Resolves: RHEL-183848
Resolves: RHEL-191577
This commit is contained in:
Sam Feifer
parent
e6b9b6fd4f
commit
8eba054be5
189
0016-fix-x-net-CVE.patch
Normal file
189
0016-fix-x-net-CVE.patch
Normal file
@ -0,0 +1,189 @@
|
||||
diff --git a/.bingo/wire.mod b/.bingo/wire.mod
|
||||
index fc39b30..cc59b83 100644
|
||||
--- a/.bingo/wire.mod
|
||||
+++ b/.bingo/wire.mod
|
||||
@@ -1,5 +1,5 @@
|
||||
module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
|
||||
|
||||
-go 1.16
|
||||
+go 1.25
|
||||
|
||||
-require github.com/google/wire v0.5.0 // cmd/wire
|
||||
+require github.com/google/wire v0.7.0 // cmd/wire
|
||||
diff --git a/.bingo/wire.sum b/.bingo/wire.sum
|
||||
index 6d4b4b3..5771a44 100644
|
||||
--- a/.bingo/wire.sum
|
||||
+++ b/.bingo/wire.sum
|
||||
@@ -3,6 +3,8 @@ github.com/google/subcommands v1.0.1 h1:/eqq+otEXm5vhfBrbREPCSVQbvofip6kIz+mX5TU
|
||||
github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
|
||||
github.com/google/wire v0.5.0 h1:I7ELFeVBr3yfPIcc8+MWvrjk+3VjbcSzoXm3JVa+jD8=
|
||||
github.com/google/wire v0.5.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
|
||||
+github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
|
||||
+github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
diff --git a/go.mod b/go.mod
|
||||
index fcbc09d..fde2d02 100644
|
||||
--- a/go.mod
|
||||
+++ b/go.mod
|
||||
@@ -1,6 +1,6 @@
|
||||
module github.com/grafana/grafana
|
||||
|
||||
-go 1.21
|
||||
+go 1.25.0
|
||||
|
||||
// Override docker/docker to avoid:
|
||||
// go: github.com/drone-runners/drone-runner-docker@v1.8.2 requires
|
||||
@@ -109,13 +109,13 @@ require (
|
||||
go.opentelemetry.io/otel/exporters/jaeger v1.10.0 // @grafana/backend-platform
|
||||
go.opentelemetry.io/otel/sdk v1.21.0 // @grafana/backend-platform
|
||||
go.opentelemetry.io/otel/trace v1.21.0 // @grafana/backend-platform
|
||||
- golang.org/x/crypto v0.17.0 // @grafana/backend-platform
|
||||
+ golang.org/x/crypto v0.51.0 // @grafana/backend-platform
|
||||
golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // @grafana/alerting-squad-backend
|
||||
- golang.org/x/net v0.19.0 // @grafana/oss-big-tent @grafana/partner-datasources
|
||||
+ golang.org/x/net v0.55.0 // @grafana/oss-big-tent @grafana/partner-datasources
|
||||
golang.org/x/oauth2 v0.15.0 // @grafana/grafana-authnz-team
|
||||
- golang.org/x/sync v0.4.0 // @grafana/alerting-squad-backend
|
||||
+ golang.org/x/sync v0.20.0 // @grafana/alerting-squad-backend
|
||||
golang.org/x/time v0.3.0 // @grafana/backend-platform
|
||||
- golang.org/x/tools v0.13.0 // @grafana/grafana-as-code
|
||||
+ golang.org/x/tools v0.44.0 // @grafana/grafana-as-code
|
||||
gonum.org/v1/gonum v0.12.0 // @grafana/observability-metrics
|
||||
google.golang.org/api v0.148.0 // @grafana/backend-platform
|
||||
google.golang.org/grpc v1.59.0 // @grafana/plugins-platform-backend
|
||||
@@ -218,8 +218,8 @@ require (
|
||||
go.opencensus.io v0.24.0 // indirect
|
||||
go.uber.org/atomic v1.11.0 // @grafana/alerting-squad-backend
|
||||
go.uber.org/goleak v1.3.0 // indirect
|
||||
- golang.org/x/sys v0.15.0 // indirect
|
||||
- golang.org/x/text v0.14.0 // @grafana/backend-platform
|
||||
+ golang.org/x/sys v0.45.0 // indirect
|
||||
+ golang.org/x/text v0.37.0 // @grafana/backend-platform
|
||||
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a // indirect; @grafana/backend-platform
|
||||
@@ -272,7 +272,7 @@ require (
|
||||
github.com/weaveworks/common v0.0.0-20230511094633-334485600903 // @grafana/alerting-squad-backend
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // @grafana/grafana-as-code
|
||||
go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // @grafana/backend-platform
|
||||
- golang.org/x/mod v0.12.0 // @grafana/backend-platform
|
||||
+ golang.org/x/mod v0.35.0 // @grafana/backend-platform
|
||||
gopkg.in/square/go-jose.v2 v2.6.0 // @grafana/grafana-authnz-team
|
||||
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // @grafana/partner-datasources
|
||||
)
|
||||
@@ -407,7 +407,7 @@ require (
|
||||
go.starlark.net v0.0.0-20221020143700-22309ac47eac // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
go.uber.org/zap v1.24.0 // indirect
|
||||
- golang.org/x/term v0.15.0 // indirect
|
||||
+ golang.org/x/term v0.43.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b // indirect
|
||||
gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
|
||||
@@ -478,6 +478,8 @@ require (
|
||||
require (
|
||||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
|
||||
+ golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect
|
||||
+ golang.org/x/tools/godoc v0.1.0-deprecated // indirect
|
||||
)
|
||||
|
||||
// Use fork of crewjam/saml with fixes for some issues until changes get merged into upstream
|
||||
diff --git a/go.sum b/go.sum
|
||||
index d05dfb5..ba1e58a 100644
|
||||
--- a/go.sum
|
||||
+++ b/go.sum
|
||||
@@ -3133,8 +3133,8 @@ golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE
|
||||
golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
|
||||
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
|
||||
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
|
||||
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
|
||||
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
|
||||
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
|
||||
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
|
||||
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
@@ -3199,8 +3199,9 @@ golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
|
||||
golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
|
||||
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
|
||||
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
|
||||
golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180816102801-aaf60122140d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
@@ -3312,8 +3313,8 @@ golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
|
||||
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||
golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
|
||||
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
|
||||
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
|
||||
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
|
||||
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
|
||||
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
@@ -3369,8 +3370,8 @@ golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJ
|
||||
golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
|
||||
-golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
|
||||
-golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
|
||||
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@@ -3539,8 +3540,10 @@ golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
|
||||
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
|
||||
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
+golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa h1:efT73AJZfAAUV7SOip6pWGkwJDzIGiKBZGVzHYa+ve4=
|
||||
+golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE=
|
||||
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
@@ -3555,8 +3558,8 @@ golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
|
||||
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
|
||||
golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
|
||||
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
|
||||
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
|
||||
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
|
||||
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
|
||||
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
|
||||
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
@@ -3574,8 +3577,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
|
||||
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
|
||||
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
|
||||
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
@@ -3713,8 +3716,11 @@ golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
|
||||
golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
|
||||
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
|
||||
golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
|
||||
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
|
||||
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
|
||||
+golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
|
||||
+golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
|
||||
golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
12
1005-vendor-fix-idna-unicode-version-gate.patch
Normal file
12
1005-vendor-fix-idna-unicode-version-gate.patch
Normal file
@ -0,0 +1,12 @@
|
||||
diff --git a/vendor/golang.org/x/net/idna/idna.go b/vendor/golang.org/x/net/idna/idna.go
|
||||
--- a/vendor/golang.org/x/net/idna/idna.go
|
||||
+++ b/vendor/golang.org/x/net/idna/idna.go
|
||||
@@ -400,7 +400,7 @@
|
||||
// Spec says keep the old label.
|
||||
continue
|
||||
}
|
||||
- if unicode16 && err == nil && len(u) > 0 && isASCII(u) {
|
||||
+ if err == nil && len(u) > 0 && isASCII(u) {
|
||||
err = punyError(enc)
|
||||
}
|
||||
isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
|
||||
@ -22,6 +22,7 @@ pushd "${SOURCE_DIR}"
|
||||
# Vendor Go dependencies
|
||||
patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch
|
||||
patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch
|
||||
patch -p1 --fuzz=0 < ../0016-fix-x-net-CVE.patch
|
||||
go mod vendor
|
||||
|
||||
# Generate Go files
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
cat <<EOF | podman build -t grafana-build -f - .
|
||||
FROM fedora:39
|
||||
FROM fedora:44
|
||||
|
||||
RUN dnf upgrade -y && \
|
||||
dnf install -y rpmdevtools python3-packaging python3-pyyaml make golang nodejs yarnpkg
|
||||
|
||||
26
grafana.spec
26
grafana.spec
@ -26,7 +26,7 @@ end}
|
||||
|
||||
Name: grafana
|
||||
Version: 10.2.6
|
||||
Release: 22%{?dist}
|
||||
Release: 23%{?dist}
|
||||
Summary: Metrics dashboard and graph editor
|
||||
License: AGPL-3.0-only
|
||||
URL: https://grafana.org
|
||||
@ -37,13 +37,13 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name}
|
||||
# Source1 contains the bundled Go and Node.js dependencies
|
||||
# Note: In case there were no changes to this tarball, the NVR of this tarball
|
||||
# lags behind the NVR of this package.
|
||||
Source1: grafana-vendor-%{version}-11.tar.xz
|
||||
Source1: grafana-vendor-%{version}-23.tar.xz
|
||||
|
||||
%if %{compile_frontend} == 0
|
||||
# Source2 contains the precompiled frontend
|
||||
# Note: In case there were no changes to this tarball, the NVR of this tarball
|
||||
# lags behind the NVR of this package.
|
||||
Source2: grafana-webpack-%{version}-11.tar.gz
|
||||
Source2: grafana-webpack-%{version}-23.tar.gz
|
||||
%endif
|
||||
|
||||
# Source3 contains the systemd-sysusers configuration
|
||||
@ -83,12 +83,14 @@ Patch12: 0012-fix-jwt-CVE.patch
|
||||
Patch13: 0013-fix-CVE-2025-4123.patch
|
||||
Patch14: 0014-Fix-CVE-2026-21721.patch
|
||||
Patch15: 0015-Fix-CVE-2026-27877.patch
|
||||
Patch16: 0016-fix-x-net-CVE.patch
|
||||
|
||||
# Patches affecting the vendor tarball
|
||||
Patch1001: 1001-vendor-patch-removed-backend-crypto.patch
|
||||
Patch1002: 1002-vendor-use-pbkdf2-from-OpenSSL.patch
|
||||
Patch1003: 1003-vendor-skip-goldenfiles-tests.patch
|
||||
Patch1004: 1004-vendor-Redacted-Url-in-logs.patch
|
||||
Patch1005: 1005-vendor-fix-idna-unicode-version-gate.patch
|
||||
|
||||
# Intersection of go_arches and nodejs_arches
|
||||
ExclusiveArch: %{grafana_arches}
|
||||
@ -233,13 +235,13 @@ Provides: bundled(golang(go.opentelemetry.io/contrib/instrumentation/net/http/ht
|
||||
Provides: bundled(golang(go.opentelemetry.io/otel/exporters/jaeger)) = 1.10.0
|
||||
Provides: bundled(golang(go.opentelemetry.io/otel/sdk)) = 1.21.0
|
||||
Provides: bundled(golang(go.opentelemetry.io/otel/trace)) = 1.21.0
|
||||
Provides: bundled(golang(golang.org/x/crypto)) = 0.17.0
|
||||
Provides: bundled(golang(golang.org/x/crypto)) = 0.51.0
|
||||
Provides: bundled(golang(golang.org/x/exp)) = 0.0.0-20230321023759.10a507213a29
|
||||
Provides: bundled(golang(golang.org/x/net)) = 0.19.0
|
||||
Provides: bundled(golang(golang.org/x/net)) = 0.55.0
|
||||
Provides: bundled(golang(golang.org/x/oauth2)) = 0.15.0
|
||||
Provides: bundled(golang(golang.org/x/sync)) = 0.4.0
|
||||
Provides: bundled(golang(golang.org/x/sync)) = 0.20.0
|
||||
Provides: bundled(golang(golang.org/x/time)) = 0.3.0
|
||||
Provides: bundled(golang(golang.org/x/tools)) = 0.13.0
|
||||
Provides: bundled(golang(golang.org/x/tools)) = 0.44.0
|
||||
Provides: bundled(golang(gonum.org/v1/gonum)) = 0.12.0
|
||||
Provides: bundled(golang(google.golang.org/api)) = 0.148.0
|
||||
Provides: bundled(golang(google.golang.org/grpc)) = 1.59.0
|
||||
