google / google/trillian

Old opencensus dependency brings in security warnings

Open
#3,911 0 comments 0 reactions 1 assignee Claimed by @phbnf View on GitHub
Dominant language
Go
Stars
3.7k
Forks
465
Avg merge
2d 16h
Merged PRs (30d)
5

Description

Trillian depends on opencensus for tracing. Opencensus is deprecated, and hasn't been updated in at least 3 years: https://github.com/census-instrumentation/opencensus-go.

This dependency:
- brings in AWS SDK v1, which further led to https://github.com/google/certificate-transparency-go/issues/1673
- bring in `github.com/prometheus/prometheus`, together with `GO-2026-5264`, `GO-2026-5381` and `GO-2026-5662`

Given that Trillian is in maintenance mode, and that it's not clear who uses tracing, we'll remove tracing altogether from Trillian, hence dropping the problematic dependencies.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.