[TT-17190] Upgrade apache/thrift to 0.23.0#8194
Merged
Merged
Conversation
Contributor
|
This pull request upgrades the indirect dependency Files Changed AnalysisThe changes are confined to
Architecture & Impact Assessment
graph TD
subgraph Tyk Gateway
A[Trace Package] --> B[jaeger-client-go]
end
B -- Uses --> D[apache/thrift]
B -- Sends Traces via Thrift Protocol --> C[Jaeger Agent/Collector]
Scope Discovery & Context ExpansionThe scope of this change is very narrow and isolated. The primary impact is on the dependency tree related to the Jaeger tracing exporter. While the code change itself is minimal, dependency updates can carry unforeseen risks. Any potential issues would likely manifest as a failure to send traces to Jaeger, which could be verified through integration testing with a Jaeger backend enabled. Metadata
Powered by Visor from Probelabs Last updated: 2026-05-11T15:47:08.257Z | Triggered by: pr_opened | Commit: 6a01e99 💡 TIP: You can chat with Visor using |
Contributor
✅ Architecture Check PassedNo architecture issues found – changes LGTM. \n\n✅ Architecture Check PassedNo architecture issues found – changes LGTM. \n\n✅ Performance Check PassedNo performance issues found – changes LGTM. ✅ Quality Check PassedNo quality issues found – changes LGTM. Powered by Visor from Probelabs Last updated: 2026-05-11T15:46:57.647Z | Triggered by: pr_opened | Commit: 6a01e99 💡 TIP: You can chat with Visor using |
MFCaballero
added
the
deps-reviewed
kofoworola
approved these changes
May 11, 2026
|
Contributor
Author
|
/release to release-5.8 |
Contributor
|
|
Contributor
Author
|
/release to release-5.13 |
Contributor
Author
|
/release to release-5.13.0 |
Contributor
|
✅ Cherry-pick successful. A PR was created: #8196 |
7 tasks
Contributor
|
✅ Cherry-pick successful. A PR was created: #8197 |
Merged
7 tasks
probelabs Bot
pushed a commit
that referenced
this pull request
May 11, 2026
<!-- Provide a general summary of your changes in the Title above --> ## Description Fix CVE-160: CVE-2026-41602 -> Requires Apache Thrift 0.23.0 ## Related Issue <!-- This project only accepts pull requests related to open issues. --> <!-- If suggesting a new feature or change, please discuss it in an issue first. --> <!-- If fixing a bug, there should be an issue describing it with steps to reproduce. --> <!-- OSS: Please link to the issue here. Tyk: please create/link the JIRA ticket. --> ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why <!---TykTechnologies/jira-linter starts here--> ### Ticket Details <details> <summary> <a href="https://tyktech.atlassian.net/browse/TT-17190" title="TT-17190" target="_blank">TT-17190</a> </summary> | | | |---------|----| | Status | In Dev | | Summary | Additional CVE fixes (Gateway & Dashboard) | Generated at: 2026-05-11 15:48:19 </details> <!---TykTechnologies/jira-linter ends here--> (cherry picked from commit 2648662) # Conflicts: # go.mod # go.sum
MFCaballero
added a commit
that referenced
this pull request
May 11, 2026
…to 0.23.0 (#8194) (#8196) [TT-17190] Upgrade apache/thrift to 0.23.0 (#8194) <!-- Provide a general summary of your changes in the Title above --> ## Description Fix CVE-160: CVE-2026-41602 -> Requires Apache Thrift 0.23.0 ## Related Issue <!-- This project only accepts pull requests related to open issues. --> <!-- If suggesting a new feature or change, please discuss it in an issue first. --> <!-- If fixing a bug, there should be an issue describing it with steps to reproduce. --> <!-- OSS: Please link to the issue here. Tyk: please create/link the JIRA ticket. --> ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why <!---TykTechnologies/jira-linter starts here--> ### Ticket Details <details> <summary> <a href="https://tyktech.atlassian.net/browse/TT-17190" title="TT-17190" target="_blank">TT-17190</a> </summary> | | | |---------|----| | Status | In Code Review | | Summary | Additional CVE fixes (Gateway & Dashboard) | Generated at: 2026-05-11 18:37:00 </details> <!---TykTechnologies/jira-linter ends here--> [TT-17190]: https://tyktech.atlassian.net/browse/TT-17190?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Florencia Caballero <[email protected]>
MFCaballero
added a commit
that referenced
this pull request
May 15, 2026
…t to 0.23.0 (#8194) (#8197) [TT-17190] Upgrade apache/thrift to 0.23.0 (#8194) <!-- Provide a general summary of your changes in the Title above --> ## Description Fix CVE-160: CVE-2026-41602 -> Requires Apache Thrift 0.23.0 ## Related Issue <!-- This project only accepts pull requests related to open issues. --> <!-- If suggesting a new feature or change, please discuss it in an issue first. --> <!-- If fixing a bug, there should be an issue describing it with steps to reproduce. --> <!-- OSS: Please link to the issue here. Tyk: please create/link the JIRA ticket. --> ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why <!---TykTechnologies/jira-linter starts here--> ### Ticket Details <details> <summary> <a href="https://tyktech.atlassian.net/browse/TT-17190" title="TT-17190" target="_blank">TT-17190</a> </summary> | | | |---------|----| | Status | Merge | | Summary | Additional CVE fixes (Gateway & Dashboard) | Generated at: 2026-05-15 09:24:16 </details> <!---TykTechnologies/jira-linter ends here--> [TT-17190]: https://tyktech.atlassian.net/browse/TT-17190?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Florencia Caballero <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fix CVE-160: CVE-2026-41602 -> Requires Apache Thrift 0.23.0
Related Issue
Motivation and Context
How This Has Been Tested
Screenshots (if appropriate)
Types of changes
Checklist
Ticket Details
TT-17190
Generated at: 2026-05-11 15:48:19