Skip to content
Snippets Groups Projects
Unverified Commit b80d27c2 authored by sudoforge's avatar sudoforge Committed by GitHub
Browse files

build(deps)!: upgrade bleve v1.0.14 => v2.5.1 (#1442)

This change upgrades `bleve`, primarily to remove the need for the
replace directive on `github.com/willf/bitset`, but this change upgrades
further to move past a non-impacting vulnerability to the `bleve/http`
package [0] [1], even though we do not use it, even indirectly.

Note that even though the GitHub advisory [0] notes that this is patched
in `v2.5.0`, all that seems to have happened (see [1]) is that a README
was added to the package noting the vulnerabilities.

Other CVE databases [2] [3] do not mark this as resolved. Again,
however, git-bug DOES NOT USE this package, so it is not really a
concern.

The cache and indexing format was changed. Index storage gains are
_significant_ (at the time of writing, with the git-bug repository, this
change reduces the index cache from ~51 MiB to less than 4 MiB).

This does not come with a change to bleve's API. We do have a test that
validates that the index file exists, however, so this change refactors
that to check against the appropriate path.

[0]: https://github.com/advisories/GHSA-9w9f-6mg8-jp7w
[1]:
https://github.com/blevesearch/bleve/commit/1c7509d6a17d36f265c90b4e8f4e3a3182fe79ff
[2]: https://nvd.nist.gov/vuln/detail/CVE-2022-31022
[3]: https://pkg.go.dev/vuln/GO-2022-0470



BREAKING-CHANGE:
 This causes a change to the format of the internal, local cache that
 git-bug uses. Users should note that older versions of git-bug will be
 incompatible with this new cache format.

 If you wish to downgrade to an older version of git-bug, you should
 first remove the cache by executing `rm -rf .git/git-bug` in a
 terminal, and then initialize the older version of git-bug to build a
 compatible version of the cache.

Co-authored-by: default avatarMichael Muré <battoletre@gmail.com>
Change-Id: I9ab436ade9221bfd91b84ebaf47434f1b3d91cd3

Co-authored-by: default avatarMichael Muré <battoletre@gmail.com>
parent e49c93d4
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment