elastic / cloudbeat / 17643518629 / 1
76%
main: 76%

DEFAULT BRANCH: main
Ran
Files 229
Run time 8s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 76.136%. Remained the same
17643518629.1

push

github

web-flow 
Remove glog replace directive (#3573)

### Summary of your changes
Continuation of https://github.com/elastic/cloudbeat/pull/3566

This was originally added to fix https://github.com/elastic/security/issues/6474.

I've checked and verified that 8.15 from the original issue actually compiles glog in the cloudbeat binary:
```shell
$ strings elastic-agent-8.15.0/data/elastic-agent-25075f/components/cloudbeat | grep glog | tail -n 5
github.com/golang/glog.Fatalf
github.com/golang/glog@v1.2.0/glog_file.go
github.com/golang/glog@v1.2.0/glog.go
dep	github.com/golang/glog	v1.2.0
=>	github.com/elastic/glog	v1.0.1-0.20210831205241-7d8b5c89dfc4	h1:ViJxdtOsHeO+SWVekzM82fYHH1xnvZ8CvGPXZj+G4YI=
```

However, our current version of cloudbeat does not use the dependency.

Furthermore, the replace is not necessary anymore as we don't pick the vulnerable version of the dependency.
With `replace`:
```shell
$ go list -m all | grep glog
github.com/golang/glog v1.2.5 => github.com/golang/glog v1.2.4
```
Without `replace`:
```shell
$ go list -m all | grep glog
github.com/golang/glog v1.2.5
```

The `go list -m all` command is listed in https://go.dev/ref/mod#minimal-version-selection as the way to check what dependency version is compiled in the final binary by Go's Minimal version selection (MVS) algorithm.

Removing the replace directive will help us avoid future vulnerabilities that might come up if we pin a static version in cloudbeat.

Regarding the outdated versions in go.sum see also relevant discussion in dependabot: https://github.com/dependabot/dependabot-core/issues/4740

9549 of 12542 relevant lines covered (76.14%)

16.64 hits per line

Source Files on job 17643518629.1