-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Circular dependency on prometheus/common #1381
Comments
Thanks for pointing! There was already an discussion about that in prometheus/common#58 - circular dep is unlikely to change. I believe you should be able to pin yaml.v2 to version you want in your go mod file, is that right? |
I don't believe client_golang itself use YAML for any logic itself. |
You can't pin it to a specific version because sum will always calculate the entire tree of hashes. The only way is for everyone that depends on this package to include a lot of |
Circular dependency has been solved after moving the version collector to client_golang! |
Thanks everyone! 💪🏽 |
This repo pulls vulnerable dependencies. For example, yaml.v2 <2.4.0
I noticed this when a dependency of mine ended up pulling in v1.11.1, which depends on prometheus/common@v0.26.0, which depends on v1.7.1.
This circular dependency is causing a bunch of older dependencies to linger.
As far as I can tell, this is still happening right now on
main
.The text was updated successfully, but these errors were encountered: