ENG-58332:Upgrade Micrometer version #115
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #115 +/- ##
============================================
- Coverage 68.53% 68.21% -0.33%
Complexity 107 107
============================================
Files 17 17
Lines 623 623
Branches 32 32
============================================
- Hits 427 425 -2
- Misses 177 179 +2
Partials 19 19
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| file name: micrometer-registry-prometheus-simpleclient-1.14.4.jar, fix not available yet | ||
| ]]></notes> | ||
| <packageUrl regex="true">^pkg:maven/io\.micrometer/micrometer-registry-prometheus-simpleclient@.*$</packageUrl> | ||
| <cve>CVE-2019-3826</cve> |
There was a problem hiding this comment.
This is a FP, please use a CPE suppression with no expiration and move it to the global suppression file. The vulnerability is in the prom server, not client.
There was a problem hiding this comment.
why do we need CPE suppression? what does it do?
made the changes
There was a problem hiding this comment.
By suppressing the CPE instead of the CVE we prevent future issues from popping up here too. The CVE suppression says "CVE-2019-3826 is not applicable to the micrometer prom client". The CPE suppression says "the micrometer prom client isn't the same thing as the prometheus server, and thus should not inherit prometheus server vulnerabilities".
Hope that helps.
Description
Please include a summary of the change, motivation and context.
Testing
Please describe the tests that you ran to verify your changes. Please summarize what did you test and what needs to be tested e.g. deployed and tested helm chart locally.
Checklist:
Documentation
Make sure that you have documented corresponding changes in this repository or hypertrace docs repo if required.