@ -263,7 +265,7 @@ Provides: bundled(golang(github.com/hashicorp/go-multierror)) = 1.1.1
|
||||
Provides: bundled(golang(github.com/modern-go/reflect2)) = 1.0.2
|
||||
Provides: bundled(golang(github.com/olekukonko/tablewriter)) = 0.0.5
|
||||
Provides: bundled(golang(go.uber.org/atomic)) = 1.11.0
|
||||
Provides: bundled(golang(golang.org/x/text)) = 0.14.0
|
||||
Provides: bundled(golang(golang.org/x/text)) = 0.37.0
|
||||
Provides: bundled(golang(google.golang.org/genproto)) = 0.0.0-20231012201019.e917dd12ba7a
|
||||
Provides: bundled(golang(cloud.google.com/go/kms)) = 1.15.2
|
||||
Provides: bundled(golang(github.com/Azure/azure-sdk-for-go/sdk/azidentity)) = 1.3.0
|
||||
@ -308,7 +310,7 @@ Provides: bundled(golang(github.com/redis/go-redis/v9)) = 9.0.2
|
||||
Provides: bundled(golang(github.com/weaveworks/common)) = 0.0.0-20230511094633.334485600903
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonpointer)) = 0.0.0-20180127040702.4e3ac2762d5f
|
||||
Provides: bundled(golang(go.opentelemetry.io/contrib/samplers/jaegerremote)) = 0.15.1
|
||||
Provides: bundled(golang(golang.org/x/mod)) = 0.12.0
|
||||
Provides: bundled(golang(golang.org/x/mod)) = 0.35.0
|
||||
Provides: bundled(golang(gopkg.in/square/go-jose.v2)) = 2.6.0
|
||||
Provides: bundled(golang(k8s.io/utils)) = 0.0.0-20230406110748.d93618cff8a2
|
||||
Provides: bundled(golang(github.com/spf13/cobra)) = 1.7.0
|
||||
@ -780,6 +782,7 @@ rm -r plugins-bundled
|
||||
%patch -P 13 -p1
|
||||
%patch -P 14 -p1
|
||||
%patch -P 15 -p1
|
||||
%patch -P 16 -p1
|
||||
|
||||
%patch -P 1001 -p1
|
||||
%if %{enable_fips_mode}
|
||||
@ -789,6 +792,7 @@ rm -r plugins-bundled
|
||||
%patch -P 1003 -p1
|
||||
%endif
|
||||
%patch -P 1004 -p1
|
||||
%patch -P 1005 -p1
|
||||
|
||||
|
||||
%build
|
||||
@ -1025,6 +1029,10 @@ done
|
||||
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
|
||||
|
||||
%changelog
|
||||
* Thu Jul 09 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-23
|
||||
- Resolves RHEL-183848: CVE-2026-39821
|
||||
- Resolves RHEL-191577: CVE-2026-27136
|
||||
|
||||
* Wed Apr 22 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-22
|
||||
- Resolves RHEL-161804: CVE-2026-27877
|
||||
- Resolves RHEL-166346: CVE-2026-33810
|
||||
|
||||
4
sources
4
sources
@ -1,3 +1,3 @@
|
||||
SHA512 (grafana-webpack-10.2.6-23.tar.gz) = 37ac517bdbfeafbc2d9ce4f96b5879d204ea4a02ae1f2a8697d4ffb528ce367ad2db315f4282d4335cf77c8e10767f0a73a61692166751ed95fc28fea71b7e59
|
||||
SHA512 (grafana-vendor-10.2.6-23.tar.xz) = 8a7644744472da7fd5feac58de858e7c0da679e5bc9eaafb244ab96f4d34679d383d6a357e347c0af787056d47d9569132c03ebdb6c5f08b8621595182e830b3
|
||||
SHA512 (grafana-10.2.6.tar.gz) = 7244f4cb6572fe0403e6224f7247fbb273bbd1f359ee706a82001f0d409fb375d113f1cb24a657e845b93eb55ee98e1d7ae713e767c219f4d3b00eaf5c73d28e
|
||||
SHA512 (grafana-webpack-10.2.6-11.tar.gz) = 7e4a0f962bc0dbf0fffbc31599870c4099e421d4505644be0a412b26043dc7adb37e81f7b24621731f96d3c8a652009a9eef8cf68dd03e1351dc309fd87a1e6f
|
||||
SHA512 (grafana-vendor-10.2.6-11.tar.xz) = 1db5bedbbc84fecad9d07f9a44db0c17c9472387bdd0d58877415c756015dc579f109c1ae43a21ae97da5625806747ddd00b5f31be7965adabd316b1d6e943e1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user