prepare 8.2.2 release

.circleci/config.yml

@@ -9,12 +9,12 @@ parameters:
   # override it in any parameterized builds, but just as a convenient shareable constant.
   go-release-version:
     type: string
-    default: "1.21.3"
+    default: "1.21.5"
 
   # In addition to the most recent version of Go, we also support the previous version.
   go-previous-version:
     type: string
-    default: "1.20.10"
+    default: "1.20.12"
 
   # We use a remote Docker host in some CI jobs that need to run Docker containers.
   # As of 2022-04-15, the default Docker daemon version was 17.09.0-ce, which started

.golangci.yml

@@ -1,13 +1,12 @@
 project_name: ld-relay
 
 run:
-  deadline: 120s
+  timeout: 120s
   tests: false
 
 linters:
   enable:
     - bodyclose
-    - depguard
     - dupl
     - errcheck
     - goconst

.ldrelease/config.yml

@@ -37,7 +37,7 @@ repo:
 
 jobs:
   - docker:
-      image: cimg/go:1.21.3   # See "Runtime platform versions" in CONTRIBUTING.md
+      image: cimg/go:1.21.5   # See "Runtime platform versions" in CONTRIBUTING.md
       copyGitHistory: true
     template:
       name: go

CHANGELOG.md

@@ -8,6 +8,11 @@ All notable changes to the LaunchDarkly Relay will be documented in this file. T
 - Bump Alpine from 3.18.3 to 3.18.4
 - Bump github.com/docker/docker from v23.0.3 to v24.0.7
 
+## [7.4.2] - 2023-11-29
+### Changed:
+- Bump google.golang.org/grpc from 1.55.0 to 1.56.3
+- Bump Alpine from 3.18.3 to 3.18.4
+
 ## [8.2.0] - 2023-10-24
 ### Added:
 - Support sampling and exclusions in PHP events

Dockerfile

@@ -1,6 +1,6 @@
 # This is a standalone Dockerfile that does not depend on goreleaser building the binary
 # It is NOT the version that is pushed to dockerhub
-FROM golang:1.21.3-alpine3.18 as builder
+FROM golang:1.21.5-alpine3.19 as builder
 # See "Runtime platform versions" in CONTRIBUTING.md
 
 RUN apk --no-cache add \
@@ -21,7 +21,7 @@ ENV GOPATH=/go
 
 RUN go build -a -o ldr .
 
-FROM alpine:3.18.4
+FROM alpine:3.19.0
 
 RUN addgroup -g 1000 -S ldr-user && \
     adduser -u 1000 -S ldr-user -G ldr-user && \
@@ -30,7 +30,7 @@ RUN addgroup -g 1000 -S ldr-user && \
 
 RUN apk add --no-cache \
     ca-certificates \
- && apk add --upgrade libcrypto1.1 libssl1.1 git \
+ && apk add --upgrade libcrypto3 libssl3 \
  && update-ca-certificates \
  && rm -rf /var/cache/apk/*
 

Dockerfile.goreleaser

@@ -2,12 +2,12 @@
 
 # See .ldrelease/config.yml for an explanation of the build/release process.
 
-FROM alpine:3.18.4
+FROM alpine:3.19.0
 # See "Runtime platform versions" in CONTRIBUTING.md
 
 RUN apk add --no-cache \
     ca-certificates \
- && apk add --upgrade libcrypto1.1 libssl1.1 \
+ && apk add --upgrade libcrypto3 libssl3 \
  && update-ca-certificates \
  && rm -rf /var/cache/apk/*
 

Makefile

@@ -1,5 +1,5 @@
 
-GOLANGCI_LINT_VERSION=v1.51.2
+GOLANGCI_LINT_VERSION=v1.55.2
 
 LINTER=./bin/golangci-lint
 LINTER_VERSION_FILE=./bin/.golangci-lint-version-$(GOLANGCI_LINT_VERSION)

README.md

@@ -86,7 +86,11 @@ If none of these are specified, the default is `--config /etc/ld-relay.conf`.
 
 ## Persistent storage
 
-You can configure Relay Proxy nodes to persist feature flag settings in Redis, DynamoDB, or Consul. You must use persistent storage to run your SDKs in daemon mode, or to use Big Segments. To learn more, read [Using a persistent store](https://docs.launchdarkly.com/home/relay-proxy/using#using-a-persistent-store).
+You can configure Relay Proxy nodes to persist feature flag settings in Redis, DynamoDB, or Consul. You must use persistent storage to run your SDKs in daemon mode. To learn more, read [Using a persistent store](https://docs.launchdarkly.com/home/relay-proxy/using#using-a-persistent-store).
+
+You can also configure the Relay Proxy to persist segment information for Big Segments in Redis or DynamoDB. To learn more, read [Configuring the Relay Proxy for segments](https://docs.launchdarkly.com/home/relay-proxy/using#configuring-the-relay-proxy-for-segments).
+
+> Segments let you target groups of contexts that encounter feature flags. Big Segments are segments with more than 15,000 targets, or that are synced from external tools. You must use either the Relay Proxy or a persistent store integration if you use server-side SDKs and Big Segments. If supporting segments is your only use case, we recommend using a persistent store integration rather than the Relay Proxy.
 
 For persistent storage configuration details, read [Persistent Storage](./docs/persistent-storage.md).
 

docs/configuration.md

@@ -63,8 +63,8 @@ For **Duration** settings, the value should be be an integer followed by `ms`, `
 | `tlsKey`                      | `TLS_KEY`                        |  String  |         | Required if `tlsEnabled` is true. Path to TLS private key file.                                                                                                                                                                                                                                                                                                                                                                                |
 | `tlsMinVersion`               | `TLS_MIN_VERSION`                |  String  |         | Set to "1.2", etc., to enforce a minimum TLS version for secure requests.                                                                                                                                                                                                                                                                                                                                                                      |
 | `logLevel`                    | `LOG_LEVEL`                      |  String  | `info`  | Should be `debug`, `info`, `warn`, `error`, or `none`. To learn more, read [Logging](./logging.md).                                                                                                                                                                                                                                                                                                                                                        |
-| `bigSegmentsStaleAsDegraded`  | `BIG_SEGMENTS_STALE_AS_DEGRADED` | Boolean  | `false` | Indicates if environments should be considered degraded if big segments are not fully synchronized.                                                                                                                                                                                                                                                                                                                                            |
-| `bigSegmentsStaleThreshold`   | `BIG_SEGMENTS_STALE_THRESHOLD`   | Duration | `5m`    | Indicates how long until big segments should be considered stale.                                                                                                                                                                                                                                                                                                                                                                              |
+| `bigSegmentsStaleAsDegraded`  | `BIG_SEGMENTS_STALE_AS_DEGRADED` | Boolean  | `false` | Indicates if environments should be considered degraded if Big Segments are not fully synchronized.                                                                                                                                                                                                                                                                                                                                            |
+| `bigSegmentsStaleThreshold`   | `BIG_SEGMENTS_STALE_THRESHOLD`   | Duration | `5m`    | Indicates how long until Big Segments should be considered stale.                                                                                                                                                                                                                                                                                                                                                                              |
 
 _(1)_ The default values for `streamUri`, `baseUri`, and `clientSideBaseUri` are `https://stream.launchdarkly.com`, `https://sdk.launchdarkly.com`, and `https://clientsdk.launchdarkly.com`, respectively. You should never need to change these URIs unless you are either using a special instance of the LaunchDarkly service, in which case Support will tell you how to set them, or you are accessing LaunchDarkly using a reverse proxy or some other mechanism that rewrites URLs.
 
@@ -183,7 +183,7 @@ To learn more, read [Persistent storage](./persistent-storage.md).
 | `port`           | `REDIS_PORT`     |  Number  | `6379`      | Port of the Redis database. Note that if you are using environment variables, setting `REDIS_PORT` to a string like `tcp://host:port` sets both the host and the port; this is used in Docker. |
 | `url`            | `REDIS_URL`      |  String  |             | URL of the Redis database (overrides `host` & `port`).                                                                                                                                         |
 | `tls`            | `REDIS_TLS`      | Boolean  | `false`     | If `true`, will use a secure connection to Redis (not all Redis servers support this). If you specified a `redis://` URL, setting `tls` to `true` will change it to `rediss://`.               |
-| `password`       | `REDIS_PASSWORD` |  String  |             | Optional password if Redis require authentication.                                                                                                                                             |
+| `password`       | `REDIS_PASSWORD` |  String  |             | Optional password if Redis requires authentication.                                                                                                                                             |
 | `username`       | `REDIS_USERNAME` |  String  |             | Optional username if Redis requires authentication.                                                                                                                                            |
 | `localTtl`       | `CACHE_TTL`      | Duration | `30s`       | Length of time that database items can be cached in memory.                                                                                                                                    |
 

docs/persistent-storage.md

@@ -4,7 +4,7 @@
 
 You can configure Relay Proxy nodes to persist feature flag settings in Redis, DynamoDB, or Consul. This provides durability in use cases like a temporary network partition that prevents the Relay Proxy from communicating with LaunchDarkly's servers. If you use Big Segments, you can only use Redis or DynamoDB as a feature store.
 
