Skip to content

fix: CVEs in release 3.7.x #21771

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sandeepsukhani wants to merge 8 commits into
base: release-3.7.x
Choose a base branch
from
Open

fix: CVEs in release 3.7.x #21771

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
793d551
update go version to 1.26.2
sandeepsukhani May 6, 2026
e9de076
update prometheus version
sandeepsukhani May 6, 2026
14eaca6
update build image to 0.35.1
sandeepsukhani May 6, 2026
cb29503
update alpine docker tag to v3.23.4
sandeepsukhani May 6, 2026
f172b63
update nix packages
sandeepsukhani May 6, 2026
6caedf5
consistently use go 1.26.2
sandeepsukhani May 7, 2026
569e854
fix: respect azure event hubs relabel drops
sandeepsukhani May 7, 2026
fcd3704
address review feedback
sandeepsukhani May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .github/workflows/build-loki-binary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ permissions:
contents: read

env:
GO_VERSION: "1.26.1"
GO_VERSION: "1.26.2"

jobs:
build:
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"loki-canary-boringcrypto-image":
"env":
"BUILD_TIMEOUT": 60
"GO_VERSION": "1.26.1"
"GO_VERSION": "1.26.2"
"IMAGE_PREFIX": "grafana"
"RELEASE_LIB_REF": "fb3b12ec3e6411bcb951a5ea08cc983c2f2735fc"
"RELEASE_REPO": "grafana/loki"
Expand Down Expand Up @@ -134,7 +134,7 @@
"loki-canary-image":
"env":
"BUILD_TIMEOUT": 60
"GO_VERSION": "1.26.1"
"GO_VERSION": "1.26.2"
"IMAGE_PREFIX": "grafana"
"RELEASE_LIB_REF": "fb3b12ec3e6411bcb951a5ea08cc983c2f2735fc"
"RELEASE_REPO": "grafana/loki"
Expand Down Expand Up @@ -258,7 +258,7 @@
"loki-image":
"env":
"BUILD_TIMEOUT": 60
"GO_VERSION": "1.26.1"
"GO_VERSION": "1.26.2"
"IMAGE_PREFIX": "grafana"
"RELEASE_LIB_REF": "fb3b12ec3e6411bcb951a5ea08cc983c2f2735fc"
"RELEASE_REPO": "grafana/loki"
Expand Down Expand Up @@ -382,7 +382,7 @@
"querytee-image":
"env":
"BUILD_TIMEOUT": 60
"GO_VERSION": "1.26.1"
"GO_VERSION": "1.26.2"
"IMAGE_PREFIX": "grafana"
"RELEASE_LIB_REF": "fb3b12ec3e6411bcb951a5ea08cc983c2f2735fc"
"RELEASE_REPO": "grafana/loki"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/logql-correctness.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
- name: Setup Go
uses: actions/setup-go@v4
with:
go-version: "1.26.1"
go-version: "1.26.2"

# The metastore generates invalid filenames for Windows (with colons),
# which get rejected by upload-artifact. We zip these files to avoid this
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
- name: Setup Go
uses: actions/setup-go@v4
with:
go-version: "1.26.1"
go-version: "1.26.2"

- name: Create results directory
run: mkdir -p ./pkg/logql/bench/results
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/querytee-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ permissions:
env:
BUILD_TIMEOUT: 60
IMAGE_PREFIX: grafana
GO_VERSION: "1.26.1"
GO_VERSION: "1.26.2"

jobs:
loki-query-tee-image:
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ DOCKER_INTERACTIVE_FLAGS := --tty --interactive
endif

# Ensure you run `make release-workflows` after changing this
GO_VERSION := 1.26.1
GO_VERSION := 1.26.2
# Ensure you run `make IMAGE_TAG=<updated-tag> build-image-push` after changing this
BUILD_IMAGE_TAG := 0.35.1

Expand Down
6 changes: 3 additions & 3 deletions clients/cmd/docker-driver/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG BUILD_IMAGE=grafana/loki-build-image:0.34.6
ARG BUILD_IMAGE=grafana/loki-build-image:0.35.1
ARG GOARCH=amd64
# Directories in this file are referenced from the root of the project not this folder
# This file is intended to be called from the root like so:
Expand All @@ -11,13 +11,13 @@ WORKDIR /src/loki
ARG GOARCH
RUN make clean && make BUILD_IN_CONTAINER=false GOARCH=${GOARCH} clients/cmd/docker-driver/docker-driver

FROM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS temp
FROM alpine:3.23.4@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS temp

ARG GOARCH

RUN apk add --update --no-cache --arch=${GOARCH} ca-certificates tzdata

FROM --platform=linux/${GOARCH} alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
FROM --platform=linux/${GOARCH} alpine:3.23.4@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

COPY --from=temp /etc/ca-certificates.conf /etc/ca-certificates.conf
COPY --from=temp /usr/share/ca-certificates /usr/share/ca-certificates
Expand Down
9 changes: 9 additions & 0 deletions clients/pkg/promtail/targets/azureeventhubs/parser.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ import (
"github.com/grafana/loki/v3/pkg/logproto"
)

// errEntryDropped is returned when a log entry is dropped by relabeling rules.
var errEntryDropped = errors.New("entry dropped by relabeling")

type azureMonitorResourceLogs struct {
Records []json.RawMessage `json:"records"`
}
Expand Down Expand Up @@ -143,6 +146,9 @@ func (e *messageParser) processRecords(labelSet model.LabelSet, relabels []*rela
result := make([]api.Entry, 0, len(records))
for _, m := range records {
entry, err := e.parseRecord(m, labelSet, relabels, useIncomingTimestamp, messageTime)
if errors.Is(err, errEntryDropped) {
continue
}
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -170,6 +176,9 @@ func (e *messageParser) parseRecord(record []byte, labelSet model.LabelSet, rela
}

logLabels := e.getLabels(logRecord, relabelConfig)
if logLabels == nil {
return api.Entry{}, errEntryDropped
}
ts := e.getTime(messageTime, useIncomingTimestamp, logRecord)

return api.Entry{
Expand Down
2 changes: 1 addition & 1 deletion cmd/logcli/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
ARG IMAGE_TAG
FROM golang:${GO_VERSION} AS build

Expand Down
2 changes: 1 addition & 1 deletion cmd/logql-analyzer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
FROM golang:${GO_VERSION} AS build

COPY . /src/loki
Expand Down
2 changes: 1 addition & 1 deletion cmd/loki-canary-boringcrypto/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
FROM golang:${GO_VERSION} as build
ARG IMAGE_TAG

Expand Down
2 changes: 1 addition & 1 deletion cmd/loki-canary/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26.1
ARG GO_VERSION=1.26.2
FROM golang:${GO_VERSION} AS build
ARG IMAGE_TAG

Expand Down
4 changes: 2 additions & 2 deletions cmd/loki-canary/Dockerfile.cross
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG BUILD_IMAGE=grafana/loki-build-image:0.34.8
ARG GO_VERSION=1.26.1
ARG BUILD_IMAGE=grafana/loki-build-image:0.35.1
ARG GO_VERSION=1.26.2
# Directories in this file are referenced from the root of the project not this folder
# This file is intended to be called from the root like so:
# docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
Expand Down
2 changes: 1 addition & 1 deletion cmd/loki/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2

# Go build stage
FROM golang:${GO_VERSION} AS build
Expand Down
2 changes: 1 addition & 1 deletion cmd/loki/Dockerfile.cross
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
# Directories in this file are referenced from the root of the project not this folder
# This file is intended to be called from the root like so:
# docker build -t grafana/loki -f cmd/loki/Dockerfile .
Expand Down
2 changes: 1 addition & 1 deletion cmd/loki/Dockerfile.debug
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG BUILD_IMAGE=grafana/loki-build-image:0.35.1
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
# Directories in this file are referenced from the root of the project not this folder
# This file is intended to be called from the root like so:
# docker build -t grafana/loki -f cmd/loki/Dockerfile.debug .
Expand Down
2 changes: 1 addition & 1 deletion cmd/migrate/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
FROM golang:${GO_VERSION} AS build
COPY . /src/loki
WORKDIR /src/loki
Expand Down
2 changes: 1 addition & 1 deletion cmd/querytee/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG GO_VERSION=1.26
ARG GO_VERSION=1.26.2
FROM golang:${GO_VERSION} AS build
ARG IMAGE_TAG

Expand Down
12 changes: 6 additions & 6 deletions flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading