Merge pull request #5 from axonops/merge/upstream-v2.4.2

Merge upstream v2.4.2 (Go 1.26.2 + logrus CVE fixes)

Author: millerjp

.github/workflows/code-format.yml

@@ -20,27 +20,13 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
-      - name: Install SSH Key
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        uses: shimataro/ssh-key-action@v2
-        with:
-          key: ${{ secrets.SSH_PRIVATE_KEY }} 
-          known_hosts: github.com
       - name: gofmt
-        run: gofmt -s -w .
-      - name: Check for modified files
-        id: git-check
-        run: echo ::set-output name=modified::$(if git diff-index --quiet HEAD --; then echo "false"; else echo "true"; fi)
-      - name: Push changes (non Fork PRs)
-        if: github.event.pull_request.head.repo.full_name == github.repository && steps.git-check.outputs.modified == 'true'
-        run: |
-          git config --global user.name 'Auto Gofmt'
-          git config --global user.email 'auto-gofmt@users.noreply.github.com'
-          git remote set-url origin git@github.com:${{ github.repository }}
-          git commit -am "Automated gofmt changes"
-          git push
-      - name: Validate (Fork PRs)
-        if: github.event.pull_request.head.repo.full_name != github.repository && steps.git-check.outputs.modified == 'true'
         run: |
-          echo "Gofmt code validation failed, please run gofmt on your branch to correctly format your code changes."
-          exit 1
+          unformatted=$(gofmt -s -l .)
+          if [ -n "$unformatted" ]; then
+            echo "Gofmt validation failed. The following files need formatting:"
+            echo "$unformatted"
+            echo ""
+            echo "Run 'gofmt -s -w .' locally and commit the result."
+            exit 1
+          fi

.github/workflows/release-binary.yml

@@ -14,7 +14,7 @@ jobs:
   build:
     name: Build and Upload Release Assets
     runs-on: ubuntu-latest
-    container: golang:1.24.2-bullseye
+    container: golang:1.26.2-bookworm
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

.github/workflows/tests.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 env:
   SIMULACRON_VERSION: 0.10.0
-  GO_VERSION: 1.24.2
+  GO_VERSION: 1.26.2
   SKIP_DSE_TESTS: ${{ vars.SKIP_DSE_TESTS || 'false' }}
 jobs:
   dependencies:

CHANGELOG/CHANGELOG-2.4.md

@@ -6,6 +6,13 @@ When cutting a new release, update the `unreleased` heading to the tag being gen
 
 ---
 
+## v2.4.2 - 2026-04-27
+
+### Improvements
+
+* [#161](https://github.com/datastax/zdm-proxy/issues/161): Update Go to 1.26.2 to fix a number of CVEs related to TLS and X509
+* [#162](https://github.com/datastax/zdm-proxy/issues/162): Update logrus to 1.9.4 to fix CVE-2025-65637
+
 ## v2.4.1 - 2026-02-09
 
 ### Bug Fixes

Dockerfile

@@ -3,7 +3,7 @@
 # $ docker build . -f ./Dockerfile -t zdm-proxy
 ##########
 
-FROM golang:1.24.2-bullseye AS builder
+FROM golang:1.26.2-bookworm AS builder
 
 ENV GO111MODULE=on \
     CGO_ENABLED=0 \

RELEASE_NOTES.md

@@ -6,6 +6,15 @@ Build artifacts are available at [Docker Hub](https://hub.docker.com/repository/
 
 For additional details on the changes included in a specific release, see the associated CHANGELOG-x.x.md file.
 
+## v2.4.2 - 2026-04-27
+
+Upgrade software dependencies to resolve vulnerabilities:
+
+- Go to 1.26.2
+- Logrus to 1.9.4
+
+[Changelog](CHANGELOG/CHANGELOG-2.4.md#v242---2026-04-27)
+
 ## v2.4.1 - 2026-02-09
 
 Fix too small buffer for LZ4 decompression.
@@ -87,4 +96,4 @@ This release enables the ZDM-Proxy to independently send heartbeats on the SECON
 
 Open-source release that also includes renaming of the product, public documentation launch and a revamp of configuration and metrics.
 
-[Changelog](CHANGELOG/CHANGELOG-2.0.md#v200---2022-10-18)
+[Changelog](CHANGELOG/CHANGELOG-2.0.md#v200---2022-10-18)

docker-compose-debug.yml

@@ -29,7 +29,7 @@ services:
         ipv4_address: 192.168.100.102
 
   proxy:
-    image: golang:1.24.2-bookworm
+    image: golang:1.26.2-bookworm
     restart: unless-stopped
     tty: true
     ports:

docker-compose-tests.yml

@@ -35,7 +35,7 @@ services:
         ipv4_address: 192.168.100.102
 
   proxy:
-    image: golang:1.24.2-bookworm
+    image: golang:1.26.2-bookworm
     container_name: zdm_tests_proxy
     restart: unless-stopped
     tty: true

go.mod

@@ -1,6 +1,6 @@
 module github.com/datastax/zdm-proxy
 
-go 1.24
+go 1.26
 
 require (
 	github.com/antlr4-go/antlr/v4 v4.13.1
@@ -13,8 +13,8 @@ require (
 	github.com/prometheus/client_golang v1.11.1
 	github.com/prometheus/client_model v0.2.0
 	github.com/rs/zerolog v1.34.0
-	github.com/sirupsen/logrus v1.6.0
-	github.com/stretchr/testify v1.9.0
+	github.com/sirupsen/logrus v1.9.4
+	github.com/stretchr/testify v1.10.0
 	golang.org/x/time v0.12.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -25,7 +25,6 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/golang/protobuf v1.5.0 // indirect
 	github.com/golang/snappy v0.0.3 // indirect
-	github.com/konsorten/go-windows-terminal-sequences v1.0.3 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
@@ -35,7 +34,7 @@ require (
 	github.com/prometheus/common v0.26.0 // indirect
 	github.com/prometheus/procfs v0.6.0 // indirect
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
-	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 )

go.sum

@@ -64,7 +64,6 @@ github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -119,17 +118,18 @@ github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
@@ -163,8 +163,9 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=