Fix Grype CVEs: update logrus and prometheus/prometheus

- Update github.com/sirupsen/logrus v1.9.0 -> v1.9.3 in test/go.mod
  to fix GHSA-4f99-4q7p-p3gh (High)
- Update github.com/prometheus/prometheus v0.35.0 -> v0.311.3
  to fix GHSA-vffh-x6r8-xx99 (Medium)
- Run go mod tidy and go mod vendor to update vendor directory
This commit is contained in:
Bruno Chauvet
2026-05-04 10:45:24 +03:00
committed by Ciprian Hacman
parent 255c6e602c
commit 97bb2fbb44
279 changed files with 17945 additions and 29165 deletions
+20 -1
View File
@@ -1,4 +1,23 @@
# Changelog
# Changes
## [2.18.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.18.0) (2026-03-09)
### Features
* add callctx telemetry helpers (#472) ([fa319ff](https://github.com/googleapis/google-cloud-go/commit/fa319ffc309366ab21e41f5d7480f450eedd2be9))
* move gax-go to use 1.25 as the lower bound of support (#469) ([01594ca](https://github.com/googleapis/google-cloud-go/commit/01594ca54717eebe7229a5168ef41be61191a720))
## [2.17.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.17.0) (2026-02-03)
### Features
* update Invoke to add retry count to context (#462) ([ea7096d](https://github.com/googleapis/google-cloud-go/commit/ea7096d50d665064dbfeffd7d93fa13d810ad4e4))
## [2.16.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.16.0) (2025-12-17)
### Features
* add IsFeatureEnabled (#454) ([2700b8a](https://github.com/googleapis/google-cloud-go/commit/2700b8ab3062c6c6c5a26d0fc6ba1fc064a8fc04))
## [2.15.0](https://github.com/googleapis/gax-go/compare/v2.14.2...v2.15.0) (2025-07-09)
+27
View File
@@ -98,3 +98,30 @@ func cloneHeaders(h map[string][]string) map[string][]string {
}
return c
}
// telemetryKey is a private type used to store/retrieve telemetry context values.
type telemetryKey string
// WithTelemetryContext injects telemetry attribute values (like resource name
// or client version) into the context. In accordance with standard Go context
// guidelines, this should only be used for data that transits processes and APIs,
// and not for passing optional parameters to functions. keyvals should have a
// corresponding value for every key provided. If there is an odd number of keyvals
// this method will panic.
func WithTelemetryContext(ctx context.Context, keyvals ...string) context.Context {
if len(keyvals)%2 != 0 {
panic(fmt.Sprintf("callctx: an even number of key value pairs must be provided, got %d", len(keyvals)))
}
for i := 0; i < len(keyvals); i = i + 2 {
ctx = context.WithValue(ctx, telemetryKey(keyvals[i]), keyvals[i+1])
}
return ctx
}
// TelemetryFromContext extracts a telemetry attribute value from the context.
// The returned bool indicates a successful typecast of the value to a string.
func TelemetryFromContext(ctx context.Context, key string) (string, bool) {
val, ok := ctx.Value(telemetryKey(key)).(string)
return val, ok
}
+75
View File
@@ -0,0 +1,75 @@
// Copyright 2025, Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
package gax
import (
"os"
"strings"
"sync"
)
var (
// featureEnabledOnce caches results for IsFeatureEnabled.
featureEnabledOnce sync.Once
featureEnabledStore map[string]bool
)
// IsFeatureEnabled checks if an experimental feature is enabled via
// environment variable. The environment variable must be prefixed with
// "GOOGLE_SDK_GO_EXPERIMENTAL_". The feature name passed to this
// function must be the suffix (e.g., "FOO" for "GOOGLE_SDK_GO_EXPERIMENTAL_FOO").
// To enable the feature, the environment variable's value must be "true",
// case-insensitive. The result for each name is cached on the first call.
func IsFeatureEnabled(name string) bool {
featureEnabledOnce.Do(func() {
featureEnabledStore = make(map[string]bool)
for _, env := range os.Environ() {
if strings.HasPrefix(env, "GOOGLE_SDK_GO_EXPERIMENTAL_") {
// Parse "KEY=VALUE"
kv := strings.SplitN(env, "=", 2)
if len(kv) == 2 && strings.ToLower(kv[1]) == "true" {
key := strings.TrimPrefix(kv[0], "GOOGLE_SDK_GO_EXPERIMENTAL_")
featureEnabledStore[key] = true
}
}
}
})
return featureEnabledStore[name]
}
// TestOnlyResetIsFeatureEnabled is for testing purposes only. It resets the cached
// feature flags, allowing environment variables to be re-read on the next call to IsFeatureEnabled.
// This function is not thread-safe; if another goroutine reads a feature after this
// function is called but before the `featureEnabledOnce` is re-initialized by IsFeatureEnabled,
// it may see an inconsistent state.
func TestOnlyResetIsFeatureEnabled() {
featureEnabledOnce = sync.Once{}
featureEnabledStore = nil
}
+13 -26
View File
@@ -1,33 +1,20 @@
// Copyright 2022, Google Inc.
// All rights reserved.
// Copyright 2026 Google LLC
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
// http://www.apache.org/licenses/LICENSE-2.0
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// Code generated by gapicgen. DO NOT EDIT.
package internal
// Version is the current tagged release of the library.
const Version = "2.15.0"
const Version = "2.18.0"
+20 -1
View File
@@ -31,15 +31,26 @@ package gax
import (
"context"
"strconv"
"strings"
"time"
"github.com/googleapis/gax-go/v2/apierror"
"github.com/googleapis/gax-go/v2/callctx"
)
// APICall is a user defined call stub.
type APICall func(context.Context, CallSettings) error
// withRetryCount returns a new context with the retry count appended to
// the telemetry context. The retry count is the number of retries that have been
// attempted. On the initial request, retry count is 0.
// On a second request (the first retry), retry count is 1.
func withRetryCount(ctx context.Context, retryCount int) context.Context {
// Add to telemetry context so it's visible to observability wrappers
return callctx.WithTelemetryContext(ctx, "resend_count", strconv.Itoa(retryCount))
}
// Invoke calls the given APICall, performing retries as specified by opts, if
// any.
func Invoke(ctx context.Context, call APICall, opts ...CallOption) error {
@@ -78,8 +89,15 @@ func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper
ctx = c
}
retryCount := 0
// Feature gate: GOOGLE_SDK_GO_EXPERIMENTAL_TRACING=true
tracingEnabled := IsFeatureEnabled("TRACING")
for {
err := call(ctx, settings)
ctxToUse := ctx
if tracingEnabled {
ctxToUse = withRetryCount(ctx, retryCount)
}
err := call(ctxToUse, settings)
if err == nil {
return nil
}
@@ -110,5 +128,6 @@ func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper
} else if err = sp(ctx, d); err != nil {
return err
}
retryCount++
}
}