Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ require (
github.com/google/go-cmp v0.7.0
github.com/google/uuid v1.6.0
github.com/grafana/dskit v0.0.0-20250818234656-8ff9c6532e85
github.com/grafana/loki/pkg/push v0.0.0-20250823105456-332df2b20000
github.com/grafana/loki/pkg/push v0.4.0
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency downgrade to non-existent submodule version tag

High Severity

The github.com/grafana/loki/pkg/push module is updated from a pseudo-version based on an August 2025 commit to v0.4.0, but v0.4.0 is a tag on the root github.com/grafana/loki repository from October 2019 — not a valid tag for the pkg/push submodule. This submodule only uses pseudo-versions (the latest being v0.0.0-20260220191100-8d268fb3ae15). This will either fail to resolve or resolve to 2019-era code that lacks the StructuredMetadata, LabelsAdapter, and LabelAdapter types used in encode.go, causing a compilation failure. Renovate bot incorrectly matched the root repo tag to the submodule.

Fix in Cursor Fix in Web

github.com/json-iterator/go v1.1.12
github.com/matttproud/golang_protobuf_extensions v1.0.4
github.com/modern-go/reflect2 v1.0.2
Expand Down
Loading