Old opencensus dependency brings in security warnings
Open
- Dominant language
- Go
- Stars
- 3.7k
- Forks
- 465
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 5
Description
Trillian depends on opencensus for tracing. Opencensus is deprecated, and hasn't been updated in at least 3 years: https://github.com/census-instrumentation/opencensus-go.
This dependency:
- brings in AWS SDK v1, which further led to https://github.com/google/certificate-transparency-go/issues/1673
- bring in `github.com/prometheus/prometheus`, together with `GO-2026-5264`, `GO-2026-5381` and `GO-2026-5662`
Given that Trillian is in maintenance mode, and that it's not clear who uses tracing, we'll remove tracing altogether from Trillian, hence dropping the problematic dependencies.
Contributor guide
Assessment
This issue has not been assessed yet.