Skip to content

Conversation

@JiriCtvrtka
Copy link
Collaborator

@JiriCtvrtka JiriCtvrtka commented Dec 17, 2025

PMM-14577

Remove the Grafana and Grafana SDK dependencies (those are causing most of CVEs). I initially asked AI to create the PR and then made the necessary fixes on top of it.

Everything is passing, so it looks good.

PR to main: #350

@@ -0,0 +1,137 @@
// Copyright 2023 Percona LLC
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code copy out from Grafana code.

@@ -0,0 +1,64 @@
// Copyright 2023 Percona LLC
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code copy out from Grafana code.

@@ -0,0 +1,88 @@
// Copyright 2023 Percona LLC
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code copy out from Grafana code.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeahh this is one part i wasn't sure of too (since grafana has its own license)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually I think any other will trigger lint error. But good point. We can verify this on tomorrow's Go Backend meeting

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, we can't change the license, so let's do the following:

  1. Keep the original license
  2. Exclude the whole directory from our license linter

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, let's reference the sources so that we can sync up with upstream as necessary.

@JiriCtvrtka JiriCtvrtka marked this pull request as ready for review December 17, 2025 15:13
@ademidoff ademidoff changed the base branch from pmm-3.4.1 to v3 December 17, 2025 22:33
@JiriCtvrtka JiriCtvrtka changed the base branch from v3 to main December 31, 2025 08:38
@JiriCtvrtka JiriCtvrtka changed the base branch from main to v3 December 31, 2025 08:45
@ademidoff
Copy link
Member

@svetasmirnova Snyk has been deprecated by IT. Shall we remove the related workflows?

@JiriCtvrtka JiriCtvrtka merged commit 7a1cfe9 into v3 Jan 7, 2026
2 of 4 checks passed
@ademidoff ademidoff deleted the PMM-14577-CVEs-fix branch January 7, 2026 14:38
@svetasmirnova
Copy link
Collaborator

@ademidoff Yes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants