influxdata / influxdata/influxdb
Update Logrus to latest available version
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Use case:__
Logrus version 1.9.0 has an open CVE. Repositories which host influx and scan for CVEs flag this dependency as the finding has been open for a very long time (10 months). Updating the version of Logrus will allow Influx to be deployed into security conscious.
__Proposal:__
Update version of Logrus to [1.9.3](https://github.com/sirupsen/logrus/releases/tag/v1.9.3) which remediates the potential denial of service vulnerability
__Current behaviour:__
Influx 2.7.x is flagged for outstanding vulnerability related to logrus
__Desired behaviour:__
Influx 2.7.x is not flagged for outstanding vulnerability related to logrus
__Alternatives considered:__
I have not considered alternatives
Contributor guide
Research direction
Start by locating the Logrus dependency declaration in the InfluxDB repository and checking how its current version is resolved. Update it to 1.9.3, then verify the dependency change and confirm that the reported Logrus vulnerability is no longer flagged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100