Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

prepare 8.2.4 release #287

Closed
wants to merge 1,138 commits into from
Closed

prepare 8.2.4 release #287

wants to merge 1,138 commits into from

Conversation

LaunchDarklyReleaseBot
Copy link
Contributor

[8.2.4] - 2024-02-07

Changed:

  • Added release-please configuration. There are no code changes to the Relay product itself.

LaunchDarklyReleaseBot and others added 30 commits April 21, 2022 17:06
# Conflicts:
#	go.mod
#	go.sum
…#189)

* Cache the replay event in case we get multiple new client connections

* Use singleflight to ensure only one replay event is generated at a time

Co-authored-by: Moshe Good <[email protected]>
…-put-data

use singleflight to deduplicate generation of stream put event
# Conflicts:
#	go.sum
#	internal/streams/stream_provider_server_side_test.go
use long timeout when awaiting changes related to file mod watching
use latest prerelease packages, update for misc SDK API changes (interfaces package)
* use Alpine 3.16.1

* update golang.org/x/net and golang.org/x/sync patch versions for CVEs

* update golang.org/x/sys patch version for CVE

* update Prometheus client library for CVE-2022-21698
cwaldren-ld and others added 23 commits January 11, 2024 09:32
The default docker image name was missing the `ld-` prefix.
…500)

Bumps [github.com/sigstore/cosign](https://github.com/sigstore/cosign)
from 1.13.1 to 1.13.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign's
releases</a>.</em></p>
<blockquote>
<h2>v1.13.2</h2>
<h2>What's Changed</h2>
<ul>
<li>[release-1.13] update builder image that uses go 1.19.4 by <a
href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a
href="https://redirect.github.com/sigstore/cosign/pull/2521">sigstore/cosign#2521</a></li>
<li>Backport GHSA-vfp6-jrw2-99g9 by <a
href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a
href="https://redirect.github.com/sigstore/cosign/pull/3364">sigstore/cosign#3364</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign/compare/v1.13.1...v1.13.2">https://github.com/sigstore/cosign/compare/v1.13.1...v1.13.2</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign's
changelog</a>.</em></p>
<blockquote>
<h1>v2.2.2</h1>
<p>v2.2.2 adds a new container with a shell,
<code>gcr.io/projectsigstore/cosign:vx.y.z-dev</code>, in addition to
the existing
container <code>gcr.io/projectsigstore/cosign:vx.y.z</code> without a
shell.</p>
<p>For private deployments, we have also added an alias for
<code>--insecure-skip-log</code>,
<code>--private-infrastructure</code>.</p>
<h2>Bug Fixes</h2>
<ul>
<li>chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6
(<a
href="https://redirect.github.com/sigstore/cosign/issues/3411">#3411</a>)
which fixes a bug with using Azure KMS</li>
<li>Don't require CT log keys if using a key/sk (<a
href="https://redirect.github.com/sigstore/cosign/issues/3415">#3415</a>)</li>
<li>Fix copy without any flag set (<a
href="https://redirect.github.com/sigstore/cosign/issues/3409">#3409</a>)</li>
<li>Update cosign generate cmd to not include newline (<a
href="https://redirect.github.com/sigstore/cosign/issues/3393">#3393</a>)</li>
<li>Fix idempotency error with signing (<a
href="https://redirect.github.com/sigstore/cosign/issues/3371">#3371</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Add <code>--yes</code> flag <code>cosign import-key-pair</code> to
skip the overwrite confirmation. (<a
href="https://redirect.github.com/sigstore/cosign/issues/3383">#3383</a>)</li>
<li>Use the timeout flag value in verify* commands. (<a
href="https://redirect.github.com/sigstore/cosign/issues/3391">#3391</a>)</li>
<li>add --private-infrastructure flag (<a
href="https://redirect.github.com/sigstore/cosign/issues/3369">#3369</a>)</li>
</ul>
<h2>Container Updates</h2>
<ul>
<li>Bump builder image to use go1.21.4 and add new cosign image tags
with shell (<a
href="https://redirect.github.com/sigstore/cosign/issues/3373">#3373</a>)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li>Update SBOM_SPEC.md (<a
href="https://redirect.github.com/sigstore/cosign/issues/3358">#3358</a>)</li>
</ul>
<h2>Contributors</h2>
<ul>
<li>Carlos Tadeu Panato Junior</li>
<li>Dylan Richardson</li>
<li>Hayden B</li>
<li>Lily Sturmann</li>
<li>Nikos Fotiou</li>
<li>Yonghe Zhao</li>
</ul>
<h1>v2.2.1</h1>
<p><strong>Note: This release comes with a fix for CVE-2023-46737
described in this <a
href="https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9">Github
Security Advisory</a>. Please upgrade to this release ASAP</strong></p>
<h2>Enhancements</h2>
<ul>
<li>feat: Support basic auth and bearer auth login to registry (<a
href="https://redirect.github.com/sigstore/cosign/issues/3310">#3310</a>)</li>
<li>add support for ignoring certificates with pkcs11 (<a
href="https://redirect.github.com/sigstore/cosign/issues/3334">#3334</a>)</li>
<li>Support ReplaceOp in Signatures (<a
href="https://redirect.github.com/sigstore/cosign/issues/3315">#3315</a>)</li>
<li>feat: added ability to get image digest back via triangulate (<a
href="https://redirect.github.com/sigstore/cosign/issues/3255">#3255</a>)</li>
<li>feat: add <code>--only</code> flag in <code>cosign copy</code> to
copy sign, att &amp; sbom (<a
href="https://redirect.github.com/sigstore/cosign/issues/3247">#3247</a>)</li>
<li>feat: add support attaching a Rekor bundle to a container (<a
href="https://redirect.github.com/sigstore/cosign/issues/3246">#3246</a>)</li>
<li>feat: add support outputting rekor response on signing (<a
href="https://redirect.github.com/sigstore/cosign/issues/3248">#3248</a>)</li>
<li>feat: improve dockerfile verify subcommand (<a
href="https://redirect.github.com/sigstore/cosign/issues/3264">#3264</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/cosign/commit/ea92927b70aaf44902190be4516fd00611f1934a"><code>ea92927</code></a>
Backport GHSA-vfp6-jrw2-99g9 (<a
href="https://redirect.github.com/sigstore/cosign/issues/3364">#3364</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/d862088b9b53e19161bc755a3097b25df47d5e05"><code>d862088</code></a>
update builder image that uses go 1.19.4 (<a
href="https://redirect.github.com/sigstore/cosign/issues/2521">#2521</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/43bde0e2012243fa78363202545e5372b26a29c2"><code>43bde0e</code></a>
update ci to run jobs in the 1.0-fork branch (<a
href="https://redirect.github.com/sigstore/cosign/issues/2408">#2408</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/9a2ea282019487e7ac92035472cf6a9765d2fc90"><code>9a2ea28</code></a>
chore(deps): bump mikefarah/yq from 4.28.2 to 4.29.2 (<a
href="https://redirect.github.com/sigstore/cosign/issues/2392">#2392</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/97625ff6e7223da82bcfb34ddd3fbc1972eb10a9"><code>97625ff</code></a>
chore(deps): bump github.com/xanzy/go-gitlab from 0.73.1 to 0.74.0 (<a
href="https://redirect.github.com/sigstore/cosign/issues/2391">#2391</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/ca0959a1c76cd1cb03a125a836077f0223a57874"><code>ca0959a</code></a>
verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for
using a k...</li>
<li><a
href="https://github.com/sigstore/cosign/commit/b6031175f47f9c6ee43663789079e526eef768f2"><code>b603117</code></a>
Refactor sign command (<a
href="https://redirect.github.com/sigstore/cosign/issues/2388">#2388</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/c3c4ea961deb4ae2bc1bc5c632e269b2da129e85"><code>c3c4ea9</code></a>
chore(deps): bump github/codeql-action from 2.1.28 to 2.1.29 (<a
href="https://redirect.github.com/sigstore/cosign/issues/2386">#2386</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/f0b2074c493aed88761a82b0ac217de59787c3bd"><code>f0b2074</code></a>
chore(deps): bump google.golang.org/api from 0.100.0 to 0.101.0 (<a
href="https://redirect.github.com/sigstore/cosign/issues/2385">#2385</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/ab7370bc3a76586c343e3bd79fdd14c795a0a9b6"><code>ab7370b</code></a>
chore(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (<a
href="https://redirect.github.com/sigstore/cosign/issues/2381">#2381</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sigstore/cosign/compare/v1.13.1...v1.13.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign&package-manager=go_modules&previous-version=1.13.1&new-version=1.13.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/launchdarkly/ld-relay-private/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
If hourly integration tests fail on (staging|production), it'll cancel
the other job. We don't want that.
Adds more badges to README so we can keep better track of the scheduled
workflows.
This implements API call rate limiting in integration tests via a custom
`http.RoundTripper`.

The problem being solved is that our current integration tests usually
fail because a call is rate-limited. This didn't happen before my Github
Actions refactoring - because the previous API tokens must have had some
kind of special privilege (?).

It is possible to make an exception for the account (mine) that
generated this service token, but I think that's not as
(maintainable|discoverable) long-term as actually rate limiting here in
the code, just like any application would need to do.

The rate limiting can be controlled by environment variable, and
defaults to `5 req / 10 seconds`. This default was chosen based on
looking at internal documentation for the slowest routes.

`LD_API_RATE_LIMIT_INTERVAL`: the duration over which to rate limit.
`LD_API_RATE_LIMIT_BURST`: how many in the interval.
Makes staging/prod integration tests upload result file with unique names.
This swaps our `fsnotify` routine from looking at the offline mode file
to looking at its directory. This allows the notifier to handle atomic
file renamings.

See #280.

---------

Co-authored-by: Graeme McKerrell <[email protected]>
A couple commits ago I introduced basic rate limiting to all REST API
requests made by Relay integration tests. This was necessary because the
tests failed due to rate limits.

The solution was kind of a last ditch effort, and it didn't work well -
it can't be aware of all the global/route-based limits in place on the
backend, so it wasn't smart enough to do its job.

Instead, the integration test accounts now have rate limiting disabled
for them.
We have an installation test (run `go install relay`) to make sure the
Go module is installable. This runs on a daily schedule, but it also
runs on every PR.

The PR run doesn't make sense since it's not building/using the local
code - just whatever is in the public Go module registry. Therefore, it
should be removed.
While doing an unrelated task (upgrading `goreleaser`), it raised the
AWS sdk version and introduced a deprecation warning for an API we're
using when we setup DynamoDB.

Since deprecated usage causes our CI to fail, this PR aims to remedy it
by upgrading all of our AWS SDK usage.
This PR adds a release-please workflow, as well as a manual publishing
job. It makes use of the `goreleaser` action.
I did some testing of the recently merged `manual-publish` process and
founds some bugs. This fixes them.
- Refactor `setup-go` step out of the unit test and publish steps (they
were stepping on each-other as composite actions)
- Fix token permissions
In a previous PR, I had refactored the go-setup step out of the unit
tests.

Unfortunately, this had the side-effect of the unit test action no
longer knowing what Go version it was using (since it used to be passed
in as a parameter.) This meant that when run in a matrix build, the test
result uploads would clash and fail to upload.

The fix is to check the current Go version using `go version` inside the
action.
@LaunchDarklyReleaseBot LaunchDarklyReleaseBot requested a review from a team February 7, 2024 21:38
@cwaldren-ld cwaldren-ld closed this Feb 7, 2024
@cwaldren-ld cwaldren-ld deleted the release-8.2.4 branch February 7, 2024 21:40
moshegood added a commit to moshegood/ld-relay that referenced this pull request Feb 22, 2024
* fix example build command

* use public prerelease tags instead of private dependencies

* fix Go installation in CI

* update SDK dependencies for JSON number parsing bugfix

* update gorilla/mux to 1.8.0

* update OpenCensus packages

* add Go 1.16 CI + "latest Go" CI + use latest 1.15 patch for release

* cimg images use "current", not "latest"

* seems there isn't any cimg/go "latest" or "current"

* add daily package build test in CI

* job names

* bump SDK version for traffic allocation feature

* [ch113491] update alpine base image (launchdarkly#258)

* use latest prerelease SDK

* fix enabling of test tags in CI

* add DynamoDB docker image in CI

* set a polling base URI in end-to-end tests since big segments logic will use it

* fix initialization logic so SDK client creation errors aren't lost when big segments are enabled

* fix use of prefix key in DynamoDB + improve tests (launchdarkly#260)

* more debug logging, less info logging for big segments logic

* make logging of big segments patch version mismatch clearer and use Warn level

* fix log parameter

* fix DynamoDB updates for big segments metadata

* add test to make sure sync time and cursor can be updated independently

* only start big seg synchronizer if necessary

* use SDK GA releases

* change applyPatch to exit early on version mismatch; go back to restarting stream in this case

* add unit tests for version mismatch behavior + DRY tests

* add log assertion

* fix retry logic on big segments stream failure

* add more logging for big segments connection status

* fix logging assertion

* add more big segments integration tests

* fix overly-time-sensitive file data tests

* fix more flaky tests

* run big segments tests with DynamoDB too

* Migrate transitive dep (jwt-go) to use modern version without vulnerability.

* Edit doc

* move Relay release logic to .ldrelease script

* suppress SDK big segments status query if we've never synced big segments

* dump Relay logs including debug logs if integration test fails

* include environment prefix in BigSegmentSynchronizer logging

* increase big segment integration test timeout (launchdarkly#274)

* generate client-side stream pings if big segments have changed

* clear big segments cache as needed + simplify state management

* fix tests and simplify component creation

* use GA releases of SDK packages

* disable CI package-build-test in Go 1.16+

* Migrate Relay release to Releaser v2 and support dry run (launchdarkly#278)

* Adding degraded doc blurb for big segments (launchdarkly#280)

* respect Redis password & TLS options for big segments; add Redis password integration tests

* redact Redis URL password in logs and status resource

* update go-server-sdk-redis-redigo to 1.2.1 for Redis URL logging fix

* Part 1, add the config and the documentation for the new config

* Part 2, Add the configuration validation and test

* Part 3, the actual logic to include the headers in the CORS Access-Control-Allow-Headers

* Linter

* update Alpine version to 3.14.2 to fix openssl CVEs

* Fix the global variable modification

* Go format

* turn off unnecessary metrics integrations in config for Docker smoke test

* rename test.env to smoke-test.env to clarify what it's for

* fix setting of custom Access-Control-Allow-Origin and add test (launchdarkly#285)

* add more explanatory test output and more verbose debugging for big segments integration tests (launchdarkly#287)

* update to Go 1.16.10 + Alpine 3.14.3; add some docs about releases (launchdarkly#288)

* update go-server-sdk-consul version for Consul API version update

* override x/crypto dependency version for CVE-2020-29652

* bump Prometheus dependency to eliminate jwt-go vulnerability

* drop support for Go 1.14 & 1.15

* make sure defaults are always applied for base URL properties

* rm unused

* rm unnecessary linter directive

* add separate configuration for server-side/client-side SDK base URLs & update the defaults

* remove Whitesource CI job + remove obsolete dependency issue note

* don't include any big segment status info in status resource unless that feature is active (launchdarkly#296)

* don't include any big segment status info in status resource unless that feature is active

* fix Big Segments staleness logic in status resource

* documentation

* update x/text package for vulnerability GO-2021-0113

* add Trivy security scan to CI (launchdarkly#297)

* add daily re-scan with Trivy

* use long timeout when awaiting changes related to file mod watching

* update Go version to 1.17.6 (launchdarkly#301)

* always terminate if auto-config stream fails with a fatal error

* pass along tags header when proxying events

* comments, rm debugging

* fix auth header logic

* fix auth header logic some more

* comments

* add tags header to CORS header whitelist (launchdarkly#304)

* update to Alpine 3.14.4 for CVE-2022-0778 fix

* force upgrade of openssl in Alpine

* also upgrade libretls

* fix it in both files

* update to Alpine 3.14.5 for CVE-2022-0778/CVE-2018-25032 (launchdarkly#308)

* update to Alpine 3.14.5 for CVE-2022-0778

* revert patches that are now included in Alpine 3.14.5

* add scripts for checking and updating Go/Alpine versions (launchdarkly#309)

* update to Alpine 3.14.5 for CVE-2022-0778

* add scripts for checking and updating Go/Alpine versions

* also make sure the Docker images really exist

* update CONTRIBUTING.md

* fix file rename

* revert patches that are now included in Alpine 3.14.5

* update Alpine to 3.14.6 for CVE-2022-28391

* update SDK packages (includes sc-136333 fix)

* don't include "v" prefix in Docker image version

* update go-server-sdk-dynamodb for data size error fix & add docs (launchdarkly#316)

* update builds to use Go 1.17.9 and fix the update script

* update go-server-sdk-consul to latest release

* update remote Docker version

* update golang.org/x/crypto for CVE-2022-27191 (launchdarkly#321)

* update golang.org/x/crypto for CVE-2022-27191

* fix go.sum

* update eventsource for SSE output efficiency fix (launchdarkly#322)

* Cache the replay event in case we get multiple new client connections (launchdarkly#189)

* Cache the replay event in case we get multiple new client connections

* Use singleflight to ensure only one replay event is generated at a time

Co-authored-by: Moshe Good <[email protected]>

* don't install curl in Docker images

* fix makefile logic for lint step

* remove indirect curl-based request logic in integration tests

* fix linter installation

* update Go to 1.17.11, Alpine to 3.16.0

* improve concurrency test to verify that the data is or isn't from a separate query

* fix lint warnings and remove unnecessary error return

* update libssl & libcrypto versions for CVE-2022-2097

* add security scan of already-published Docker image (launchdarkly#328)

* update Alpine version and some Go libraries to address CVEs (launchdarkly#329)

* use Alpine 3.16.1

* update golang.org/x/net and golang.org/x/sync patch versions for CVEs

* update golang.org/x/sys patch version for CVE

* update Prometheus client library for CVE-2022-21698

* ensure that DynamoDB config is consistent between Big Segments and regular data store

* comment

* update Alpine to 3.16.2

* update golangci-lint and go-junit-report

* fix CI

* prevent traversal of directories outside target path when expanding archive

* enforce TLS >= 1.2 for secure Redis

* misc linter updates

* fix test message

* add Go 1.18 & 1.19 jobs

* make test expectation less Go-version-dependent

* linting

* revert unnecessary change

* fix installation of test coverage tool

* migrate to AWS Go SDK v2 for DynamoDB (launchdarkly#333)

* update to Go 1.19.2

* update golang.org/x/net for CVE-2022-27664

* update golang.org/x/text for CVE-2022-32149

* update Consul API dependency to avoid false report of CVE-2022-40716

* switch to fork of Stackdriver metrics client to remove AWS transitive dependency (launchdarkly#343)

* update to Go 1.19.4 and Alpine 3.16.3

* override golang.org/x/net for CVE-2022-41717 only when building executables for release

* redo the security patch by updating go.mod for all builds; drop Go 1.16

* update Redis/DDB integrations to remove misleading error logging

* chore: drop go 1.17, 1.18 tests; add go 1.20 [v6] (launchdarkly#367)

* chore: drop go 1.17,1.18 tests; add go 1.20

* fix: Fix CVE-2022-41723 by overriding golang.org/x/net to v0.7.0

---------

Co-authored-by: Eli Bishop <[email protected]>
Co-authored-by: LaunchDarklyCI <[email protected]>
Co-authored-by: hroederld <[email protected]>
Co-authored-by: LaunchDarklyReleaseBot <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Casey Waldren <[email protected]>
moshegood added a commit to moshegood/ld-relay that referenced this pull request Feb 22, 2024
* update gorilla/mux to 1.8.0

* update OpenCensus packages

* add Go 1.16 CI + "latest Go" CI + use latest 1.15 patch for release

* cimg images use "current", not "latest"

* seems there isn't any cimg/go "latest" or "current"

* add daily package build test in CI

* job names

* bump SDK version for traffic allocation feature

* [ch113491] update alpine base image (launchdarkly#258)

* use latest prerelease SDK

* fix enabling of test tags in CI

* add DynamoDB docker image in CI

* set a polling base URI in end-to-end tests since big segments logic will use it

* fix initialization logic so SDK client creation errors aren't lost when big segments are enabled

* fix use of prefix key in DynamoDB + improve tests (launchdarkly#260)

* more debug logging, less info logging for big segments logic

* make logging of big segments patch version mismatch clearer and use Warn level

* fix log parameter

* fix DynamoDB updates for big segments metadata

* add test to make sure sync time and cursor can be updated independently

* only start big seg synchronizer if necessary

* use SDK GA releases

* change applyPatch to exit early on version mismatch; go back to restarting stream in this case

* add unit tests for version mismatch behavior + DRY tests

* add log assertion

* fix retry logic on big segments stream failure

* add more logging for big segments connection status

* fix logging assertion

* add more big segments integration tests

* fix overly-time-sensitive file data tests

* fix more flaky tests

* run big segments tests with DynamoDB too

* Migrate transitive dep (jwt-go) to use modern version without vulnerability.

* Edit doc

* move Relay release logic to .ldrelease script

* suppress SDK big segments status query if we've never synced big segments

* dump Relay logs including debug logs if integration test fails

* include environment prefix in BigSegmentSynchronizer logging

* increase big segment integration test timeout (launchdarkly#274)

* generate client-side stream pings if big segments have changed

* clear big segments cache as needed + simplify state management

* fix tests and simplify component creation

* use GA releases of SDK packages

* disable CI package-build-test in Go 1.16+

* Migrate Relay release to Releaser v2 and support dry run (launchdarkly#278)

* Adding degraded doc blurb for big segments (launchdarkly#280)

* respect Redis password & TLS options for big segments; add Redis password integration tests

* redact Redis URL password in logs and status resource

* update go-server-sdk-redis-redigo to 1.2.1 for Redis URL logging fix

* Part 1, add the config and the documentation for the new config

* Part 2, Add the configuration validation and test

* Part 3, the actual logic to include the headers in the CORS Access-Control-Allow-Headers

* Linter

* update Alpine version to 3.14.2 to fix openssl CVEs

* Fix the global variable modification

* Go format

* turn off unnecessary metrics integrations in config for Docker smoke test

* rename test.env to smoke-test.env to clarify what it's for

* fix setting of custom Access-Control-Allow-Origin and add test (launchdarkly#285)

* add more explanatory test output and more verbose debugging for big segments integration tests (launchdarkly#287)

* update to Go 1.16.10 + Alpine 3.14.3; add some docs about releases (launchdarkly#288)

* update go-server-sdk-consul version for Consul API version update

* override x/crypto dependency version for CVE-2020-29652

* bump Prometheus dependency to eliminate jwt-go vulnerability

* drop support for Go 1.14 & 1.15

* make sure defaults are always applied for base URL properties

* rm unused

* rm unnecessary linter directive

* add separate configuration for server-side/client-side SDK base URLs & update the defaults

* remove Whitesource CI job + remove obsolete dependency issue note

* don't include any big segment status info in status resource unless that feature is active (launchdarkly#296)

* don't include any big segment status info in status resource unless that feature is active

* fix Big Segments staleness logic in status resource

* documentation

* update x/text package for vulnerability GO-2021-0113

* add Trivy security scan to CI (launchdarkly#297)

* add daily re-scan with Trivy

* use long timeout when awaiting changes related to file mod watching

* update Go version to 1.17.6 (launchdarkly#301)

* always terminate if auto-config stream fails with a fatal error

* pass along tags header when proxying events

* comments, rm debugging

* fix auth header logic

* fix auth header logic some more

* comments

* add tags header to CORS header whitelist (launchdarkly#304)

* update to Alpine 3.14.4 for CVE-2022-0778 fix

* force upgrade of openssl in Alpine

* also upgrade libretls

* fix it in both files

* update to Alpine 3.14.5 for CVE-2022-0778/CVE-2018-25032 (launchdarkly#308)

* update to Alpine 3.14.5 for CVE-2022-0778

* revert patches that are now included in Alpine 3.14.5

* add scripts for checking and updating Go/Alpine versions (launchdarkly#309)

* update to Alpine 3.14.5 for CVE-2022-0778

* add scripts for checking and updating Go/Alpine versions

* also make sure the Docker images really exist

* update CONTRIBUTING.md

* fix file rename

* revert patches that are now included in Alpine 3.14.5

* update Alpine to 3.14.6 for CVE-2022-28391

* update SDK packages (includes sc-136333 fix)

* don't include "v" prefix in Docker image version

* update go-server-sdk-dynamodb for data size error fix & add docs (launchdarkly#316)

* update builds to use Go 1.17.9 and fix the update script

* update go-server-sdk-consul to latest release

* update remote Docker version

* update golang.org/x/crypto for CVE-2022-27191 (launchdarkly#321)

* update golang.org/x/crypto for CVE-2022-27191

* fix go.sum

* update eventsource for SSE output efficiency fix (launchdarkly#322)

* Cache the replay event in case we get multiple new client connections (launchdarkly#189)

* Cache the replay event in case we get multiple new client connections

* Use singleflight to ensure only one replay event is generated at a time

Co-authored-by: Moshe Good <[email protected]>

* don't install curl in Docker images

* fix makefile logic for lint step

* remove indirect curl-based request logic in integration tests

* fix linter installation

* update Go to 1.17.11, Alpine to 3.16.0

* improve concurrency test to verify that the data is or isn't from a separate query

* fix lint warnings and remove unnecessary error return

* update libssl & libcrypto versions for CVE-2022-2097

* add security scan of already-published Docker image (launchdarkly#328)

* update Alpine version and some Go libraries to address CVEs (launchdarkly#329)

* use Alpine 3.16.1

* update golang.org/x/net and golang.org/x/sync patch versions for CVEs

* update golang.org/x/sys patch version for CVE

* update Prometheus client library for CVE-2022-21698

* ensure that DynamoDB config is consistent between Big Segments and regular data store

* comment

* update Alpine to 3.16.2

* update golangci-lint and go-junit-report

* fix CI

* prevent traversal of directories outside target path when expanding archive

* enforce TLS >= 1.2 for secure Redis

* misc linter updates

* fix test message

* add Go 1.18 & 1.19 jobs

* make test expectation less Go-version-dependent

* linting

* revert unnecessary change

* fix installation of test coverage tool

* migrate to AWS Go SDK v2 for DynamoDB (launchdarkly#333)

* update to Go 1.19.2

* update golang.org/x/net for CVE-2022-27664

* update golang.org/x/text for CVE-2022-32149

* update Consul API dependency to avoid false report of CVE-2022-40716

* switch to fork of Stackdriver metrics client to remove AWS transitive dependency (launchdarkly#343)

* update to Go 1.19.4 and Alpine 3.16.3

* override golang.org/x/net for CVE-2022-41717 only when building executables for release

* redo the security patch by updating go.mod for all builds; drop Go 1.16

* update Redis/DDB integrations to remove misleading error logging

* chore: drop go 1.17, 1.18 tests; add go 1.20 [v6] (launchdarkly#367)

* chore: drop go 1.17,1.18 tests; add go 1.20

* fix: Fix CVE-2022-41723 by overriding golang.org/x/net to v0.7.0

* chore: bump supported Go versions to 1.20.2 & 1.19.7 (launchdarkly#374)

go1.20.2 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the compiler, the covdata command, the linker, the runtime, and the crypto/ecdh, crypto/rsa, crypto/x509, os, and syscall packages.

go1.19.7 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the linker, the runtime, and the crypto/x509 and syscall packages.

* chore: update the LaunchDarkly REST API client to v12 (launchdarkly#375)

* chore: update api-client-go to v12.0.0

* chore: fix flaky autoconfig integration tests (launchdarkly#382)

* chore: modify testUpdatedSDKKeyWithExpiry to wait for healthy relay status

* increase statusPollTimeout and Interval for integration tests

* chore: update the integration test URL to properly account for prod environment (launchdarkly#384)

* chore: upgrade goreleaser to 1.16.1 (launchdarkly#396)

* chore: upgrade goreleaser to 1.16.1 and use conventional release artifact filenames

* chore: add tools.go to specify goreleaser version

---------

Co-authored-by: LaunchDarklyCI <[email protected]>
Co-authored-by: Eli Bishop <[email protected]>
Co-authored-by: hroederld <[email protected]>
Co-authored-by: LaunchDarklyReleaseBot <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Casey Waldren <[email protected]>
moshegood added a commit to moshegood/ld-relay that referenced this pull request Feb 22, 2024
* add Go 1.16 CI + "latest Go" CI + use latest 1.15 patch for release

* cimg images use "current", not "latest"

* seems there isn't any cimg/go "latest" or "current"

* add daily package build test in CI

* job names

* bump SDK version for traffic allocation feature

* [ch113491] update alpine base image (launchdarkly#258)

* use latest prerelease SDK

* fix enabling of test tags in CI

* add DynamoDB docker image in CI

* set a polling base URI in end-to-end tests since big segments logic will use it

* fix initialization logic so SDK client creation errors aren't lost when big segments are enabled

* fix use of prefix key in DynamoDB + improve tests (launchdarkly#260)

* more debug logging, less info logging for big segments logic

* make logging of big segments patch version mismatch clearer and use Warn level

* fix log parameter

* fix DynamoDB updates for big segments metadata

* add test to make sure sync time and cursor can be updated independently

* only start big seg synchronizer if necessary

* use SDK GA releases

* change applyPatch to exit early on version mismatch; go back to restarting stream in this case

* add unit tests for version mismatch behavior + DRY tests

* add log assertion

* fix retry logic on big segments stream failure

* add more logging for big segments connection status

* fix logging assertion

* add more big segments integration tests

* fix overly-time-sensitive file data tests

* fix more flaky tests

* run big segments tests with DynamoDB too

* Migrate transitive dep (jwt-go) to use modern version without vulnerability.

* Edit doc

* move Relay release logic to .ldrelease script

* suppress SDK big segments status query if we've never synced big segments

* dump Relay logs including debug logs if integration test fails

* include environment prefix in BigSegmentSynchronizer logging

* increase big segment integration test timeout (launchdarkly#274)

* generate client-side stream pings if big segments have changed

* clear big segments cache as needed + simplify state management

* fix tests and simplify component creation

* use GA releases of SDK packages

* disable CI package-build-test in Go 1.16+

* Migrate Relay release to Releaser v2 and support dry run (launchdarkly#278)

* Adding degraded doc blurb for big segments (launchdarkly#280)

* respect Redis password & TLS options for big segments; add Redis password integration tests

* redact Redis URL password in logs and status resource

* update go-server-sdk-redis-redigo to 1.2.1 for Redis URL logging fix

* Part 1, add the config and the documentation for the new config

* Part 2, Add the configuration validation and test

* Part 3, the actual logic to include the headers in the CORS Access-Control-Allow-Headers

* Linter

* update Alpine version to 3.14.2 to fix openssl CVEs

* Fix the global variable modification

* Go format

* turn off unnecessary metrics integrations in config for Docker smoke test

* rename test.env to smoke-test.env to clarify what it's for

* fix setting of custom Access-Control-Allow-Origin and add test (launchdarkly#285)

* add more explanatory test output and more verbose debugging for big segments integration tests (launchdarkly#287)

* update to Go 1.16.10 + Alpine 3.14.3; add some docs about releases (launchdarkly#288)

* update go-server-sdk-consul version for Consul API version update

* override x/crypto dependency version for CVE-2020-29652

* bump Prometheus dependency to eliminate jwt-go vulnerability

* drop support for Go 1.14 & 1.15

* make sure defaults are always applied for base URL properties

* rm unused

* rm unnecessary linter directive

* add separate configuration for server-side/client-side SDK base URLs & update the defaults

* remove Whitesource CI job + remove obsolete dependency issue note

* don't include any big segment status info in status resource unless that feature is active (launchdarkly#296)

* don't include any big segment status info in status resource unless that feature is active

* fix Big Segments staleness logic in status resource

* documentation

* update x/text package for vulnerability GO-2021-0113

* add Trivy security scan to CI (launchdarkly#297)

* add daily re-scan with Trivy

* use long timeout when awaiting changes related to file mod watching

* update Go version to 1.17.6 (launchdarkly#301)

* always terminate if auto-config stream fails with a fatal error

* pass along tags header when proxying events

* comments, rm debugging

* fix auth header logic

* fix auth header logic some more

* comments

* add tags header to CORS header whitelist (launchdarkly#304)

* update to Alpine 3.14.4 for CVE-2022-0778 fix

* force upgrade of openssl in Alpine

* also upgrade libretls

* fix it in both files

* update to Alpine 3.14.5 for CVE-2022-0778/CVE-2018-25032 (launchdarkly#308)

* update to Alpine 3.14.5 for CVE-2022-0778

* revert patches that are now included in Alpine 3.14.5

* add scripts for checking and updating Go/Alpine versions (launchdarkly#309)

* update to Alpine 3.14.5 for CVE-2022-0778

* add scripts for checking and updating Go/Alpine versions

* also make sure the Docker images really exist

* update CONTRIBUTING.md

* fix file rename

* revert patches that are now included in Alpine 3.14.5

* update Alpine to 3.14.6 for CVE-2022-28391

* update SDK packages (includes sc-136333 fix)

* don't include "v" prefix in Docker image version

* update go-server-sdk-dynamodb for data size error fix & add docs (launchdarkly#316)

* update builds to use Go 1.17.9 and fix the update script

* update go-server-sdk-consul to latest release

* update remote Docker version

* update golang.org/x/crypto for CVE-2022-27191 (launchdarkly#321)

* update golang.org/x/crypto for CVE-2022-27191

* fix go.sum

* update eventsource for SSE output efficiency fix (launchdarkly#322)

* Cache the replay event in case we get multiple new client connections (launchdarkly#189)

* Cache the replay event in case we get multiple new client connections

* Use singleflight to ensure only one replay event is generated at a time

Co-authored-by: Moshe Good <[email protected]>

* don't install curl in Docker images

* fix makefile logic for lint step

* remove indirect curl-based request logic in integration tests

* fix linter installation

* update Go to 1.17.11, Alpine to 3.16.0

* improve concurrency test to verify that the data is or isn't from a separate query

* fix lint warnings and remove unnecessary error return

* update libssl & libcrypto versions for CVE-2022-2097

* add security scan of already-published Docker image (launchdarkly#328)

* update Alpine version and some Go libraries to address CVEs (launchdarkly#329)

* use Alpine 3.16.1

* update golang.org/x/net and golang.org/x/sync patch versions for CVEs

* update golang.org/x/sys patch version for CVE

* update Prometheus client library for CVE-2022-21698

* ensure that DynamoDB config is consistent between Big Segments and regular data store

* comment

* update Alpine to 3.16.2

* update golangci-lint and go-junit-report

* fix CI

* prevent traversal of directories outside target path when expanding archive

* enforce TLS >= 1.2 for secure Redis

* misc linter updates

* fix test message

* add Go 1.18 & 1.19 jobs

* make test expectation less Go-version-dependent

* linting

* revert unnecessary change

* fix installation of test coverage tool

* migrate to AWS Go SDK v2 for DynamoDB (launchdarkly#333)

* update to Go 1.19.2

* update golang.org/x/net for CVE-2022-27664

* update golang.org/x/text for CVE-2022-32149

* update Consul API dependency to avoid false report of CVE-2022-40716

* switch to fork of Stackdriver metrics client to remove AWS transitive dependency (launchdarkly#343)

* update to Go 1.19.4 and Alpine 3.16.3

* override golang.org/x/net for CVE-2022-41717 only when building executables for release

* redo the security patch by updating go.mod for all builds; drop Go 1.16

* update Redis/DDB integrations to remove misleading error logging

* chore: drop go 1.17, 1.18 tests; add go 1.20 [v6] (launchdarkly#367)

* chore: drop go 1.17,1.18 tests; add go 1.20

* fix: Fix CVE-2022-41723 by overriding golang.org/x/net to v0.7.0

* chore: bump supported Go versions to 1.20.2 & 1.19.7 (launchdarkly#374)

go1.20.2 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the compiler, the covdata command, the linker, the runtime, and the crypto/ecdh, crypto/rsa, crypto/x509, os, and syscall packages.

go1.19.7 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the linker, the runtime, and the crypto/x509 and syscall packages.

* chore: update the LaunchDarkly REST API client to v12 (launchdarkly#375)

* chore: update api-client-go to v12.0.0

* chore: fix flaky autoconfig integration tests (launchdarkly#382)

* chore: modify testUpdatedSDKKeyWithExpiry to wait for healthy relay status

* increase statusPollTimeout and Interval for integration tests

* chore: update the integration test URL to properly account for prod environment (launchdarkly#384)

* chore: upgrade goreleaser to 1.16.1 (launchdarkly#396)

* chore: upgrade goreleaser to 1.16.1 and use conventional release artifact filenames

* chore: add tools.go to specify goreleaser version

* chore: add missing tools.go (launchdarkly#407)

* chore: upgrade dependencies (launchdarkly#408)

---------

Co-authored-by: Eli Bishop <[email protected]>
Co-authored-by: LaunchDarklyCI <[email protected]>
Co-authored-by: hroederld <[email protected]>
Co-authored-by: LaunchDarklyReleaseBot <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Casey Waldren <[email protected]>
moshegood added a commit to moshegood/ld-relay that referenced this pull request Feb 22, 2024
* add Go 1.16 CI + "latest Go" CI + use latest 1.15 patch for release

* cimg images use "current", not "latest"

* seems there isn't any cimg/go "latest" or "current"

* add daily package build test in CI

* job names

* bump SDK version for traffic allocation feature

* [ch113491] update alpine base image (launchdarkly#258)

* use latest prerelease SDK

* fix enabling of test tags in CI

* add DynamoDB docker image in CI

* set a polling base URI in end-to-end tests since big segments logic will use it

* fix initialization logic so SDK client creation errors aren't lost when big segments are enabled

* fix use of prefix key in DynamoDB + improve tests (launchdarkly#260)

* more debug logging, less info logging for big segments logic

* make logging of big segments patch version mismatch clearer and use Warn level

* fix log parameter

* fix DynamoDB updates for big segments metadata

* add test to make sure sync time and cursor can be updated independently

* only start big seg synchronizer if necessary

* use SDK GA releases

* change applyPatch to exit early on version mismatch; go back to restarting stream in this case

* add unit tests for version mismatch behavior + DRY tests

* add log assertion

* fix retry logic on big segments stream failure

* add more logging for big segments connection status

* fix logging assertion

* add more big segments integration tests

* fix overly-time-sensitive file data tests

* fix more flaky tests

* run big segments tests with DynamoDB too

* Migrate transitive dep (jwt-go) to use modern version without vulnerability.

* Edit doc

* move Relay release logic to .ldrelease script

* suppress SDK big segments status query if we've never synced big segments

* dump Relay logs including debug logs if integration test fails

* include environment prefix in BigSegmentSynchronizer logging

* increase big segment integration test timeout (launchdarkly#274)

* generate client-side stream pings if big segments have changed

* clear big segments cache as needed + simplify state management

* fix tests and simplify component creation

* use GA releases of SDK packages

* disable CI package-build-test in Go 1.16+

* Migrate Relay release to Releaser v2 and support dry run (launchdarkly#278)

* Adding degraded doc blurb for big segments (launchdarkly#280)

* respect Redis password & TLS options for big segments; add Redis password integration tests

* redact Redis URL password in logs and status resource

* update go-server-sdk-redis-redigo to 1.2.1 for Redis URL logging fix

* Part 1, add the config and the documentation for the new config

* Part 2, Add the configuration validation and test

* Part 3, the actual logic to include the headers in the CORS Access-Control-Allow-Headers

* Linter

* update Alpine version to 3.14.2 to fix openssl CVEs

* Fix the global variable modification

* Go format

* turn off unnecessary metrics integrations in config for Docker smoke test

* rename test.env to smoke-test.env to clarify what it's for

* fix setting of custom Access-Control-Allow-Origin and add test (launchdarkly#285)

* add more explanatory test output and more verbose debugging for big segments integration tests (launchdarkly#287)

* update to Go 1.16.10 + Alpine 3.14.3; add some docs about releases (launchdarkly#288)

* update go-server-sdk-consul version for Consul API version update

* override x/crypto dependency version for CVE-2020-29652

* bump Prometheus dependency to eliminate jwt-go vulnerability

* drop support for Go 1.14 & 1.15

* make sure defaults are always applied for base URL properties

* rm unused

* rm unnecessary linter directive

* add separate configuration for server-side/client-side SDK base URLs & update the defaults

* remove Whitesource CI job + remove obsolete dependency issue note

* don't include any big segment status info in status resource unless that feature is active (launchdarkly#296)

* don't include any big segment status info in status resource unless that feature is active

* fix Big Segments staleness logic in status resource

* documentation

* update x/text package for vulnerability GO-2021-0113

* add Trivy security scan to CI (launchdarkly#297)

* add daily re-scan with Trivy

* use long timeout when awaiting changes related to file mod watching

* update Go version to 1.17.6 (launchdarkly#301)

* always terminate if auto-config stream fails with a fatal error

* pass along tags header when proxying events

* comments, rm debugging

* fix auth header logic

* fix auth header logic some more

* comments

* add tags header to CORS header whitelist (launchdarkly#304)

* update to Alpine 3.14.4 for CVE-2022-0778 fix

* force upgrade of openssl in Alpine

* also upgrade libretls

* fix it in both files

* update to Alpine 3.14.5 for CVE-2022-0778/CVE-2018-25032 (launchdarkly#308)

* update to Alpine 3.14.5 for CVE-2022-0778

* revert patches that are now included in Alpine 3.14.5

* add scripts for checking and updating Go/Alpine versions (launchdarkly#309)

* update to Alpine 3.14.5 for CVE-2022-0778

* add scripts for checking and updating Go/Alpine versions

* also make sure the Docker images really exist

* update CONTRIBUTING.md

* fix file rename

* revert patches that are now included in Alpine 3.14.5

* update Alpine to 3.14.6 for CVE-2022-28391

* update SDK packages (includes sc-136333 fix)

* don't include "v" prefix in Docker image version

* update go-server-sdk-dynamodb for data size error fix & add docs (launchdarkly#316)

* update builds to use Go 1.17.9 and fix the update script

* update go-server-sdk-consul to latest release

* update remote Docker version

* update golang.org/x/crypto for CVE-2022-27191 (launchdarkly#321)

* update golang.org/x/crypto for CVE-2022-27191

* fix go.sum

* update eventsource for SSE output efficiency fix (launchdarkly#322)

* Cache the replay event in case we get multiple new client connections (launchdarkly#189)

* Cache the replay event in case we get multiple new client connections

* Use singleflight to ensure only one replay event is generated at a time

Co-authored-by: Moshe Good <[email protected]>

* don't install curl in Docker images

* fix makefile logic for lint step

* remove indirect curl-based request logic in integration tests

* fix linter installation

* update Go to 1.17.11, Alpine to 3.16.0

* improve concurrency test to verify that the data is or isn't from a separate query

* fix lint warnings and remove unnecessary error return

* update libssl & libcrypto versions for CVE-2022-2097

* add security scan of already-published Docker image (launchdarkly#328)

* update Alpine version and some Go libraries to address CVEs (launchdarkly#329)

* use Alpine 3.16.1

* update golang.org/x/net and golang.org/x/sync patch versions for CVEs

* update golang.org/x/sys patch version for CVE

* update Prometheus client library for CVE-2022-21698

* ensure that DynamoDB config is consistent between Big Segments and regular data store

* comment

* update Alpine to 3.16.2

* update golangci-lint and go-junit-report

* fix CI

* prevent traversal of directories outside target path when expanding archive

* enforce TLS >= 1.2 for secure Redis

* misc linter updates

* fix test message

* add Go 1.18 & 1.19 jobs

* make test expectation less Go-version-dependent

* linting

* revert unnecessary change

* fix installation of test coverage tool

* migrate to AWS Go SDK v2 for DynamoDB (launchdarkly#333)

* update to Go 1.19.2

* update golang.org/x/net for CVE-2022-27664

* update golang.org/x/text for CVE-2022-32149

* update Consul API dependency to avoid false report of CVE-2022-40716

* switch to fork of Stackdriver metrics client to remove AWS transitive dependency (launchdarkly#343)

* update to Go 1.19.4 and Alpine 3.16.3

* override golang.org/x/net for CVE-2022-41717 only when building executables for release

* redo the security patch by updating go.mod for all builds; drop Go 1.16

* update Redis/DDB integrations to remove misleading error logging

* chore: drop go 1.17, 1.18 tests; add go 1.20 [v6] (launchdarkly#367)

* chore: drop go 1.17,1.18 tests; add go 1.20

* fix: Fix CVE-2022-41723 by overriding golang.org/x/net to v0.7.0

* chore: bump supported Go versions to 1.20.2 & 1.19.7 (launchdarkly#374)

go1.20.2 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the compiler, the covdata command, the linker, the runtime, and the crypto/ecdh, crypto/rsa, crypto/x509, os, and syscall packages.

go1.19.7 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the linker, the runtime, and the crypto/x509 and syscall packages.

* chore: update the LaunchDarkly REST API client to v12 (launchdarkly#375)

* chore: update api-client-go to v12.0.0

* chore: fix flaky autoconfig integration tests (launchdarkly#382)

* chore: modify testUpdatedSDKKeyWithExpiry to wait for healthy relay status

* increase statusPollTimeout and Interval for integration tests

* chore: update the integration test URL to properly account for prod environment (launchdarkly#384)

* chore: upgrade goreleaser to 1.16.1 (launchdarkly#396)

* chore: upgrade goreleaser to 1.16.1 and use conventional release artifact filenames

* chore: add tools.go to specify goreleaser version

* chore: add missing tools.go (launchdarkly#407)

* chore: upgrade dependencies (launchdarkly#408)

* chore: update alpine docker image to 3.17.3 (launchdarkly#429)

---------

Co-authored-by: LaunchDarklyCI <[email protected]>
Co-authored-by: Eli Bishop <[email protected]>
Co-authored-by: hroederld <[email protected]>
Co-authored-by: LaunchDarklyReleaseBot <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Casey Waldren <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.