Upgrading github.com/prometheus/common 0.68 to 0.69
Review neededv0.68.1 → v0.69.0Security3Changed2Fixed1Other1
Review neededUpgrade verdict
2 behavior changes and 3 security fixes.
In plain terms
- When a request is redirected to a different host, credentials are no longer sent along.
- Once a redirect crosses to another host, credentials stay stripped for the rest of the redirect chain.
- OAuth2 tokens are no longer fetched when a redirect goes to a different host.
Must act 3 items need code or config changes
What you must change
Security3
Strips credentials on cross-host redirects in config HTTP client handling.
Makes isCrossHostRedirect sticky across the redirect chain.
isCrossHostRedirectChecks for cross-host redirect before fetching an OAuth2 token.