Security
This release fixes a high-severity SQL injection in the TraceQL metrics endpoints (/api/metrics/query_range and /api/metrics/query, plus their /tempo versions). Regex filters (=~, !~) weren't escaped properly, so an unauthenticated caller could run their own SQL on ClickHouse with the reader's account. All versions up to and including 5.6.1 are affected. Upgrade is strongly recommended.
Advisory: GHSA-w49g-c353-q3rg
If you can't upgrade straight away, enable basic auth (QRYN_LOGIN and QRYN_PASSWORD), or connect the reader with a read-only ClickHouse account limited to Gigapipe's database.
Thanks to @NotAFlightRisk for reporting it.
Behaviour change
In TraceQL metrics regex filters, \b now means a word boundary (it was read as a backspace character) and \\ matches a literal backslash. Other patterns behave as before.
What's Changed
- fix(logql): support unwrap conversion functions (duration, bytes) by @Guess-Who-sec in #1052
- test(smart_buffer): deflake TestRAMChunk_ReleaseReusesBlocks by @Guess-Who-sec in #1056
- ci(dependabot): keep GitHub Actions up to date by @rita7lopes in #1072
- build(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1073
- build(deps): bump actions/setup-go from 5 to 7 by @dependabot[bot] in #1074
- build(deps): bump docker/setup-buildx-action from 3.10.0 to 4.4.1 by @dependabot[bot] in #1075
- build(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #1076
- build(deps): bump mydea/action-wait-for-api from 1 to 2 by @dependabot[bot] in #1077
- build(deps): bump github.com/prometheus/prometheus from 0.315.1 to 0.316.0 by @dependabot[bot] in #1078
- build(deps): bump golang.org/x/sync from 0.24.0 to 0.25.0 by @dependabot[bot] in #1079
- test(writer): pin label fingerprint values (M2 1/4, #991) by @Guess-Who-sec in #1060
- chore(ci): M1 tooling groundwork and deterministic PromQL substitute names (#918) by @Guess-Who-sec in #1059
Full Changelog: v5.6.1...v5.6.2