cloudfoundry / cloudfoundry/log-cache-release
Used Prometheus package is pinned to a really old version
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 14
- Forks
- 29
- Avg merge
- 4h 10m
- Merged PRs (30d)
- 2
Description
At SAP are running security checks on the Log Cache's codebase and we (me and @zpascal) have seen that the used Prometheus package is pinned to a really old version. The pinned version is 2.13 from October 2019 and the current version is 2.44.
I've went through the code today and I've seen that the only place where the Prometheus package is used is in promql.go.
Why is the Prometheus package pinned to an old version? What kind of incompatibilities are there with the newer versions?
As the the Prometheus package is used only in one file I guess it won't be hard to refactor it, so that the newest stable version can be used...
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the dependency declaration at src/go.mod and the Prometheus usage in src/internal/promql/promql.go. Compare the pinned Prometheus API with a current stable version and identify any incompatibilities in that file. Done means the dependency is upgraded and the existing PromQL integration continues to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, prometheus
- Domain
- observability-sre
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100