Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade otel/build-protobuf image 0.2.1->0.11.0 #46

Merged

Conversation

MrAlias
Copy link
Contributor

@MrAlias MrAlias commented Mar 23, 2022

Fix #45

  • Upgrades github.com/grpc-ecosystem/grpc-gateway v1.16.0 -> v2.7.0 (last version that supports Go 1.14 and resolves vulnerability)
  • Switch from github.com/golang/protobuf to google.golang.org/protobuf entirely.

Upgrades `github.com/grpc-ecosystem/grpc-gateway` v1.16.0 -> v2.10.0

Upgrades `google.golang.org/protobuf` v1.27.1 -> v1.28.0

Switch from `github.com/golang/protobuf` to `google.golang.org/protobuf`
entirely.
@MrAlias MrAlias requested a review from a team March 23, 2022 19:55
@MrAlias
Copy link
Contributor Author

MrAlias commented Mar 23, 2022

Looking at options to address Go 1.17 min requirement. Might be worth following suit for the repo.

@Aneurysm9
Copy link
Member

Can we use github.com/grpc-ecosystem/grpc-gateway@v2.7.0? That seems to be the most recent version that doesn't explicitly require 1.17.

@MrAlias
Copy link
Contributor Author

MrAlias commented Mar 24, 2022

Can we use github.com/grpc-ecosystem/grpc-gateway@v2.7.0? That seems to be the most recent version that doesn't explicitly require 1.17.

It doesn't look like there is a release that supports that version. v0.8.0 brings in these dependencies:

go: creating new go.mod: module go.opentelemetry.io/proto/otlp
go: to add module requirements and sums:
	go mod tidy
go: module github.com/golang/protobuf is deprecated: Use the "google.golang.org/protobuf" module instead.
go: added github.com/golang/protobuf v1.5.2
go: added github.com/grpc-ecosystem/grpc-gateway v1.16.0
go: added google.golang.org/grpc v1.45.0
go: added google.golang.org/protobuf v1.28.0

and v0.9.0:

go: creating new go.mod: module go.opentelemetry.io/proto/otlp
go: to add module requirements and sums:
	go mod tidy
go: added github.com/grpc-ecosystem/grpc-gateway/v2 v2.10.0
go: added google.golang.org/grpc v1.45.0
go: added google.golang.org/protobuf v1.28.0

@MrAlias
Copy link
Contributor Author

MrAlias commented Mar 24, 2022

Given there is a security issue this is resolving, it seems to motivate moving forward to Go 1.17 early.

@MrAlias
Copy link
Contributor Author

MrAlias commented Mar 24, 2022

@Aneurysm9 PTAL. I think I've figured out a way to upgrade reliably to where we want github.com/grpc-ecosystem/grpc-gateway and keep backwards compatible support.

@MrAlias MrAlias merged commit 82d5892 into open-telemetry:main Mar 25, 2022
@MrAlias MrAlias deleted the upgrade-otel-build-protobuf-image branch March 25, 2022 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Recommend moving to v2 for github.com/grpc-ecosystem/grpc-gateway
3 participants