Skip to content

PMM-14577 Fix CVEs. #4848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JiriCtvrtka merged 33 commits into from
Jan 7, 2026
Merged

PMM-14577 Fix CVEs. #4848

Show file tree
Hide file tree
Changes from 28 commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
ba0b3e5
PMM-14577 Fix CVEs
JiriCtvrtka Dec 16, 2025
c5386a3
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 17, 2025
fc26b21
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 17, 2025
a20fc08
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 22, 2025
3e3e2a6
PMM-14577 Replace for testing.
JiriCtvrtka Dec 22, 2025
ed75fe6
PMM-14577 Test if this will be double register bug.
JiriCtvrtka Dec 22, 2025
a404867
PMM-14577 Test.
JiriCtvrtka Dec 22, 2025
00f1e8e
PMM-14577 Removing replace - all diff in PMM repo - test
JiriCtvrtka Dec 22, 2025
a387acf
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 22, 2025
b19a95c
PMM-14577 tidy.
JiriCtvrtka Dec 22, 2025
189dac1
PMM-14577 Format.
JiriCtvrtka Dec 22, 2025
19c5960
PMM-14577 Fix channels test after remove replace for go-grpc.
JiriCtvrtka Dec 22, 2025
a12355a
PMM-14577 Lint.
JiriCtvrtka Dec 22, 2025
d0409e1
PMM-14577 Lint.
JiriCtvrtka Dec 22, 2025
e80d20c
Revert "PMM-14577 Lint."
JiriCtvrtka Dec 23, 2025
fae4faf
PMM-14577 Fix, comments.
JiriCtvrtka Dec 23, 2025
39dc201
PMM-14577 Rename to more meaningful method name.
JiriCtvrtka Dec 23, 2025
2d4cad8
PMM-14577 Lint.
JiriCtvrtka Dec 23, 2025
c8f614f
PMM-14577 Remove replace.
JiriCtvrtka Dec 23, 2025
10b71cc
PMM-14577 Try disable lint.
JiriCtvrtka Dec 23, 2025
418db88
PMM-14577 Lint.
JiriCtvrtka Dec 23, 2025
21f44f0
PMM-14577 Update hashicorp.
JiriCtvrtka Dec 23, 2025
f355d1b
PMM-14577 Separe go-grpc-prometheus code into new file.
JiriCtvrtka Dec 23, 2025
ea0da7b
PMM-14577 Lint.
JiriCtvrtka Dec 23, 2025
344f26a
PMM-14577 Missing package.
JiriCtvrtka Dec 23, 2025
d533bc5
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 23, 2025
97657f9
PMM-14577 Typo.
JiriCtvrtka Dec 23, 2025
4136744
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 29, 2025
b7513a9
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Dec 29, 2025
bbaf475
Merge branch 'v3' into PMM-14577-CVEs-fix
JiriCtvrtka Jan 7, 2026
18d9d7a
PMM-14577 Update replace.
JiriCtvrtka Jan 7, 2026
df2fb0d
PMM-14577 Correct timestamp in replace.
JiriCtvrtka Jan 7, 2026
db10f7e
PMM-14577 Tidy.
JiriCtvrtka Jan 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ linters:
- recvcheck
path: managed/models/
paths:
- managed/utils/interceptors/go-grpc-prometheus.go
- agent/agents/mongodb/internal/
- qan-api2/migrations/
- third_party$
Expand Down
33 changes: 16 additions & 17 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,11 @@ go 1.25.5
// Update saas with
// go get -v github.com/percona/saas@latest

replace github.com/grpc-ecosystem/go-grpc-prometheus => github.com/Percona-Lab/go-grpc-prometheus v0.0.0-20230116133345-3487748d4592
replace github.com/go-openapi/spec => github.com/JiriCtvrtka/spec v0.0.0-20251222101011-485c12f10ee3
Copy link
Contributor Author

@JiriCtvrtka JiriCtvrtka Dec 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I dont have permissions to this repo. This is only for now. Once finished it will be replaced with proper commit in Percona spec repo.

Copy link
Member

@ademidoff ademidoff Jan 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe we have a new version now.


replace github.com/go-openapi/spec => github.com/Percona-Lab/spec v0.21.0-percona
replace github.com/alecthomas/kingpin/v2 => github.com/Percona-Lab/kingpin/v2 v2.0.0-20251219125400-95ff74a47c0a

replace github.com/alecthomas/kingpin/v2 => github.com/Percona-Lab/kingpin/v2 v2.4.0-percona

replace golang.org/x/crypto => github.com/percona-lab/crypto v0.0.0-20231108144114-756dfb24eaf2
replace golang.org/x/crypto => github.com/percona-lab/crypto v0.0.0-20251219125031-82d8ba2cda22
Copy link
Contributor Author

@JiriCtvrtka JiriCtvrtka Dec 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before merge of PR all will be replaced with proper commit (after those are merged).


require (
github.com/AlekSi/pointer v1.2.0
Expand Down Expand Up @@ -45,7 +43,7 @@ require (
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2
github.com/hashicorp/go-version v1.8.0
github.com/hashicorp/raft v1.7.0
github.com/hashicorp/raft v1.7.3
github.com/jmoiron/sqlx v1.4.0
github.com/jotaen/kong-completion v0.0.5
github.com/lib/pq v1.10.9
Expand Down Expand Up @@ -101,24 +99,25 @@ require (
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/swag/cmdutils v0.25.1 // indirect
github.com/go-openapi/swag/conv v0.25.1 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.1 // indirect
github.com/go-openapi/swag/jsonname v0.25.1 // indirect
github.com/go-openapi/swag/jsonutils v0.25.1 // indirect
github.com/go-openapi/swag/loading v0.25.1 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.1 // indirect
github.com/go-openapi/swag/netutils v0.25.1 // indirect
github.com/go-openapi/swag/stringutils v0.25.1 // indirect
github.com/go-openapi/swag/typeutils v0.25.1 // indirect
github.com/go-openapi/swag/yamlutils v0.25.1 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/gogo/googleapis v0.0.0-20180223154316-0cd9801be74a // indirect
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.0.1 // indirect
github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853 // indirect
github.com/hashicorp/go-hclog v1.6.3 // indirect
github.com/hashicorp/go-msgpack/v2 v2.1.1 // indirect
github.com/hashicorp/go-metrics v0.5.4 // indirect
github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
github.com/kr/fs v0.1.0 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/miekg/dns v1.1.68 // indirect
Expand Down Expand Up @@ -152,8 +151,8 @@ require (
github.com/go-faster/city v1.0.1 // indirect
github.com/go-faster/errors v0.7.1 // indirect
github.com/go-openapi/analysis v0.24.0 // indirect
github.com/go-openapi/jsonpointer v0.22.1 // indirect
github.com/go-openapi/jsonreference v0.21.2 // indirect
github.com/go-openapi/jsonpointer v0.22.4 // indirect
github.com/go-openapi/jsonreference v0.21.4 // indirect
github.com/go-openapi/loads v0.23.1 // indirect
github.com/go-openapi/spec v0.22.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
Expand Down Expand Up @@ -181,7 +180,7 @@ require (
github.com/pierrec/lz4/v4 v4.1.22 // indirect
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/rs/xid v1.5.0 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/shopspring/decimal v1.4.0 // indirect
Expand Down
174 changes: 134 additions & 40 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 2 additions & 3 deletions managed/cmd/pmm-managed/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ import (
"github.com/alecthomas/kingpin/v2"
grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
grpc_validator "github.com/grpc-ecosystem/go-grpc-middleware/validator"
grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
grpc_gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
"github.com/pkg/errors"
metrics "github.com/prometheus/client_golang/api"
Expand Down Expand Up @@ -236,14 +235,14 @@ func runGRPCServer(ctx context.Context, deps *gRPCServerDeps) {
l := logrus.WithField("component", "gRPC")
l.Infof("Starting server on http://%s/ ...", gRPCAddr)

grpcMetrics := grpc_prometheus.NewServerMetricsWithExtension(&interceptors.GRPCMetricsExtension{})
grpcMetrics := interceptors.NewServerMetricsWithExtension(&interceptors.GRPCMetricsExtension{})
prom.MustRegister(grpcMetrics)

gRPCServer := grpc.NewServer(
grpc.MaxRecvMsgSize(gRPCMessageMaxSize),

grpc.UnaryInterceptor(grpc_middleware.ChainUnaryServer(
interceptors.Unary(grpcMetrics.UnaryServerInterceptor()),
interceptors.UnaryAdd(grpcMetrics.UnaryServerInterceptor()),
interceptors.UnaryServiceEnabledInterceptor(),
grpc_validator.UnaryServerInterceptor())),
grpc.StreamInterceptor(grpc_middleware.ChainStreamServer(
Expand Down
5 changes: 2 additions & 3 deletions managed/services/agents/channel/channel_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ import (
"testing"
"time"

grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
"github.com/pkg/errors"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
Expand Down Expand Up @@ -60,12 +59,12 @@ func setup(t *testing.T, connect func(*Channel) error, expected ...error) (agent
lis, err := net.Listen("tcp", "127.0.0.1:0")
require.NoError(t, err)

grpcMetrics := grpc_prometheus.NewServerMetricsWithExtension(&interceptors.GRPCMetricsExtension{})
grpcMetrics := interceptors.NewServerMetricsWithExtension(&interceptors.GRPCMetricsExtension{})
grpcStreamInterceptor := grpcMetrics.StreamServerInterceptor()
grpcUnaryInterceptor := grpcMetrics.UnaryServerInterceptor()

server := grpc.NewServer(
grpc.UnaryInterceptor(interceptors.Unary(grpcUnaryInterceptor)),
grpc.UnaryInterceptor(interceptors.UnaryAdd(grpcUnaryInterceptor)),
grpc.StreamInterceptor(interceptors.Stream(grpcStreamInterceptor)))

agentv1.RegisterAgentServiceServer(server, &testServer{
Expand Down
Loading
Loading