New Release Soon?
andrewkratochvil opened this issue · comments
Is it possible to get a new release soon? There are several CVEs with the current release (1.4.2) that are caused by old dependencies. It appears that the prombot has updated the dependencies and would fix several of the CVEs. Thank you!
Yes, a new release is imminent.
Note that there is no evidence that any of the CVEs is affecting the Pushgateway. It's a bit of a trade-off if that justifies a new release (removing bugs that are probably irrelevant and trading them for yet unknown bugs that might very well be relevant…). I will still cut a release, simply because the previous one is so long ago.
The release is done: https://github.com/prometheus/pushgateway/releases/tag/v1.4.3
As said, no known issues with the old release, but this has updated dependencies and the binaries are built with Go 1.18.
Thank you for the new release! Updating the dependencies resolved all the findings.