Skip to content

chore: Add new pyroscope releases - #1160

Closed
observability-noctua-bot wants to merge 1 commit into
canonical:mainfrom
observability-noctua-bot:update-1784876120
Closed

chore: Add new pyroscope releases#1160
observability-noctua-bot wants to merge 1 commit into
canonical:mainfrom
observability-noctua-bot:update-1784876120

Conversation

@observability-noctua-bot

Copy link
Copy Markdown
Contributor

This is an automatic PR opened by the Observability Noctua bot.

@zhijie-yang zhijie-yang left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to the comments in #1159

@iamsharduld

iamsharduld commented Jul 29, 2026

Copy link
Copy Markdown

Thanks for the review.

The gate fails on two advisories: CVE-2026-56852 (golang.org/x/text) and GHSA-hrxh-6v49-42gf (google.golang.org/grpc). Both have fixes upstream, so we bumped them in the rock build rather than suppressing them: canonical/pyroscope-rock#58.

Worth noting neither is in the suppression list the 1.18.1 entry carries, so restoring that list would not have fixed this on its own.

With the bump, the same scan goes from exit 1 with 4 HIGH findings to exit 0 with none. Once #58 merges a replacement PR should open automatically, so this one can be closed in favour of that.

@zhijie-yang

Copy link
Copy Markdown
Collaborator

Thanks for the clarification. I'll leave this open until the replacement PR is raised.

@zhijie-yang

Copy link
Copy Markdown
Collaborator

Superseded by #1176

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

invalid This doesn't seem right pending cve

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants