Fix Grype CVEs: update logrus and prometheus/prometheus

- Update github.com/sirupsen/logrus v1.9.0 -> v1.9.3 in test/go.mod
  to fix GHSA-4f99-4q7p-p3gh (High)
- Update github.com/prometheus/prometheus v0.35.0 -> v0.311.3
  to fix GHSA-vffh-x6r8-xx99 (Medium)
- Run go mod tidy and go mod vendor to update vendor directory
This commit is contained in:
Bruno Chauvet
2026-05-03 10:05:37 -04:00
parent 45979bdf4e
commit 877b6d6908
279 changed files with 17765 additions and 29131 deletions
+88 -64
View File
@@ -1,4 +1,4 @@
# cloud.google.com/go/auth v0.17.0
# cloud.google.com/go/auth v0.18.2
## explicit; go 1.24.0
cloud.google.com/go/auth
cloud.google.com/go/auth/credentials
@@ -24,13 +24,13 @@ cloud.google.com/go/auth/oauth2adapt
# cloud.google.com/go/compute/metadata v0.9.0
## explicit; go 1.24.0
cloud.google.com/go/compute/metadata
# cloud.google.com/go/monitoring v1.24.2
## explicit; go 1.23.0
# cloud.google.com/go/monitoring v1.24.3
## explicit; go 1.24.0
cloud.google.com/go/monitoring/apiv3/v2
cloud.google.com/go/monitoring/apiv3/v2/monitoringpb
cloud.google.com/go/monitoring/internal
# cloud.google.com/go/trace v1.11.6
## explicit; go 1.23.0
# cloud.google.com/go/trace v1.11.7
## explicit; go 1.24.0
cloud.google.com/go/trace/apiv2
cloud.google.com/go/trace/apiv2/tracepb
cloud.google.com/go/trace/internal
@@ -125,8 +125,6 @@ github.com/euank/go-kmsg-parser/kmsgparser
# github.com/felixge/httpsnoop v1.0.4
## explicit; go 1.13
github.com/felixge/httpsnoop
# github.com/fsnotify/fsnotify v1.6.0
## explicit; go 1.16
# github.com/fxamacker/cbor/v2 v2.9.0
## explicit; go 1.20
github.com/fxamacker/cbor/v2
@@ -148,16 +146,52 @@ github.com/go-logr/stdr
## explicit; go 1.12
github.com/go-ole/go-ole
github.com/go-ole/go-ole/oleutil
# github.com/go-openapi/jsonpointer v0.21.0
## explicit; go 1.20
# github.com/go-openapi/jsonpointer v0.22.5
## explicit; go 1.24.0
github.com/go-openapi/jsonpointer
# github.com/go-openapi/jsonreference v0.20.2
## explicit; go 1.13
# github.com/go-openapi/jsonreference v0.21.4
## explicit; go 1.24.0
github.com/go-openapi/jsonreference
github.com/go-openapi/jsonreference/internal
# github.com/go-openapi/swag v0.23.0
## explicit; go 1.20
# github.com/go-openapi/swag v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag
# github.com/go-openapi/swag/cmdutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/cmdutils
# github.com/go-openapi/swag/conv v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/conv
# github.com/go-openapi/swag/fileutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/fileutils
# github.com/go-openapi/swag/jsonname v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/jsonname
# github.com/go-openapi/swag/jsonutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/jsonutils
github.com/go-openapi/swag/jsonutils/adapters
github.com/go-openapi/swag/jsonutils/adapters/ifaces
github.com/go-openapi/swag/jsonutils/adapters/stdlib/json
# github.com/go-openapi/swag/loading v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/loading
# github.com/go-openapi/swag/mangling v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/mangling
# github.com/go-openapi/swag/netutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/netutils
# github.com/go-openapi/swag/stringutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/stringutils
# github.com/go-openapi/swag/typeutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/typeutils
# github.com/go-openapi/swag/yamlutils v0.25.5
## explicit; go 1.24.0
github.com/go-openapi/swag/yamlutils
# github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
## explicit
github.com/golang/groupcache/lru
@@ -199,12 +233,12 @@ github.com/google/s2a-go/stream
# github.com/google/uuid v1.6.0
## explicit
github.com/google/uuid
# github.com/googleapis/enterprise-certificate-proxy v0.3.7
## explicit; go 1.23.0
# github.com/googleapis/enterprise-certificate-proxy v0.3.14
## explicit; go 1.24.11
github.com/googleapis/enterprise-certificate-proxy/client
github.com/googleapis/enterprise-certificate-proxy/client/util
# github.com/googleapis/gax-go/v2 v2.15.0
## explicit; go 1.23.0
# github.com/googleapis/gax-go/v2 v2.18.0
## explicit; go 1.25.0
github.com/googleapis/gax-go/v2
github.com/googleapis/gax-go/v2/apierror
github.com/googleapis/gax-go/v2/apierror/internal/proto
@@ -224,20 +258,12 @@ github.com/hpcloud/tail/winfile
# github.com/jmespath/go-jmespath v0.4.0
## explicit; go 1.14
github.com/jmespath/go-jmespath
# github.com/josharian/intern v1.0.0
## explicit; go 1.5
github.com/josharian/intern
# github.com/json-iterator/go v1.1.12
## explicit; go 1.12
github.com/json-iterator/go
# github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0
## explicit; go 1.16
github.com/lufia/plan9stats
# github.com/mailru/easyjson v0.7.7
## explicit; go 1.12
github.com/mailru/easyjson/buffer
github.com/mailru/easyjson/jlexer
github.com/mailru/easyjson/jwriter
# github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
## explicit
github.com/modern-go/concurrent
@@ -264,7 +290,7 @@ github.com/prometheus/client_golang/prometheus/promhttp/internal
# github.com/prometheus/client_model v0.6.2
## explicit; go 1.22.0
github.com/prometheus/client_model/go
# github.com/prometheus/common v0.67.4
# github.com/prometheus/common v0.67.5
## explicit; go 1.24.0
github.com/prometheus/common/expfmt
github.com/prometheus/common/model
@@ -273,8 +299,8 @@ github.com/prometheus/common/model
github.com/prometheus/procfs
github.com/prometheus/procfs/internal/fs
github.com/prometheus/procfs/internal/util
# github.com/prometheus/prometheus v0.35.0
## explicit; go 1.16
# github.com/prometheus/prometheus v0.311.3
## explicit; go 1.25.0
github.com/prometheus/prometheus/model/value
# github.com/prometheus/statsd_exporter v0.22.7
## explicit; go 1.17
@@ -340,14 +366,13 @@ go.opentelemetry.io/auto/sdk/internal/telemetry
## explicit; go 1.23.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal
# go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0
## explicit; go 1.23.0
# go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
## explicit; go 1.25.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconvutil
# go.opentelemetry.io/otel v1.41.0
## explicit; go 1.24.0
# go.opentelemetry.io/otel v1.42.0
## explicit; go 1.25.0
go.opentelemetry.io/otel
go.opentelemetry.io/otel/attribute
go.opentelemetry.io/otel/attribute/internal
@@ -358,30 +383,29 @@ go.opentelemetry.io/otel/internal/baggage
go.opentelemetry.io/otel/internal/errorhandler
go.opentelemetry.io/otel/internal/global
go.opentelemetry.io/otel/propagation
go.opentelemetry.io/otel/semconv/v1.20.0
go.opentelemetry.io/otel/semconv/v1.26.0
go.opentelemetry.io/otel/semconv/v1.30.0
go.opentelemetry.io/otel/semconv/v1.37.0
go.opentelemetry.io/otel/semconv/v1.39.0
# go.opentelemetry.io/otel/metric v1.41.0
## explicit; go 1.24.0
go.opentelemetry.io/otel/semconv/v1.40.0
go.opentelemetry.io/otel/semconv/v1.40.0/httpconv
# go.opentelemetry.io/otel/metric v1.42.0
## explicit; go 1.25.0
go.opentelemetry.io/otel/metric
go.opentelemetry.io/otel/metric/embedded
go.opentelemetry.io/otel/metric/noop
# go.opentelemetry.io/otel/trace v1.41.0
## explicit; go 1.24.0
# go.opentelemetry.io/otel/trace v1.42.0
## explicit; go 1.25.0
go.opentelemetry.io/otel/trace
go.opentelemetry.io/otel/trace/embedded
go.opentelemetry.io/otel/trace/internal/telemetry
go.opentelemetry.io/otel/trace/noop
# go.yaml.in/yaml/v2 v2.4.3
# go.yaml.in/yaml/v2 v2.4.4
## explicit; go 1.15
go.yaml.in/yaml/v2
# go.yaml.in/yaml/v3 v3.0.4
## explicit; go 1.16
go.yaml.in/yaml/v3
# golang.org/x/crypto v0.48.0
## explicit; go 1.24.0
# golang.org/x/crypto v0.49.0
## explicit; go 1.25.0
golang.org/x/crypto/chacha20
golang.org/x/crypto/chacha20poly1305
golang.org/x/crypto/cryptobyte
@@ -389,7 +413,7 @@ golang.org/x/crypto/cryptobyte/asn1
golang.org/x/crypto/hkdf
golang.org/x/crypto/internal/alias
golang.org/x/crypto/internal/poly1305
# golang.org/x/net v0.51.0
# golang.org/x/net v0.52.0
## explicit; go 1.25.0
golang.org/x/net/http/httpguts
golang.org/x/net/http2
@@ -399,8 +423,8 @@ golang.org/x/net/internal/httpcommon
golang.org/x/net/internal/httpsfv
golang.org/x/net/internal/timeseries
golang.org/x/net/trace
# golang.org/x/oauth2 v0.35.0
## explicit; go 1.24.0
# golang.org/x/oauth2 v0.36.0
## explicit; go 1.25.0
golang.org/x/oauth2
golang.org/x/oauth2/authhandler
golang.org/x/oauth2/google
@@ -411,11 +435,11 @@ golang.org/x/oauth2/google/internal/stsexchange
golang.org/x/oauth2/internal
golang.org/x/oauth2/jws
golang.org/x/oauth2/jwt
# golang.org/x/sync v0.19.0
## explicit; go 1.24.0
# golang.org/x/sync v0.20.0
## explicit; go 1.25.0
golang.org/x/sync/semaphore
# golang.org/x/sys v0.41.0
## explicit; go 1.24.0
# golang.org/x/sys v0.42.0
## explicit; go 1.25.0
golang.org/x/sys/cpu
golang.org/x/sys/plan9
golang.org/x/sys/unix
@@ -424,20 +448,20 @@ golang.org/x/sys/windows/registry
golang.org/x/sys/windows/svc
golang.org/x/sys/windows/svc/debug
golang.org/x/sys/windows/svc/eventlog
# golang.org/x/term v0.40.0
## explicit; go 1.24.0
# golang.org/x/term v0.41.0
## explicit; go 1.25.0
golang.org/x/term
# golang.org/x/text v0.34.0
## explicit; go 1.24.0
# golang.org/x/text v0.35.0
## explicit; go 1.25.0
golang.org/x/text/secure/bidirule
golang.org/x/text/transform
golang.org/x/text/unicode/bidi
golang.org/x/text/unicode/norm
# golang.org/x/time v0.14.0
## explicit; go 1.24.0
# golang.org/x/time v0.15.0
## explicit; go 1.25.0
golang.org/x/time/rate
# google.golang.org/api v0.258.0
## explicit; go 1.24.0
# google.golang.org/api v0.272.0
## explicit; go 1.25.0
google.golang.org/api/googleapi
google.golang.org/api/googleapi/transport
google.golang.org/api/internal
@@ -451,22 +475,22 @@ google.golang.org/api/option/internaloption
google.golang.org/api/support/bundler
google.golang.org/api/transport/grpc
google.golang.org/api/transport/http
# google.golang.org/genproto v0.0.0-20250603155806-513f23925822
## explicit; go 1.23.0
# google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d
## explicit; go 1.25.0
google.golang.org/genproto/googleapis/devtools/cloudtrace/v2
google.golang.org/genproto/googleapis/monitoring/v3
google.golang.org/genproto/googleapis/type/calendarperiod
google.golang.org/genproto/googleapis/type/timeofday
# google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217
## explicit; go 1.24.0
# google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7
## explicit; go 1.25.0
google.golang.org/genproto/googleapis/api
google.golang.org/genproto/googleapis/api/annotations
google.golang.org/genproto/googleapis/api/distribution
google.golang.org/genproto/googleapis/api/label
google.golang.org/genproto/googleapis/api/metric
google.golang.org/genproto/googleapis/api/monitoredres
# google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2
## explicit; go 1.24.0
# google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c
## explicit; go 1.25.0
google.golang.org/genproto/googleapis/rpc/code
google.golang.org/genproto/googleapis/rpc/errdetails
google.golang.org/genproto/googleapis/rpc/status