search

brave / go-sync

Brave sync server v2
Mozilla Public License 2.0
185 stars 44 forks source link

Release 5/3/2024 #235

Closed DJAndries closed 4 months ago

github-actions[bot] commented 4 months ago

The following commits were not verified: e9e157835648397879d89e79a5232b03dd586bbf (unsigned) 4d1610a5c9760b1b81bf53564e571b65ccbe8632 (unsigned)

github-actions[bot] commented 4 months ago

[puLL-Merge] - brave/go-sync@235

Description

This PR updates various dependencies and Go version for the go-sync service. The motivation appears to be keeping the dependencies and Go runtime up-to-date.

Changes ### Changes - `.github/workflows/ci.yml`: - Updated `actions/checkout` to a newer version - Bumped Go version from 1.18 to 1.22 for CI - `Dockerfile`: Updated base Go image from 1.20 to 1.22 - `README.md`: - Updated Go version in developer setup instructions from 1.18 to 1.22 - Added instructions for connecting to local server from Brave browser - `dynamo.Dockerfile`: Updated `amazon/dynamodb-local` image from 2.3.0 to 2.4.0 - `go.mod`: - Bumped Go version from 1.20 to 1.22 - Updated several dependencies to newer versions, including `aws-sdk-go`, `go-chi`, `prometheus/client_golang`, `rs/zerolog` - `go.sum`: Updated checksums based on dependency changes in `go.mod` - `server/server.go`: Fixed comment mentioning wrong port number (8195 -> 8295)

Security Hotspots

  1. Updating to a new major version of Go (1.20 -> 1.22) could potentially introduce breaking changes or new vulnerabilities. The Go release notes should be carefully reviewed.
  2. Several dependencies were updated, some to new minor/patch versions (aws-sdk-go, go-chi, zerolog) and others to new major versions (prometheus/client_golang). The changelogs should be reviewed for any security fixes or breaking changes.
  3. While updating dependencies is generally good for security, bringing in new versions can also introduce new bugs. Thorough testing should be done after updating.

Overall the changes look reasonable from a security perspective assuming proper testing is done after the updates. Keeping Go and dependencies up-to-date is a good security practice.