-To learn more, read [Using a persistent feature store](https://docs.launchdarkly.com/sdk/concepts/feature-store), and the Relay Proxy documentation on [Configuration](./configuration.md).
+To learn more, read [Using a persistent feature store](https://docs.launchdarkly.com/sdk/concepts/data-stores), and the Relay Proxy documentation on [Configuration](./configuration.md).
 
 The Relay Proxy does not support clustered Redis or Redis Sentinel.
 
@@ -34,9 +34,9 @@ DYNAMODB_TABLE=my-feature-flags
 CACHE_TTL=30s
 ```
 
-The Relay Proxy can only use one of these at a time. If you enabled both Redis and DynamoDB it would result in an error.
+The Relay Proxy can only use one of these at a time. If you enable both Redis and DynamoDB it will result in an error.
 
-LaunchDarkly SDK clients have their own options for configuring persistent storage. If you use [daemon mode](../README.md#daemon-mode), the clients need to be using the same storage configuration as the Relay Proxy. If you are not using daemon mode, the two configurations are completely independent. For example, you could have a relay using Redis, but a client using DynamoDB or not using persistent storage at all.
+LaunchDarkly SDK clients have their own options for configuring persistent storage. If you use [daemon mode](../README.md#daemon-mode), the clients need to be using the same storage configuration as the Relay Proxy. If you are not using daemon mode, the two configurations are completely independent. For example, you could have a Relay Proxy using Redis, but a client using DynamoDB or not using persistent storage at all.
 
 If the database becomes unavailable, the Relay Proxy's behavior, based on its use of the Go SDK, depends on the `CACHE_TTL` setting:
 

go.mod

@@ -42,8 +42,7 @@ require (
 	github.com/prometheus/client_golang v1.15.1 // indirect; override to address CVE-2022-21698
 	github.com/stretchr/testify v1.8.4
 	go.opencensus.io v0.24.0
-	golang.org/x/net v0.17.0 // indirect; override to address CVE-2022-41723
-	golang.org/x/sync v0.2.0
+	golang.org/x/sync v0.5.0
 	gopkg.in/gcfg.v1 v1.2.3
 )
 
@@ -77,6 +76,7 @@ require (
 	cloud.google.com/go/storage v1.29.0 // indirect
 	cloud.google.com/go/trace v1.9.0 // indirect
 	code.gitea.io/sdk/gitea v0.15.1 // indirect
+	dario.cat/mergo v1.0.0 // indirect
 	github.com/AlekSi/pointer v1.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.3.1 // indirect
@@ -102,8 +102,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.1 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230528122434-6f98819771a1 // indirect
-	github.com/acomagu/bufpipe v1.0.4 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/atc0005/go-teams-notify/v2 v2.7.0 // indirect
@@ -132,7 +131,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/charmbracelet/lipgloss v0.6.0 // indirect
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220327082430-c57b701bfc08 // indirect
-	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
@@ -154,8 +153,8 @@ require (
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.4.1 // indirect
-	github.com/go-git/go-git/v5 v5.7.0 // indirect
+	github.com/go-git/go-billy/v5 v5.5.0 // indirect
+	github.com/go-git/go-git/v5 v5.11.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-openapi/analysis v0.21.4 // indirect
@@ -174,7 +173,7 @@ require (
 	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-containerregistry v0.14.0 // indirect
 	github.com/google/go-github/v50 v50.0.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
@@ -251,7 +250,7 @@ require (
 	github.com/sigstore/rekor v1.2.0 // indirect
 	github.com/sigstore/sigstore v1.6.4 // indirect
 	github.com/sirupsen/logrus v1.9.0 // indirect
-	github.com/skeema/knownhosts v1.1.1 // indirect
+	github.com/skeema/knownhosts v1.2.1 // indirect
 	github.com/slack-go/slack v0.12.1 // indirect
 	github.com/spf13/afero v1.9.3 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
@@ -273,14 +272,15 @@ require (
 	gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
 	go.mongodb.org/mongo-driver v1.11.3 // indirect
 	gocloud.dev v0.29.0 // indirect
-	golang.org/x/crypto v0.14.0 // indirect
-	golang.org/x/mod v0.11.0 // indirect
+	golang.org/x/crypto v0.17.0 // indirect
+	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
 	golang.org/x/oauth2 v0.7.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.9.3 // indirect
+	golang.org/x/tools v0.16.1 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/api v0.121.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect