Vulnerabilities because of older Alpine base image

[rajrohanyadav]

Hi maintainers,

Hope you are doing good.

Would you be able to take a look at #712 which has failed to auto-merge and causing a few (1 CRITICAL and 2 HIGH) vulnerabilities in the docker image? It'd be great if you could investigate and fix the build, so that the bump can be merged.

Thanks,
Rohan

[rajrohanyadav]

Hi @MovieStoreGuy @tiedotguy

Sorry for the ping, but if you could take a look at this, it would be really helpful.

Thankyou

[davidgit]

Hi @akavatl or @hstan ,

Could you help us here?

Thanks in advance

[hstan]

@davidgit
Merged #735

[rahulreddy15]

Hey @hstan ,
There is also a critical security vulnerability in the bin/gostatsd binary ( CVE-2024-24790 ) which will be resolved by bumping the go version.
Attaching the trivy report for you to see.

altassian-gostatsd.txt

[rahulreddy15]

Hey @hstan
Linking the PR that upgrades golang and golang.org/x/net versions

#736

[rahulreddy15]

Hey @hstan
The workflow seems to have failed because I did not run go mod tidy after upgrading golang.org/x/net.
Ran this and updated the PR. The upgraded libraries also appear in go.sum now.

[rahulreddy15]

Hey @hstan or @akavatl

Test Failures

After bumping the golang version and x/net dependencies to address critical security vulnerabilities some unit tests are failing. These tests were actually failing previously as well, but weren't being detected due to what appears to be a bug in the parallel test execution. With the updated Go version, these tests are now consistently failing regardless of parallel execution mode.

Specific Test Issue

The test case "host is added" in TestTagsToMap is failing because there's no implementation code that actually adds the host to the tags map. The test expects:

{"host is added", "x", nil, map[string]string{"host": "x"}}

This test expects that when a host "x" is provided with no tags, the resulting map should contain {"host": "x"}. However, looking at the current implementation of ToMap():

func (tags Tags) ToMap() map[string]string {
	flatpack := make(map[string][]string, len(tags))
	for i := 0; i < len(tags); i++ {
		key, value := parseTag(tags[i])
		key = strings.ReplaceAll(key, `.`, `_`)
		flatpack[key] = append(flatpack[key], value)
	}

	tagsMap := make(map[string]string, len(flatpack))
	for key, values := range flatpack {
		// Cheap operation, due to the fact that no sorting or additional allocation is required.
		if len(values) == 1 {
			tagsMap[key] = values[0]
			continue
		}
		// Expensive operation due an values being sorted and additioanl string being created with the Join
		sort.Strings(values)
		tagsMap[key] = strings.Join(values, `__`)
	}

	return tagsMap
}

There's no code to add the host value to the map when it's provided. The function only processes the tags array and doesn't account for the host parameter that's being tested.

To fix this issue, I recommend we modify the ToMap() function to include the host in the resulting map when it's provided. Something like:

	// Add host if provided
	if host != "" {
		flatpack["host"] = append(flatpack["host"], host)
	}

Please let me know how you'd like to proceed so we can resolve these test failures.

[hstan]

@rahulreddy15 I left a comment in the PR

[rahulreddy15]

Hey @hstan, Rebased the branch with master
You can run the testing pipeline again. 🤞🏾

[rahulreddy15]

@hstan Thanks for taking care of the PR.
When can we expect a release ?

[hstan]

@rahulreddy15 I've cut a new tag 40.0.1

[rahulreddy15]

@hstan You might have to run the manual release github action to create a release after you created the tag.

[hstan]

Done