newrelic-fluent-bit-output/2.0.2-r2: cve remediation

[octo-sts]

newrelic-fluent-bit-output/2.0.2-r2: fix CVE-2024-34156

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/newrelic-fluent-bit-output.advisories.yaml

[github-actions]

Package newrelic-fluent-bit-output: Click to expand/collapse

Package newrelic-fluent-bit-output:
Unchanged

Package newrelic-fluent-bit-output-compat: Click to expand/collapse

Package newrelic-fluent-bit-output-compat:
Unchanged

bincapz found differences: Click to expand/collapse

Deleted: newrelic-fluent-bit-output/var/lib/db/sbom/newrelic-fluent-bit-output-2.0.2-r2.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
-MEDIUM	net/download	download files	downloadLocation
-LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/960247fbd5af835a1b72e0817f8a

Moved: newrelic-fluent-bit-output-compat/var/lib/db/sbom/newrelic-fluent-bit-output-compat-2.0.2-r2.spdx.json -> /tmp/wolfictl-apk-1294529685/newrelic-fluent-bit-output-compat/var/lib/db/sbom/newrelic-fluent-bit-output-compat-2.0.2-r3.spdx.json (similarity: 0.99)

Moved: newrelic-fluent-bit-output-compat/var/lib/db/sbom/newrelic-fluent-bit-output-compat-2.0.2-r2.spdx.json -> /tmp/wolfictl-apk-1294529685/newrelic-fluent-bit-output/var/lib/db/sbom/newrelic-fluent-bit-output-2.0.2-r3.spdx.json (similarity: 0.91)

[octo-sts]

Open AI suggestions to solve the build error:

No errors were found in the log file located at `/tmp/script1579951804`.

[mamccorm]

This one will keep re-opening, as the upstream project still has a hard dependency on go v1.20:

• https://github.com/newrelic/newrelic-fluent-bit-output/blob/747dc5cf609ae298e2a255613aa9bddcc233d1cb/go.mod#L4

We have to pin here to v1.20 until the issue (linked above) is resolved. Our automation is detecting go CVEs and trying to bump the epoch to resolve. if we merge this it'll keep re-opening!