Skip to content

Commit d5dd7a6

Browse files
authored
[chore] Include explicit mention of GHSA-c74f-6mfw-mm4v in changelog (open-telemetry#10332)
Mentions GHSA-c74f-6mfw-mm4v explicitly in the changelog
1 parent 86ee482 commit d5dd7a6

File tree

3 files changed

+17
-14
lines changed

3 files changed

+17
-14
lines changed

.chloggen/jpkroehling-configgrpc-use-own-compressors-for-zstd.yaml

Lines changed: 0 additions & 13 deletions
This file was deleted.

CHANGELOG-API.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,14 @@ If you are looking for user-facing changes, check out [CHANGELOG.md](./CHANGELOG
77

88
<!-- next version -->
99

10+
## v0.102.1
11+
12+
No API-only changes on this release. **This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `configgrpc`.**
13+
1014
## v1.9.0/v0.102.0
1115

16+
**This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `confighttp`.**
17+
1218
### 🛑 Breaking changes 🛑
1319

1420
- `otelcol`: Remove deprecated `ConfigProvider` field from `CollectorSettings` (#10281)

CHANGELOG.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,22 @@ If you are looking for developer-facing changes, check out [CHANGELOG-API.md](./
77

88
<!-- next version -->
99

10+
## v0.102.1
11+
12+
**This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `configgrpc`.**
13+
14+
### 🧰 Bug fixes 🧰
15+
16+
- `configrpc`: Use own compressors for zstd. Before this change, the zstd compressor we used didn't respect the max message size. This addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `configgrpc` (#10323)
17+
1018
## v1.9.0/v0.102.0
1119

20+
**This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `confighttp`.**
21+
1222
### 🛑 Breaking changes 🛑
1323

1424
- `envprovider`: Restricts Environment Variable names. Environment variable names must now be ASCII only and start with a letter or an underscore, and can only contain underscores, letters, or numbers. (#9531)
15-
- `confighttp`: Apply MaxRequestBodySize to the result of a decompressed body (#10289)
25+
- `confighttp`: Apply MaxRequestBodySize to the result of a decompressed body. This addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `confighttp` (#10289)
1626
When using compressed payloads, the Collector would verify only the size of the compressed payload.
1727
This change applies the same restriction to the decompressed content. As a security measure, a limit of 20 MiB was added, which makes this a breaking change.
1828
For most clients, this shouldn't be a problem, but if you often have payloads that decompress to more than 20 MiB, you might want to either configure your

0 commit comments

Comments
 (0)