search

census-ecosystem / opencensus-go-exporter-stackdriver

OpenCensus Go exporter for Stackdriver Monitoring and Trace
Apache License 2.0
67 stars 79 forks source link

switch to aws-sdk-go-v2 #314

Closed jkeys089 closed 1 year ago

jkeys089 commented 1 year ago

What

Why

To mitigate vulnerabilities reported by osv-scanner

$> osv-scanner --lockfile=go.mod
Scanned opencensus-go-exporter-stackdriver/go.mod file and found 25 packages
OSV URL ECOSYSTEM PACKAGE VERSION SOURCE
https://osv.dev/GO-2022-0646 Go github.com/aws/aws-sdk-go 1.43.31 go.mod
https://osv.dev/GHSA-vvpx-j8f3-3w6h Go golang.org/x/net 0.5.0 go.mod
https://osv.dev/GO-2023-1571

Notes

We're not actually affected by the vulnerabilities listed above but it does create indirect dependencies that are flagged in downstream projects.

dashpole commented 1 year ago

/gcbrun

jkeys089 commented 1 year ago

@dashpole I think the staticcheck step is failing due to an issue unrelated to this PR. Should we try to fix that in a separate PR or is it OK to ignore?

Edit: Actually, I just noticed you have golangci-lint which includes the checks from staticcheck. Perhaps we should just remove the redundant staticcheck step?

dashpole commented 1 year ago

Yeah, looks like it is OK to ignore that.

jkeys089 commented 1 year ago

@dashpole thanks for the quick review! As a followup question: is there a schedule for tagging new releases?