chore(deps): update module github.com/golang/glog to v1.2.4 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/golang/glog	v1.0.0 → v1.2.4

---

Insecure Temporary File usage in github.com/golang/glog

CVE-2024-45339 / GHSA-6wxm-mpqj-6jpf

More information

Details

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Severity

• CVSS Score: 4.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45339
• https://github.com/golang/glog/pull/74
• https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
• https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
• https://pkg.go.dev/vuln/GO-2025-3372
• https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html
• https://github.com/advisories/GHSA-6wxm-mpqj-6jpf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

golang/glog (github.com/golang/glog)

v1.2.4

Compare Source

What's Changed

• Fail if log file already exists by @​chressie in #​74:
  • glog: Don't try to create/rotate a given syncBuffer twice in the same second
  • glog: introduce createInDir function as in internal version
  • glog: have createInDir fail if the file already exists

Full Changelog: golang/glog@v1.2.3...v1.2.4

v1.2.3

Compare Source

What's Changed

• glog: check that stderr is valid before using it by default by @​chressie in #​72
• glog: fix typo by @​chressie in #​73

Full Changelog: golang/glog@v1.2.2...v1.2.3

v1.2.2

Compare Source

What's Changed

• glog: avoid calling user.Current() on windows by @​bentekkie in #​69

Full Changelog: golang/glog@v1.2.1...v1.2.2

v1.2.1

Compare Source

What's Changed

• glog: don't hold mutex when sync'ing by @​chressie in #​68

Full Changelog: golang/glog@v1.2.0...v1.2.1

v1.2.0

Compare Source

What's Changed

• glog: add context variants and logsink tests by @​chressie in #​66

Full Changelog: golang/glog@v1.1.2...v1.2.0

v1.1.2

Compare Source

Bugfix release.

What's Changed

• glog: populate symlinks -log_link directory by @​chressie in #​64

Full Changelog: golang/glog@v1.1.1...v1.1.2

v1.1.1

Compare Source

Bugfixes since the larger v1.1.0, which have been addressed.

v1.1.0

Compare Source

Tagging v1.1.0 after syncing glog with internal changes

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/google/go-cmp	v0.5.9 -> v0.6.0