Bump github.com/elastic/go-ucfg from 0.8.6 to 0.8.7 #4390
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github.com/elastic/go-ucfg](https://github.com/elastic/go-ucfg) from 0.8.6 to 0.8.7. - [Release notes](https://github.com/elastic/go-ucfg/releases) - [Changelog](https://github.com/elastic/go-ucfg/blob/main/CHANGELOG.md) - [Commits](elastic/go-ucfg@v0.8.6...v0.8.7) --- updated-dependencies: - dependency-name: github.com/elastic/go-ucfg dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
|
Pinging @elastic/elastic-agent (Team:Elastic-Agent) |
|
This pull request does not have a backport label. Could you fix it @dependabot[bot]? 🙏
NOTE: |
|
|
@fearful-symmetry are other changes in the agent required as part of the fix from elastic/go-ucfg#197? Is the fix opt-in? @aleksmaus same question for elastic/go-ucfg#198, do we need a change in the agent to apply the fix? |
|
The same automated version bump exists on Beats elastic/beats#38251, same question there on if we need code changes beyond the package bump to fix the bugs in the release. |
For my change, it can be picked up without code changes, it will at least limit the max numeric "array" field allocation to 1024, and will be completely backwards compatible within that range. If the value is larger it will treat it as the "named field" instead. The other part of that change requires the code change. The default config needs to be initialized with "EnableNumKeys" option, which is disabled by default. This will treat any field with numberic value as the "named field". This is kind of more breaking change and would suggest to allocate some additional regression testing time. Initially this change was needed for osquery policy where the users could specify the numeric values for the query names in the pack, and in that case this change is actually helping osquery configuration from getting broken when the user specifies the numeric name for the config key. So, enabling the "EnableNumKeys" behavior is preferable for osquery, but I can't be sure about all other possible cases until it's tested thoroughly with other integrations and beats. |
|
@cmacknz for more context on the problem for osquery Without enabling "EnableNumKeys" the osquery configuration will still be broken if the user specifies the query name that is a numeric string less than 1024, like "999". Current remediation in kibana was to disallow numeric names for the queries. |
|
For the |
|
I'll merge this then, and then turning on the new features can happen separately. |
cmacknz
deleted the
dependabot/go_modules/github.com/elastic/go-ucfg-0.8.7
branch
Bumps github.com/elastic/go-ucfg from 0.8.6 to 0.8.7.
Release notes
Sourced from github.com/elastic/go-ucfg's releases.
Changelog
Sourced from github.com/elastic/go-ucfg's changelog.
Commits
1f9133cAdd exported IgnoreCommas option to fix parser issues (#197)db1ecc8Fix numeric configuration keys handling (#198)c785f58ci: update identation (#199)de82dd9notice: update year (#200)9e7ec4b[workflow] go-ucfg (#195)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)