Skip to content

v0.1.1 - Security fix

Choose a tag to compare

@schankst schankst released this 24 Jul 17:31
· 32 commits to main since this release

Removes the github.com/sirupsen/logrus dependency, fixing CVE-2025-65637 (GHSA-4f99-4q7p-p3gh) — a DoS in Entry.Writer() on long single-line payloads, present in the pinned v1.6.0.

logrus was only used in client_test.go's TestMain for log.SetOutput(os.Stdout), which the standard library's log package already does identically. Switched to stdlib log and dropped the dependency entirely rather than just bumping the version — no functional change, one less dependency.