Repository navigation
chore: update dependencies to fix security vulnerabilities - #192
Conversation
Go: - grafana-plugin-sdk-go 0.284.0 -> 0.294.0 - google.golang.org/grpc 1.76.0 -> 1.82.1 (CVE-2026-33186) - go.opentelemetry.io/otel{,/sdk} 1.38.0 -> 1.44.0 (CVE-2026-29181, CVE-2026-24051, CVE-2026-39883) npm: - npm audit fix: websocket-driver (CVE-2026-54466), ws, storybook, fast-uri, flatted, form-data, minimatch - copy-webpack-plugin 11 -> 14 (pulls patched serialize-javascript 7.0.7) - scoped overrides for dompurify, js-cookie, immutable, uuid Signed-off-by: Patrik Cyvoct <patrik@ptrk.io>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0b358bbe8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| module github.com/quickwit-oss/quickwit-datasource | ||
|
|
||
| go 1.25 | ||
| go 1.26.5 |
There was a problem hiding this comment.
Raising the module minimum here means the tag release workflow is now out of sync: .github/workflows/release.yml still installs Go 1.25 before running mage coverage and mage buildAll. On release runners where toolchain auto-download is disabled or unavailable, those backend steps fail before producing the signed artifact with go.mod requires go >= 1.26.5; update the release workflow to use go-version-file: go.mod or install 1.26.5 explicitly.
Useful? React with 👍 / 👎.
1 participant
Go:
npm: