fix(security/unknown/): update module github.com/klauspost/compress to v1.18.7 [security] - #201
Conversation
renovate-sh-app
Bot
added
automerge-security-update
severity:UNKNOWN
update-patch
labels
renovate-sh-app
Bot
changed the title
Pull request was closed
renovate-sh-app
Bot
changed the title
6600bde to
b74dae5
Compare
renovate-sh-app
Bot
changed the title
renovate-sh-app
Bot
changed the title
b74dae5 to
cb4e52a
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| ```terraform | ||
| ## use cloudwatch log group | ||
| terraform apply -var "lambda_promtail_image=<repo:tag>" -var "write_address=https://logs-prod-us-central1.grafana.net/loki/api/v1/push" -var "password=<password>" -var "username=<user>" -var 'log_group_names=["/aws/lambda/log-group-1", "/aws/lambda/log-group-2"]' -var 'bucket_names=["bucket-a", "bucket-b"]' -var 'batch_size=131072' |
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
|
|
||
| ```terraform | ||
| ## use cloudwatch log group | ||
| terraform apply -var "lambda_promtail_image=<repo:tag>" -var "write_address=https://logs-prod-us-central1.grafana.net/loki/api/v1/push" -var "password=<password>" -var "username=<user>" -var 'log_group_names=["/aws/lambda/log-group-1", "/aws/lambda/log-group-2"]' -var 'bucket_names=["bucket-a", "bucket-b"]' -var 'batch_size=131072' |
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
| ``` | ||
|
|
||
| To keep the log group label add `-var "keep_stream=true"`. | ||
|
|
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
|
|
||
| - [Deploy with Terraform](/docs/loki/latest/send-data/lambda-promtail/lambda-promtail-deploy-terraform): Recommended for most deployments. The Terraform configuration accepts arrays of log groups, buckets, and Kinesis streams, and can build the function from source or deploy a prebuilt ZIP archive. | ||
| - [Deploy with CloudFormation](/docs/loki/latest/send-data/lambda-promtail/lambda-promtail-deploy-cloudformation): Use the provided templates for CloudWatch, S3 with EventBridge, and Application Load Balancer logs. | ||
| ```terraform |
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
| MainLambdaPromtailSubscriptionFilter: | ||
| Type: AWS::Logs::SubscriptionFilter | ||
| Properties: | ||
| DestinationArn: !GetAtt LambdaPromtailFunction.Arn |
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
| Properties: | ||
| DestinationArn: !GetAtt LambdaPromtailFunction.Arn | ||
| FilterPattern: "" | ||
| LogGroupName: "/aws/lambda/some-lambda-log-group" |
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
|
|
||
| Grafana publishes a prebuilt ZIP archive of the function with each [release](https://github.com/grafana/lambda-promtail/releases), which you can deploy with Terraform or reference from CloudFormation. | ||
| You can also clone the [lambda-promtail repository](https://github.com/grafana/lambda-promtail), modify the Go code, and build the function yourself. | ||
| To add extra labels, include `ParameterKey=ExtraLabels,ParameterValue="name1,value1,name2,value2"`. |
There was a problem hiding this comment.
Grafana.AmazonProductNames (warning)
Use the full Amazon product name in the first instance.
For more information, refer to Grafana Writers' Toolkit.
Reported by Vale using Grafana Writers' Toolkit style. If you believe we can improve the rule, report an issue.
renovate-sh-app
Bot
changed the title
…o v1.18.7 [security] | datasource | package | from | to | | ---------- | ----------------------------- | ------- | ------- | | go | github.com/klauspost/compress | v1.18.2 | v1.18.7 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
renovate-sh-app
Bot
changed the title
cb4e52a to
16c45b2
Compare
This PR contains the following updates:
v1.18.2→v1.18.7Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
OOB read in github.com/klauspost/compress/s2
GHSA-259r-337f-4rfw / GO-2026-5841
More information
Details
Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
klauspost/compress (github.com/klauspost/compress)
v1.18.7Compare Source
Security release without other changes.
Full Changelog: klauspost/compress@v1.18.6...v1.18.7
v1.18.6Compare Source
What's Changed
New Contributors
Full Changelog: klauspost/compress@v1.18.5...v1.18.6
v1.18.5Compare Source
What's Changed
Full Changelog: klauspost/compress@v1.18.4...v1.18.5
v1.18.4Compare Source
What's Changed
New Contributors
Full Changelog: klauspost/compress@v1.18.2...v1.18.4
v1.18.3Compare Source
Downstream CVE-2025-61728
See golang/go#77102
Full Changelog: klauspost/compress@v1.18.2...v1.18.3
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.