Repository navigation
Upgrade logrus to v1.10.2 - #4
Merged
Merged
Conversation
Fixes GHSA-4f99-4q7p-p3gh, a DoS in Entry.Writer(). kcvm does not call Entry.Writer() but the vulnerable version was still flagged. logrus v1.10.2 requires Go 1.23, so the minimum Go version goes from 1.16 to 1.23.
Patch release for the logrus security upgrade.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades
github.com/sirupsen/logrusfrom v1.5.0 to v1.10.2 to fix the open Dependabot alert GHSA-4f99-4q7p-p3gh, a denial of service inEntry.Writer().kcvm never calls
Entry.Writer(), so it wasn't exploitable, but the vulnerable version was still flagged.Other changes
go.mod), because logrus v1.10.2 requires it. CI already builds with the latest stable Go. The README's build instructions are updated.go mod tidyalso bumped some indirect dependencies, the newer Go version madego.modlist them explicitly, andgolang.org/x/syswent from a 2019 snapshot to v0.13.0.Testing
go vet ./...andgo test ./...pass.kcvm initandkcvm usewith a missing version: info, warning and fatal log lines print as before.Release
Merging this PR publishes v0.3.1, a patch release for the security fix.
VERSIONis bumped fromv0.3.0tov0.3.1, and the README download example now points to v0.3.1.