/go.mod h1:UTCu3xpK2mLI5qcMNw+HKDiEL77it/1XtAjisC4sLwM=
pkg/build/wire/go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/build/wire
go 1.23.7
go 1.24.2
require (
github.com/google/go-cmp v0.6.0
pkg/promlib/go.mod
+3 -3
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/promlib
go 1.23.7
go 1.24.2
require (
github.com/grafana/grafana-plugin-sdk-go v0.241.0
@@ -105,8 +105,8 @@ require (
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.53.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.28.0 // indirect
go.opentelemetry.io/contrib/samplers/jaegerremote v0.20.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.29.0 // indirect
go.opentelemetry.io/contrib/samplers/jaegerremote v0.23.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.34.0 // indirect
pkg/promlib/go.sum
+2 -4
View File
@@ -266,10 +266,8 @@ go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.53.0/go.mod h1:ImRBLMJv177/pwiLZ7tU7HDGNdBv7rS0HQ99eN/zBl8=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
go.opentelemetry.io/contrib/propagators/jaeger v1.28.0 h1:xQ3ktSVS128JWIaN1DiPGIjcH+GsvkibIAVRWFjS9eM=
go.opentelemetry.io/contrib/propagators/jaeger v1.28.0/go.mod h1:O9HIyI2kVBrFoEwQZ0IN6PHXykGoit4mZV2aEjkTRH4=
go.opentelemetry.io/contrib/samplers/jaegerremote v0.20.0 h1:ja+d7Aea/9PgGxB63+E0jtRFpma717wubS0KFkZpmYw=
go.opentelemetry.io/contrib/samplers/jaegerremote v0.20.0/go.mod h1:Yc1eg51SJy7xZdOTyg1xyFcwE+ghcWh3/0hKeLo6Wlo=
go.opentelemetry.io/contrib/propagators/jaeger v1.29.0 h1:+YPiqF5rR6PqHBlmEFLPumbSP0gY0WmCGFayXRcCLvs=
go.opentelemetry.io/contrib/samplers/jaegerremote v0.23.0 h1:qKi9ntCcronqWqfuKxqrxZlZd82jXJEgGiAWH1+phxo=
go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
pkg/semconv/go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/semconv
go 1.23.7
go 1.24.2
require go.opentelemetry.io/otel v1.34.0
pkg/services/encryption/provider/cipher_aescfb.go
+1
View File
@@ -38,6 +38,7 @@ func (c aesCfbCipher) Encrypt(_ context.Context, payload []byte, secret string)
return nil, err
}
//nolint:staticcheck // SA1019: We're not changing away from CFB in older versions
stream := cipher.NewCFBEncrypter(block, iv)
stream.XORKeyStream(ciphertext[encryption.SaltLength+aes.BlockSize:], payload)
pkg/services/encryption/provider/decipher_aes.go
+1
View File
@@ -59,6 +59,7 @@ func decryptCFB(block cipher.Block, payload []byte) ([]byte, error) {
payload = payload[encryption.SaltLength+aes.BlockSize:]
payloadDst := make([]byte, len(payload))
//nolint:staticcheck // SA1019: We're not changing away from CFB in older versions
stream := cipher.NewCFBDecrypter(block, iv)
// XORKeyStream can work in-place if the two arguments are the same.
pkg/storage/unified/resource/go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/storage/unified/resource
go 1.23.7
go 1.24.2
require (
github.com/fullstorydev/grpchan v1.1.1
pkg/util/encryption.go
+2
View File
@@ -102,6 +102,7 @@ func decryptCFB(block cipher.Block, payload []byte) ([]byte, error) {
payload = payload[saltLength+aes.BlockSize:]
payloadDst := make([]byte, len(payload))
//nolint:staticcheck // SA1019: We're not changing away from CFB in older versions
stream := cipher.NewCFBDecrypter(block, iv)
// XORKeyStream can work in-place if the two arguments are the same.
@@ -136,6 +137,7 @@ func Encrypt(payload []byte, secret string) ([]byte, error) {
return nil, err
}
//nolint:staticcheck // SA1019: We're not changing away from CFB in older versions
stream := cipher.NewCFBEncrypter(block, iv)
stream.XORKeyStream(ciphertext[saltLength+aes.BlockSize:], payload)
pkg/util/xorm/go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/grafana/grafana/pkg/util/xorm
go 1.23.7
go 1.24.2
require (
github.com/mattn/go-sqlite3 v1.14.22