metrico / qryn

Polyglot Observability Stack. Lightweight & Drop-in compatible with Loki, Prometheus, Tempo, Pyroscope, Opentelemetry, Datadog & more! WASM powered ⭐️ Star to Support
https://qryn.dev
GNU Affero General Public License v3.0
1.05k stars 63 forks source link

lock protobufjs to 7.2.5, make docker_bun non root, add bunconfig.toml #431

Closed deathalt closed 5 months ago

deathalt commented 5 months ago

protobufjs = 7.2.6 have broken backward compatibility

also make bun non root for extra security

avoid https://github.com/advisories/GHSA-h755-8qp9-cq85 CVE-2022-35177 for bun as well as for node

CLAassistant commented 5 months ago

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Андрей Лалаев seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

socket-security[bot] commented 5 months ago

Updated and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
node-fetch 2.6.9...2.7.0 None +0/-0 162 kB node-fetch-bot
jest 27.4.5...27.5.1 shell +131/-129 19.7 MB simenb
record-cache 1.1.1...1.2.0 None +1/-0 39.4 kB mafintosh
handlebars 4.7.7...4.7.8 None +2/-2 4.12 MB jaylinski
glob 7.2.0...7.2.3 None +0/-0 55.1 kB isaacs
prometheus-remote-write 0.3.0...0.3.1 None +3/-2 4.31 MB huksley
fastify 4.24.3...4.25.2 None +12/-11 4.02 MB matteo.collina
logfmt 1.3.2...1.4.0 None +0/-0 65.4 kB csquared
scramjet 4.36.1...4.37.0 environment +3/-3 837 kB michalcz
protocol-buffers-encodings 1.1.1...1.2.0 None +1/-0 42 kB mafintosh
stream-chain 2.2.4...2.2.5 None +0/-0 39 kB elazutkin
stream-json 1.7.3...1.8.0 None +1/-1 130 kB elazutkin
pino 7.6.5...7.11.0 filesystem +7/-7 872 kB jsumners
eslint-plugin-import 2.25.3...2.29.1 None +74/-43 6.71 MB ljharb
patch-package 6.4.7...6.5.1 None +9/-6 738 kB ds300
@opentelemetry/instrumentation-connect 0.30.0...0.30.1 None +7/-5 4.9 MB dyladan
json-stable-stringify 1.0.1...1.1.1 None +12/-1 247 kB ljharb
ws 8.4.0...8.16.0 None +0/-0 141 kB lpinca
date-fns 2.27.0...2.30.0 None +2/-0 6.96 MB kossnocorp
@fastify/basic-auth 5.1.0...5.1.1 None +0/-0 49.9 kB eomm
pino-pretty 7.5.1...7.6.1 None +6/-6 589 kB matteo.collina
fastify-metrics 10.3.3...10.6.0 None +13/-12 4.08 MB m03geek
@fastify/websocket 8.2.0...8.3.1 None +1/-1 225 kB matteo.collina
@elastic/elasticsearch 8.6.0...8.11.0 None +4/-4 4.1 MB elasticmachine

🚮 Removed packages: @fastify/cors@8.4.1, eslint-plugin-jest@25.3.0