Skip to content

Security: Go 1.27.3, plugin SDK v0.297.0, npm audit fixes #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eddietejeda merged 2 commits into from
Oct 25, 2026
Merged

Security: Go 1.27.3, plugin SDK v0.297.0, npm audit fixes #70

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7194e4f
Go 1.27.3 (GO-2026-6809), plugin SDK v0.297.0, patch npm audit findings
eddietejeda Oct 25, 2026
d414695
Keep @grafana/plugin-e2e at 3.11.1
eddietejeda Oct 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:

- uses: grafana/plugin-actions/build-plugin@build-plugin/v1.2.0
with:
go-version: '1.27.2'
go-version: '1.27.3'
# Signs the plugin when the GRAFANA_ACCESS_POLICY_TOKEN repository
# secret is set; skipped (unsigned build) otherwise. Generate one at
# https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin#generate-an-access-policy-token
Expand Down
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

## Unreleased

- Build backend binaries with Go 1.27.3, fixing GO-2026-6809 (crypto/x509 trusted compromised intermediate certificates), and update grafana-plugin-sdk-go to v0.297.0.
- Force patched versions of dev/build dependencies flagged by npm audit: zod 4.6.7 (GHSA-mrhx-c7xc-m3w5), fast-uri 3.1.9 (GHSA-w74x-v6f9-j3xg and three others), ip-address 10.7.4 (GHSA-rxp7-6hxx-x8q5) and serialize-javascript 7.1.4 (GHSA-m5mm-p8h7-m29v).
- Read query results as Arrow directly from `POST /v1/query`, so a fast query takes one request instead of two. Async and too-large results still come from the Results API.
- Show the real error for failed queries: read `error_message` from query runs and failed results, and show the `message` and `code` from Hotdata error bodies instead of raw JSON.
- The query editor's database picker searches by name on the server as you type (`GET /v1/databases?search=`), so any database in a large workspace can be found without loading them all. A saved database shows its name, not its id.
Expand Down
43 changes: 22 additions & 21 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
module github.com/hotdata/hotdata

go 1.27.2
go 1.27.3

require (
github.com/apache/arrow-go/v18 v18.8.0
github.com/grafana/grafana-plugin-sdk-go v0.296.5
github.com/grafana/grafana-plugin-sdk-go v0.297.0
)

require (
Expand All @@ -19,7 +19,7 @@ require (
github.com/fatih/color v1.19.0 // indirect
github.com/go-logr/logr v1.4.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/goccy/go-json v0.10.6 // indirect
github.com/goccy/go-json v0.11.2 // indirect
github.com/gogo/googleapis v1.4.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/protobuf v1.5.4 // indirect
Expand All @@ -30,13 +30,13 @@ require (
github.com/grafana/pyroscope-go/godeltaprof v0.1.12 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0 // indirect
github.com/hashicorp/go-hclog v1.6.3 // indirect
github.com/hashicorp/go-plugin v1.8.0 // indirect
github.com/hashicorp/yamux v0.1.2 // indirect
github.com/jaegertracing/jaeger-idl v0.12.0 // indirect
github.com/jaegertracing/jaeger-idl v0.13.2 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.20.0 // indirect
github.com/klauspost/compress v1.20.1 // indirect
github.com/klauspost/cpuid/v2 v2.4.0 // indirect
github.com/magefile/mage v1.17.2 // indirect
github.com/mattetti/filebuffer v1.0.1 // indirect
Expand All @@ -50,12 +50,12 @@ require (
github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
github.com/olekukonko/errors v1.3.0 // indirect
github.com/olekukonko/ll v0.1.8 // indirect
github.com/olekukonko/tablewriter v1.1.4 // indirect
github.com/olekukonko/tablewriter v1.1.5 // indirect
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
github.com/pierrec/lz4/v4 v4.1.29 // indirect
github.com/pierrec/lz4/v4 v4.1.33 // indirect
github.com/prometheus/client_golang v1.24.1 // indirect
github.com/prometheus/client_model v0.6.3 // indirect
github.com/prometheus/common v0.71.0 // indirect
github.com/prometheus/common v0.72.0 // indirect
github.com/prometheus/procfs v0.22.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 // indirect
Expand All @@ -64,23 +64,24 @@ require (
github.com/urfave/cli v1.22.17 // indirect
github.com/zeebo/xxh3 v1.1.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.71.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.46.0 // indirect
go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.3 // indirect
go.opentelemetry.io/otel v1.46.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
go.opentelemetry.io/otel/metric v1.46.0 // indirect
go.opentelemetry.io/otel/sdk v1.46.0 // indirect
go.opentelemetry.io/otel/trace v1.46.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.72.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.47.0 // indirect
go.opentelemetry.io/contrib/samplers/jaegerremote v0.38.0 // indirect
go.opentelemetry.io/otel v1.47.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0 // indirect
go.opentelemetry.io/otel/log v1.47.0 // indirect
go.opentelemetry.io/otel/metric v1.47.0 // indirect
go.opentelemetry.io/otel/sdk v1.47.0 // indirect
go.opentelemetry.io/otel/trace v1.47.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.1 // indirect
golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/text v0.42.0 // indirect
google.golang.org/genproto v0.0.0-20210630183607-d20f26d13c79 // indirect
google.golang.org/grpc v1.83.2 // indirect
google.golang.org/grpc v1.84.0 // indirect
google.golang.org/protobuf v1.36.12 // indirect
gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
)
Loading
Loading