Comments (5)
Hi @Lexdamian, thanks for the suggestion. This removal is planned in our v2 release, still in the works.
Is this causing you any issue that would require us to tackle it before our v2 release?
from dd-trace-go.
Hello! I am fixing vulnerabilities issues that are critical and this one is blocking a bunch of repos on our side. What's the release schedule for v2? I have a PR ready for the above mentioned remediation just in case.
from dd-trace-go.
@Lexdamian Unless you import our contrib for labstack/echo
you aren't vulnerable. Please check our SECURITY.md
:
If you are using a vulnerability checker other than
golang.org/x/vuln/vulncheck
you may detect vulnerabilities in our contrib dependencies. In general we like to specify non-vulnerable minimum versions of dependencies when we can do so in a non-breaking way. To avoid breaking users of this library there may be contrib libraries that are deprecated/vulnerable but still appear in our go.mod file. If you are not using these contrib packages you are not vulnerable (i.e. if they do not appear in your go.sum file). At the next major version we will drop support for these packages. (e.g. as of dd-trace-go@v1 labstack/echo v3 is considered deprecated and users should migrate to labstack/echo.v4)
Regarding v2, there isn't a release schedule yet.
from dd-trace-go.
@Lexdamian Can you confirm you are still affected according to vulncheck
? As I already stated, unless you import explicitly the labstack/echo
contrib, you shouldn't be affected by any vulnerability related to it.
from dd-trace-go.
Closing as we addressed the issue as stated in our security policy. Feel free to open a support ticket if it's still an issue on your side (so, you are importing the contrib).
from dd-trace-go.
Related Issues (20)
- Profiler: Add ability to override logger HOT 1
- Headers not propagated across custom spans within trace HOT 1
- contrib/jackc/pgx.v5: trace acquire and release HOT 1
- [BUG] Datadog Tracer v1.64.0 WARN: Turning off Data Streams Monitoring. Upgrade your agent to 7.34+ HOT 6
- proposal: integrate with github.com/twmb/franz-go HOT 1
- [BUG] fatal error: concurrent map writes when using contrib/net/http.(*roundTripper).RoundTrip HOT 1
- Remove warn logs from tracer/option newConfig HOT 1
- Go 1.19 no longer works HOT 1
- Failed to configure Datadog Profiler locally HOT 1
- Add WithStatsdClient StartOption for tracer HOT 1
- [BUG] 99designs/gqlgen/tracer.go: panic cause nil pointer
- enable delta memory profiler to reduce storage cost. HOT 3
- [QUESTION] Why is globalconfig.AnalyticsRate() commented out everywhere HOT 1
- [BUG] contrib/dimfeld/httptreemux.v5: default resource namer incorrectly replaces path variables HOT 1
- More precise span error in gin middleware HOT 1
- [BUG] appsec golang 1.23 HOT 1
- Questionable Dependency in internal/appsec/waf_test.go HOT 1
- propose: contrib/net/http: add conditional propagation logic to roundTripper configuration
- shopify sarama has moved to https://github.com/IBM/sarama and broke the integration HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dd-trace-go.