Skip to content

Commit 6383bfe

Browse files
renovate-sh-app[bot]rfratto
renovate-sh-app[bot]
and
rfratto
authored
fix(security/UNKNOWN/): Update security golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.7.x) (#22189)
Co-authored-by: Robert Fratto <robertfratto@gmail.com>
1 parent 3379538 commit 6383bfe

134 files changed

Lines changed: 10942 additions & 33723 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -98,10 +98,10 @@ require (
9898
go.etcd.io/bbolt v1.4.3
9999
go.uber.org/atomic v1.11.0
100100
go.uber.org/goleak v1.3.0
101-
golang.org/x/crypto v0.49.0
102-
golang.org/x/net v0.52.0
101+
golang.org/x/crypto v0.52.0
102+
golang.org/x/net v0.54.0
103103
golang.org/x/sync v0.20.0
104-
golang.org/x/sys v0.44.0
104+
golang.org/x/sys v0.45.0
105105
golang.org/x/time v0.15.0
106106
google.golang.org/api v0.272.0
107107
google.golang.org/grpc v1.80.0
@@ -163,7 +163,7 @@ require (
163163
go.yaml.in/yaml/v3 v3.0.4
164164
go4.org/netipx v0.0.0-20230125063823-8449b0a6169f
165165
golang.org/x/oauth2 v0.36.0
166-
golang.org/x/text v0.35.0
166+
golang.org/x/text v0.37.0
167167
google.golang.org/protobuf v1.36.11
168168
gotest.tools v2.2.0+incompatible
169169
k8s.io/apimachinery v0.35.3
@@ -332,7 +332,7 @@ require (
332332
go.yaml.in/yaml/v2 v2.4.4 // indirect
333333
go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
334334
golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
335-
golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
335+
golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect
336336
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
337337
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
338338
modernc.org/libc v1.68.0 // indirect
@@ -488,9 +488,9 @@ require (
488488
go.opentelemetry.io/otel/trace v1.43.0
489489
go.uber.org/multierr v1.11.0 // indirect
490490
go.uber.org/zap v1.27.1 // indirect
491-
golang.org/x/mod v0.34.0 // indirect
492-
golang.org/x/term v0.41.0 // indirect
493-
golang.org/x/tools v0.43.0
491+
golang.org/x/mod v0.35.0 // indirect
492+
golang.org/x/term v0.43.0 // indirect
493+
golang.org/x/tools v0.44.0
494494
google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d // indirect
495495
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
496496
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9

‎go.sum‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1340,8 +1340,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
13401340
golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
13411341
golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
13421342
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
1343-
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
1344-
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
1343+
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
1344+
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
13451345
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
13461346
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
13471347
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1377,8 +1377,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
13771377
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
13781378
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
13791379
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
1380-
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
1381-
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
1380+
golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
1381+
golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
13821382
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
13831383
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
13841384
golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1417,8 +1417,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
14171417
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
14181418
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
14191419
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
1420-
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
1421-
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
1420+
golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
1421+
golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
14221422
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
14231423
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
14241424
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1499,17 +1499,17 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
14991499
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
15001500
golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
15011501
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
1502-
golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
1503-
golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
1504-
golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c h1:6a8FdnNk6bTXBjR4AGKFgUKuo+7GnR3FX5L7CbveeZc=
1505-
golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c/go.mod h1:TpUTTEp9frx7rTdLpC9gFG9kdI7zVLFTFFlqaH2Cncw=
1502+
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
1503+
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
1504+
golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa h1:efT73AJZfAAUV7SOip6pWGkwJDzIGiKBZGVzHYa+ve4=
1505+
golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE=
15061506
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
15071507
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
15081508
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
15091509
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
15101510
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
1511-
golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
1512-
golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
1511+
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
1512+
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
15131513
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
15141514
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
15151515
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1521,8 +1521,8 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
15211521
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
15221522
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
15231523
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
1524-
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
1525-
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
1524+
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
1525+
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
15261526
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
15271527
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
15281528
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1574,8 +1574,8 @@ golang.org/x/tools v0.0.0-20201022035929-9cf592e881e9/go.mod h1:emZCQorbCU4vsT4f
15741574
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
15751575
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
15761576
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
1577-
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
1578-
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
1577+
golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
1578+
golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
15791579
golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
15801580
golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
15811581
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎pkg/engine/internal/scheduler/wire/wire_http2_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,13 @@ import (
1212
"github.com/go-kit/log"
1313
"github.com/oklog/ulid/v2"
1414
"github.com/stretchr/testify/require"
15-
"golang.org/x/net/http2"
16-
"golang.org/x/net/http2/h2c"
1715

1816
"github.com/grafana/loki/v3/pkg/engine/internal/planner/physical"
1917
"github.com/grafana/loki/v3/pkg/engine/internal/scheduler/wire"
2018
"github.com/grafana/loki/v3/pkg/engine/internal/types"
2119
"github.com/grafana/loki/v3/pkg/engine/internal/util/dag"
2220
"github.com/grafana/loki/v3/pkg/engine/internal/workflow"
21+
serverutil "github.com/grafana/loki/v3/pkg/util/server"
2322
)
2423

2524
// TestHTTP2BasicConnectivity tests basic connection establishment and communication.
@@ -668,8 +667,9 @@ func prepareHTTP2Listener(t *testing.T) (*wire.HTTP2Listener, func()) {
668667
mux.Handle("/", listener)
669668

670669
server := &http.Server{
671-
Handler: h2c.NewHandler(mux, &http2.Server{}),
670+
Handler: mux,
672671
}
672+
serverutil.EnableUnencryptedHTTP2(server)
673673
wgServe := sync.WaitGroup{}
674674
wgServe.Add(1)
675675

‎pkg/logql/bench/store_dataobj_v2_engine.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,13 @@ import (
2020
"github.com/prometheus/client_golang/prometheus"
2121
"github.com/thanos-io/objstore"
2222
"github.com/thanos-io/objstore/providers/filesystem"
23-
"golang.org/x/net/http2"
24-
"golang.org/x/net/http2/h2c"
2523

2624
"github.com/grafana/loki/v3/pkg/dataobj/metastore"
2725
"github.com/grafana/loki/v3/pkg/engine"
2826
"github.com/grafana/loki/v3/pkg/logql"
2927
"github.com/grafana/loki/v3/pkg/logqlmodel"
3028
"github.com/grafana/loki/v3/pkg/util/rangeio"
29+
serverutil "github.com/grafana/loki/v3/pkg/util/server"
3130
)
3231

3332
var (
@@ -223,7 +222,7 @@ func newServerService(name string, logger log.Logger, registerer prometheus.Regi
223222
)
224223

225224
// Enable HTTP/2
226-
serv.HTTPServer.Handler = h2c.NewHandler(serv.HTTPServer.Handler, &http2.Server{})
225+
serverutil.EnableUnencryptedHTTP2(serv.HTTPServer)
227226

228227
return serv, svc, nil
229228
}

‎pkg/loki/modules.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,6 @@ import (
3434
"github.com/prometheus/client_golang/prometheus/collectors/version"
3535
"github.com/prometheus/common/model"
3636
"github.com/thanos-io/objstore"
37-
"golang.org/x/net/http2"
38-
"golang.org/x/net/http2/h2c"
3937

4038
"github.com/grafana/loki/v3/pkg/dataobj/metastore"
4139

@@ -221,7 +219,7 @@ func (t *Loki) initServer() (services.Service, error) {
221219
}(t.Server.HTTPServer.Handler)
222220

223221
t.Server.HTTPServer.Handler = middleware.Merge(serverutil.RecoveryHTTPMiddleware).Wrap(h)
224-
t.Server.HTTPServer.Handler = h2c.NewHandler(t.Server.HTTPServer.Handler, &http2.Server{})
222+
serverutil.EnableUnencryptedHTTP2(t.Server.HTTPServer)
225223

226224
if t.Cfg.Server.HTTPListenPort == 0 {
227225
t.Cfg.Server.HTTPListenPort = portFromAddr(t.Server.HTTPListenAddr().String())

‎pkg/util/server/unencrypted_http2.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package server
2+
3+
import "net/http"
4+
5+
// EnableUnencryptedHTTP2 configures srv to accept HTTP/1.x and cleartext HTTP/2 (h2c).
6+
func EnableUnencryptedHTTP2(srv *http.Server) {
7+
protocols := srv.Protocols
8+
if protocols == nil {
9+
protocols = new(http.Protocols)
10+
srv.Protocols = protocols
11+
}
12+
protocols.SetHTTP1(true)
13+
protocols.SetUnencryptedHTTP2(true)
14+
}

‎tools/querycomparator/execute.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@ import (
1717
"github.com/prometheus/client_golang/prometheus"
1818
"github.com/prometheus/common/model"
1919
"github.com/thanos-io/objstore"
20-
"golang.org/x/net/http2"
21-
"golang.org/x/net/http2/h2c"
2220

2321
"github.com/grafana/loki/v3/pkg/compactor/deletion"
2422
"github.com/grafana/loki/v3/pkg/dataobj/metastore"
@@ -33,6 +31,7 @@ import (
3331
"github.com/grafana/loki/v3/pkg/storage/bucket/gcs"
3432
"github.com/grafana/loki/v3/pkg/storage/config"
3533
"github.com/grafana/loki/v3/pkg/storage/stores/shipper/indexshipper"
34+
serverutil "github.com/grafana/loki/v3/pkg/util/server"
3635
"github.com/grafana/loki/v3/pkg/validation"
3736
)
3837

@@ -404,7 +403,7 @@ func newServerService(name string, httpPort int, logger glog.Logger, registerer
404403
)
405404

406405
// Enable HTTP/2
407-
serv.HTTPServer.Handler = h2c.NewHandler(serv.HTTPServer.Handler, &http2.Server{})
406+
serverutil.EnableUnencryptedHTTP2(serv.HTTPServer)
408407

409408
return serv, svc, nil
410409
}

‎vendor/golang.org/x/crypto/blake2b/go125.go‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)