github-actions[bot]
commented
1 week ago :mag: Vulnerabilities of ghcr.io/uniget-org/tools/parca-agent:0.31.0
:package: Image Reference ghcr.io/uniget-org/tools/parca-agent:0.31.0
| digest | sha256:420616e8a65b11e317360e316fb8328b022b7e9e77c931484b5ec6806e7450df |
| vulnerabilities |      |
| platform | linux/amd64 |
| size | 41 MB |
| packages | 184 |
pkg:golang/github.com/azure/azure-sdk-for-go/sdk/azidentity@1.5.2 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
DescriptionAzure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability. | ||||||||
pkg:golang/stdlib@1.22.4
DescriptionThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail. |
github.com/azure/azure-sdk-for-go/sdk/azidentity 
stdlib
This PR contains the following updates:
0.30.0->0.31.0Release Notes
parca-dev/parca-agent (parca-dev/parca-agent)
### [`v0.31.0`](https://togithub.com/parca-dev/parca-agent/releases/tag/v0.31.0) [Compare Source](https://togithub.com/parca-dev/parca-agent/compare/v0.30.0...v0.31.0) #### Highlights 1. Custom labels to turn Go profiling labels into pprof labels 2. MUSL support 3. Enhanced python support, especially on arm64 and alpine/MUSL systems 4. Arm64 fixes for PAC mode 5. Synthetic unwinder errors 6. Improved dwarf unwinding by using .debug_frame and .debug_link 7. Fixes for linux 6.8 kernels (verifier errors) #### What's Changed - java: Add groundwork for the naive unwinder by [@kakkoyun](https://togithub.com/kakkoyun) in [https://github.com/parca-dev/parca-agent/pull/2591](https://togithub.com/parca-dev/parca-agent/pull/2591) - Use object file pool cache for unwind information by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2595](https://togithub.com/parca-dev/parca-agent/pull/2595) - Fix benign but bogus main executable assumption by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2596](https://togithub.com/parca-dev/parca-agent/pull/2596) - bpf/unwinder/native: remove duplicated code by [@Sylfrena](https://togithub.com/Sylfrena) in [https://github.com/parca-dev/parca-agent/pull/2603](https://togithub.com/parca-dev/parca-agent/pull/2603) - Scripts ergonomics by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2601](https://togithub.com/parca-dev/parca-agent/pull/2601) - Various fixes for aarch64 by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2604](https://togithub.com/parca-dev/parca-agent/pull/2604) - go.\*: Update runtime-data by [@kakkoyun](https://togithub.com/kakkoyun) in [https://github.com/parca-dev/parca-agent/pull/2610](https://togithub.com/parca-dev/parca-agent/pull/2610) - Only attempt to profile online CPUs by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2646](https://togithub.com/parca-dev/parca-agent/pull/2646) - Fix function end detection by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2636](https://togithub.com/parca-dev/parca-agent/pull/2636) - Surface unwind failure reasons in status page by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2649](https://togithub.com/parca-dev/parca-agent/pull/2649) - Bump Ainur to fix Go version misdetection by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2656](https://togithub.com/parca-dev/parca-agent/pull/2656) - Add a bit more logging/metrics when unwind table adding fails by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2670](https://togithub.com/parca-dev/parca-agent/pull/2670) - pkg/profiler/cpu/bpf/maps: Improve too many mappings error message by [@brancz](https://togithub.com/brancz) in [https://github.com/parca-dev/parca-agent/pull/2675](https://togithub.com/parca-dev/parca-agent/pull/2675) - Add "unwind failed" synthetic stacks by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2682](https://togithub.com/parca-dev/parca-agent/pull/2682) - add failed reasons stacks even when there are no other stacks in the profile by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2687](https://togithub.com/parca-dev/parca-agent/pull/2687) - Avoid filling uploadJob channel w/ NoopDebugInfoManager by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2686](https://togithub.com/parca-dev/parca-agent/pull/2686) - Fix template test by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2690](https://togithub.com/parca-dev/parca-agent/pull/2690) - Fix bug where event processors exit on error by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2688](https://togithub.com/parca-dev/parca-agent/pull/2688) - Oops, don't log unconditionally by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2693](https://togithub.com/parca-dev/parca-agent/pull/2693) - Fix off-by-one error in chunk splitting by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2697](https://togithub.com/parca-dev/parca-agent/pull/2697) - Add "request read" event by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2705](https://togithub.com/parca-dev/parca-agent/pull/2705) - Makefile fixes for guix by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2706](https://togithub.com/parca-dev/parca-agent/pull/2706) - fast integration by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2698](https://togithub.com/parca-dev/parca-agent/pull/2698) - Don't swallow errors from GenerateCompactUnwindTable by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2718](https://togithub.com/parca-dev/parca-agent/pull/2718) - minor logging improvements by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2709](https://togithub.com/parca-dev/parca-agent/pull/2709) - Run amd64 integration tests on public github actions runners by [@brancz](https://togithub.com/brancz) in [https://github.com/parca-dev/parca-agent/pull/2720](https://togithub.com/parca-dev/parca-agent/pull/2720) - remove no-op Close statement by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2721](https://togithub.com/parca-dev/parca-agent/pull/2721) - Fix pointer authentication for FP-based unwinding by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2732](https://togithub.com/parca-dev/parca-agent/pull/2732) - Fix arm native integration tests by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2734](https://togithub.com/parca-dev/parca-agent/pull/2734) - Fix unwinder loading on 6.8 kernels by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2667](https://togithub.com/parca-dev/parca-agent/pull/2667) - Bump max per-process mappings up to 2000 by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2749](https://togithub.com/parca-dev/parca-agent/pull/2749) - bpf/unwinders/pyperf: Use an LRU map and increase the size by [@brancz](https://togithub.com/brancz) in [https://github.com/parca-dev/parca-agent/pull/2760](https://togithub.com/parca-dev/parca-agent/pull/2760) - Properly get return address for leaf frames on ARM during syscalls by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2761](https://togithub.com/parca-dev/parca-agent/pull/2761) - Log in another case where we unexpectedly fail to add unwind table by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2766](https://togithub.com/parca-dev/parca-agent/pull/2766) - Use both .eh_frame and .debug_frame by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2717](https://togithub.com/parca-dev/parca-agent/pull/2717) - Update MAINTAINERS.md by [@Sylfrena](https://togithub.com/Sylfrena) in [https://github.com/parca-dev/parca-agent/pull/2771](https://togithub.com/parca-dev/parca-agent/pull/2771) - Fix build ID precedence by [@brancz](https://togithub.com/brancz) in [https://github.com/parca-dev/parca-agent/pull/2775](https://togithub.com/parca-dev/parca-agent/pull/2775) - spam opaquify in more places to fix verifier issues on 6.8 by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2781](https://togithub.com/parca-dev/parca-agent/pull/2781) - .github: Don't skip building snap if only changing .c files by [@brancz](https://togithub.com/brancz) in [https://github.com/parca-dev/parca-agent/pull/2783](https://togithub.com/parca-dev/parca-agent/pull/2783) - Don't use .debug_frame info for Go binaries by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2782](https://togithub.com/parca-dev/parca-agent/pull/2782) - Fix Python version detection by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2794](https://togithub.com/parca-dev/parca-agent/pull/2794) - feat: add procfs cmdline by [@dreamerlzl](https://togithub.com/dreamerlzl) in [https://github.com/parca-dev/parca-agent/pull/2799](https://togithub.com/parca-dev/parca-agent/pull/2799) - don't hang on panic in Run() by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2792](https://togithub.com/parca-dev/parca-agent/pull/2792) - fix duplicated leaf frame for dwarf unwinding by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2811](https://togithub.com/parca-dev/parca-agent/pull/2811) - Get Go custom label offsets dynamically by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2808](https://togithub.com/parca-dev/parca-agent/pull/2808) - fix verification on 5.4 by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2816](https://togithub.com/parca-dev/parca-agent/pull/2816) - Add Tommy to MAINTAINERS.md by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2820](https://togithub.com/parca-dev/parca-agent/pull/2820) - support musl 1.2.5/alpine 3.20 by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2823](https://togithub.com/parca-dev/parca-agent/pull/2823) - Musl support by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2605](https://togithub.com/parca-dev/parca-agent/pull/2605) - fix go runtime detection to work with containers by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2815](https://togithub.com/parca-dev/parca-agent/pull/2815) - Refix 5.4 verifier error by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2837](https://togithub.com/parca-dev/parca-agent/pull/2837) - add the stack anyway in the case of truncation for native frames. by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2850](https://togithub.com/parca-dev/parca-agent/pull/2850) - Deduplicate list of PIDs in processEventBatcher by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2845](https://togithub.com/parca-dev/parca-agent/pull/2845) - If we have should_use_fp_by_default set we need to honor it or we will fail to unwind go binaries with no dwarf info. by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2858](https://togithub.com/parca-dev/parca-agent/pull/2858) - memset entire unwind_state by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2857](https://togithub.com/parca-dev/parca-agent/pull/2857) - Use arm for skip-check by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2863](https://togithub.com/parca-dev/parca-agent/pull/2863) - Use --verbose instead of --debug by [@brancz](https://togithub.com/brancz) in [https://github.com/parca-dev/parca-agent/pull/2867](https://togithub.com/parca-dev/parca-agent/pull/2867) - ra-1 fix for FP unwinding by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2874](https://togithub.com/parca-dev/parca-agent/pull/2874) - Fix one more case where we should assume we're done walking the stack when we have dwarf info but encounter a pc out of range. by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2872](https://togithub.com/parca-dev/parca-agent/pull/2872) - Revert "memset the entire unwind_state to make sure no" by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2878](https://togithub.com/parca-dev/parca-agent/pull/2878) - Remove synthetic unwinder error frames from agent and instead generate them in the unwinder with more context by [@gnurizen](https://togithub.com/gnurizen) in [https://github.com/parca-dev/parca-agent/pull/2851](https://togithub.com/parca-dev/parca-agent/pull/2851) - Collect custom labels by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2833](https://togithub.com/parca-dev/parca-agent/pull/2833) - fix x86 verification issues with custom labels by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2886](https://togithub.com/parca-dev/parca-agent/pull/2886) - fix wrong computation of current goroutine in kernel code on arm by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2887](https://togithub.com/parca-dev/parca-agent/pull/2887) - Fix various issues with debuginfo uploading by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2895](https://togithub.com/parca-dev/parca-agent/pull/2895) - Fix various panics in DWARF decoding by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2896](https://togithub.com/parca-dev/parca-agent/pull/2896) - Increase warning level when failing to fetch unwinder info by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2892](https://togithub.com/parca-dev/parca-agent/pull/2892) - Fix golang runtime detection for containers by [@umanwizard](https://togithub.com/umanwizard) in [https://github.com/parca-dev/parca-agent/pull/2903](https://togithub.com/parca-dev/parca-agent/pull/2903) #### New Contributors - [@umanwizard](https://togithub.com/umanwizard) made their first contribution in [https://github.com/parca-dev/parca-agent/pull/2604](https://togithub.com/parca-dev/parca-agent/pull/2604) **Full Changelog**: https://github.com/parca-dev/parca-agent/compare/v0.30.0...v0.31.0Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.