update loggregator-release to include prometheus 2.12.0

[luisapace]

Hi, my team would use loggregator-release (V104.4 or higher) and to approve that I've to verify that all its licenses are acceptable.

During my analysis I've found a problematic license in the code of package prometheus 2.10.0 (dependency of loggregator-release, and so I've opened an issue on it: prometheus/prometheus#5783

(please note that I've opened the issue on 2.9.2 but 2.10.0 have the same problem).

Its developers have solved the issue in prometheus 2.12.0 (see details in the above issue).

So, I kindly ask you to update loggregator-release to use the new version of prometheus.

Thanks a lot.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/168452217

The labels on this github issue will be updated when the story is started.

[luisapace]

Hi, do you have any new on this issue? Thanks

[Max Eshleman]

@luisapace Sorry about the delay on a response. I'm not seeing where loggregator release depends on prometheus/prometheus. It isn't in the go.mod and a go mod why github.com/prometheus/prometheus returns (main module does not need package github.com/prometheus/prometheus)

Would you mind pointing out where you're finding this dependency in the codebase?

[luisapace]

@kitemongerer Hi Max, my colleague Michele Licursi has sent you an email with details, please let me know in case you have not received it.

Thanks

[Max Eshleman]

@luisapace I did not receive the email. It would be great if it would be posted in the #loggregator channel in https://cloudfoundry.slack.com/messages/C02HCCXV5 so the rest of the team can assist

[Michele Licursi]

@kitemongerer
The dependency chain that links to prometheus is the following

https://github.com/cloudfoundry/loggregator-release/tree/v104.4/src/code.cloudfoundry.org shows this link: https://github.com/cloudfoundry/log-cache/tree/b58cf4e7bc872866d692b7757683ce6711bc182f.
inside log-cache you can then find log-cache/internal/promql/promql.go .
The promql.go has : "github.com/prometheus/prometheus/pkg/labels"

"github.com/prometheus/prometheus/promql"

"github.com/prometheus/prometheus/storage"
among its imports

This is surprising as the link says: "bump log-cache to version that doesn't require prometheus "

Hope this clarifies the issue raised by Luisa

[luisapace]

@kitemongerer Hi, are there any updates? Thanks

[Max Eshleman]

@luisapace It looks like the current version of loggregator-release has this log-cache commit in its go.mod: cloudfoundry/log-cache-release@8c97ac6#diff-12842eeae4e409eb286af05c15acac3e

which has Prometheus 2.12.0... is that what you're looking for?

[luisapace]

@kitemongerer yes, thanks. May I ask you if you can confirm what is the current version? 103.4.3?

[Max Eshleman]

It's 106.2.0

[luisapace]

I've seen it has been just released! thanks a lot again for your help

[luisapace]

@kitemongerer many thanks again