influxdata / influxdata/influxdb

Update Logrus to latest available version

Open
#24,708 6 comments 0 reactions 0 assignees View on GitHub
security security/negligible
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Use case:__
Logrus version 1.9.0 has an open CVE. Repositories which host influx and scan for CVEs flag this dependency as the finding has been open for a very long time (10 months). Updating the version of Logrus will allow Influx to be deployed into security conscious.

__Proposal:__
Update version of Logrus to [1.9.3](https://github.com/sirupsen/logrus/releases/tag/v1.9.3) which remediates the potential denial of service vulnerability

__Current behaviour:__
Influx 2.7.x is flagged for outstanding vulnerability related to logrus

__Desired behaviour:__
Influx 2.7.x is not flagged for outstanding vulnerability related to logrus

__Alternatives considered:__
I have not considered alternatives

Contributor guide

Open the contributing guide

Research direction

Start by locating the Logrus dependency declaration in the InfluxDB repository and checking how its current version is resolved. Update it to 1.9.3, then verify the dependency change and confirm that the reported Logrus vulnerability is no longer flagged.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.