need to update dependencies to solve vulnerabilities

[themkarimi]

dependencies used in this project are outdated and are prone to many vulnerabilities including CVE-2023-24538(with the score of 9.8), it is vital to update dependencies to solve these issues.

[BBQigniter]

Also mentioned here #401

I now tried to rebuild the stuff and it looks like I got it working - but I have no clue about Go and not sure if it works 100%, is safe to use and I'm still testing. But if somebody has more knowledge and really knows how to do it correctly - here is what I did

I cloned this repo

Then I updated the go.mod file and checked all requirements via https://pkg.go.dev/ and updated the version-numbers where I found a newer one.

The file looks now like this:

module github.com/martin-helmich/prometheus-nginxlog-exporter

go 1.25.3

require (
	github.com/hashicorp/consul/api v1.33.0
	github.com/hashicorp/hcl v1.0.0
	github.com/nxadm/tail v1.4.11
	github.com/pkg/errors v0.9.1
	github.com/prometheus/client_golang v1.23.2
	github.com/prometheus/common v0.67.4
	github.com/satyrius/gonx v1.4.0
	github.com/stretchr/testify v1.11.1
	go.uber.org/zap v1.27.1
	gopkg.in/mcuadros/go-syslog.v2 v2.3.0
	gopkg.in/yaml.v3 v3.0.1
)

require (
	github.com/armon/go-metrics v0.4.1 // indirect
	github.com/beorn7/perks v1.0.1 // indirect
	github.com/cespare/xxhash/v2 v2.3.0 // indirect
	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
	github.com/fatih/color v1.18.0 // indirect
	github.com/fsnotify/fsnotify v1.9.0 // indirect
	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
	github.com/hashicorp/errwrap v1.1.0 // indirect
	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
	github.com/hashicorp/go-hclog v1.6.3 // indirect
	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
	github.com/hashicorp/go-metrics v0.5.4 // indirect
	github.com/hashicorp/go-multierror v1.1.1 // indirect
	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
	github.com/hashicorp/golang-lru v1.0.2 // indirect
	github.com/hashicorp/serf v0.10.2 // indirect
	github.com/mattn/go-colorable v0.1.14 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mitchellh/go-homedir v1.1.0 // indirect
	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
	github.com/prometheus/client_model v0.6.2 // indirect
	github.com/prometheus/procfs v0.19.2 // indirect
	github.com/smartystreets/goconvey v1.8.1 // indirect
	go.uber.org/multierr v1.11.0 // indirect
	go.yaml.in/yaml/v2 v2.4.3 // indirect
	golang.org/x/exp v0.0.0-20251209150349-8475f28825e9 // indirect
	golang.org/x/sys v0.39.0 // indirect
	google.golang.org/protobuf v1.36.10 // indirect
	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
)

I renamed the old go.sum file and executed go mod tidy - this will create a new one

The first try with go build failed complaining about an undefined version.NewCollector function. After some googling I found that this seems to be obsolete now in a previous module and changed the line 42 to:

 42     "github.com/prometheus/client_golang/prometheus/collectors/version"
 43     /*"github.com/prometheus/common/version"*/

Next go build failed again - but at about line 80, because this module has no version.Print anymore so I replaced it with

 79     if opts.Version {
 80         /*fmt.Println(version.Print("prometheus-nginxlog-exporter"))*/
 81         fmt.Println("not-sure-what-i-am-doing")
 82         os.Exit(0)
 83     }

After those two changes, the binary was built successfully and no errors where shown. Local tests also where successful 😮

The test-config I used was:

listen {
  port = 4040
  address = "0.0.0.0"
  metrics_endpoint = "/metrics"
}

namespace "nginx" {
  format = "$proxy_add_x_forwarded_for - $remote_user [$time_local_ms] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id"
  source {
    files = [
      "/var/log/nginx/access.log"
    ]
  }
  
  labels {
    app = "nginx"
    environment = "bloopsi"
  }

  relabel "upstream_name" { from = "proxy_upstream_name" }
}

Started the exporter locally via:

./prometheus-nginxlog-exporter -config-file ./config.hcl

And pushed some logs in defined format to /var/log/nginx/access.log simply via echo "<test-log>" >> /var/log/nginx/access.log and the output on http://localhost:4040/metrics looked very promising.

In the Dockerfile I then only updated the first line to FROM golang:1.25.3 and built an image. Soon I'll probably try with Kubernetes if I get an OK from my boss.

Edit: forgot to post the updated go.mod file

[BBQigniter]

ok - next problem I hit is now #413

I'll now have a look at this fork https://github.com/jkroepke/access-log-exporter mentioned in this issue #414