CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

sysutils/loki 2.9.2_34

Scalable, highly-available, multi-tenant log aggregation system

Maintainer
freebsd@funzi.org
Packages
latest: 2.9.2_34
Upstream
Higher version available: 3.7.9
Last update
to 2.9.2_34 · d81b7ba3c3
Quarterly
2026Q4: 2.9.2_34 · last MFH 60647eff54
WWW
https://github.com/grafana/loki
Links
cgit · VuXML

Unaddressed (1)

The CVE record lists the packaged version 2.9.2_34 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-217265.32026-04-15The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ru…

VuXML only (0)

Listed in VuXML, the packaged version 2.9.2_34 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
294393maintainer-feedback? sysutils/loki: service loki stop fails to kill loki processNew2026-04-10

Commits (65)

Dag-Erling Smørgrav (des) · 2.9.2_34 MFH 2026Q4 ✓
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Adam Weinberger (adamw) · 2.9.2_32
many: Bump go ports for 1.26.8 and 1.27.1
dd0905142a
Dag-Erling Smørgrav (des) · 2.9.2_31 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 2.9.2_30 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 2.9.2_29 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.12 / 1.26.5
4ea3547132
Dag-Erling Smørgrav (des) · 2.9.2_28
various: Bump go ports for go-1.25.11 / go-1.26.4
dd8dc2a59d
Adam Weinberger (adamw) · 2.9.2_27
various: Bump ports for Go 1.25.10
4e243a83f8
Dag-Erling Smørgrav (des) · 2.9.2_26
various: Bump go ports for go-1.25.9 / 1.26.2
7507e72a84
Michael Gmelin (grembo) · 2.9.2_25
sysutils/loki: Remove GH_TUPLE

GH_TUPLE is not required when using go:modules.
As a side-effect, this solves a hash issue in distfiles.

Approved by:	portmgr (blanket)
Differential Revision:	https://reviews.freebsd.org/D55695
02cf1b3851
Adam Weinberger (adamw) · 2.9.2_24
various: Bump ports for Go 1.25.8
a8d318da7c
Michael Gmelin (grembo) · 2.9.2_23
sysutils/loki: Fix build

Checksum of one of the many required go modules changed, compared
its content to what was on distcache to verify the change is harmless:

    diff consul-1.5.1/vendor/k8s.io/client-go/pkg/version/base.go ...
    ...
    < gitVersion   string = "v0.0.0-master+40cec98468b"
    ---
    > gitVersion   string = "v0.0.0-master+40cec98468b8"

Approved by:	portmgr (blanket)
1dff87feb9
Adam Weinberger (adamw) · 2.9.2_23
various: Bump ports for Go default 1.24->1.25
97685c1886
Adam Weinberger (adamw) · 2.9.2_22
various: Bump Go ports for 1.24.13
529df949a5
Adam Weinberger (adamw) · 2.9.2_21
various: Bump Go ports for 1.24.12
013f2d30b0
Mateusz Piotrowski (0mp) · 2.9.2_20
sysutils/loki: Fix a copy/paste mishap in comments

Several comments in loki's rc.d file referred to "grafana" where they
should have referred to "loki". Looks like a copy/paste mishap from
grafana's rc.d.

Approved by:	portmgr blanket
Fixes:		a96c988a2977 sysutils/loki: Add new port
Pull Request:	https://github.com/freebsd/freebsd-ports/pull/466
f0ec4e0714
Adam Weinberger (adamw) · 2.9.2_20
various: Bump Go ports for 1.24.11
b24429e3ed
Adam Weinberger (adamw) · 2.9.2_19
various: Bump Go ports for 1.24.10
0dfced16fb
Adam Weinberger (adamw) · 2.9.2_18
various: Bump go ports for go-1.24.9
90f976619b
Adam Weinberger (adamw) · 2.9.2_17
many: Bump dependent ports after go124 update
2e7587aaf8
Adam Weinberger (adamw) · 2.9.2_16
many: Bump go ports for go-1.24.7
31a5a229a7
Adam Weinberger (adamw) · 2.9.2_15
go ports: Bump for 1.24.6
53610681ea
Adam Weinberger (adamw) · 2.9.2_14
many: Bump PORTREVISION for go-1.24.5 update
275975297b
Adam Weinberger (adamw) · 2.9.2_13
various: Bump PORTREVISION after go124-1.24.4 update
94be418de3
Adam Weinberger (adamw) · 2.9.2_12
go: Bump go124-dependent ports

Earlier I bumped the default Go to 1.24. Ports that specify a lower
version will still build with those lower version (for now), so they
don't need a bumping. Instead I'm bumping anything that (now) has go124
as a dependency.
0bdd2ad334
Adam Weinberger (adamw) · 2.9.2_11
go: Bump ports for go124 update
a4e30d4f4f
Adam Weinberger (adamw) · 2.9.2_10
Bump all go ports for yesterday's releases
d0642a6176
Michael Gmelin (grembo) · 2.9.2_9
sysutils/loki: Add version information to build

This way, `loki --version` actually shows the version that
is installed.

PR:		281716
Approved by:	freebsd@funzi.org (maintainer)
d5c8853a47
Ashish SHUKLA (ashish) · 2.9.2_8
all: Bump after lang/go121 update
aa8c0111bf
Ashish SHUKLA (ashish) · 2.9.2_7
all: Bump after lang/go121 update
c4b51c2028
Ashish SHUKLA (ashish) · 2.9.2_6
all: Bump after lang/go121 update

MFH:		2024Q2
746fa696a1
Ashish SHUKLA (ashish) · 2.9.2_5
all: Bump after lang/go121 update

MFH:		2024Q2
fce0cc3272
Ashish SHUKLA (ashish) · 2.9.2_4
all: Bump after lang/go121 update

MFH:		2024Q2
32b284679a
Muhammad Moinur Rahman (bofh) · 2.9.2_3
lang/go: Change DEFAULT to 1.21

PR:		277776
Approved by:	portmgr (exp-run)
a5a000df3b
Ashish SHUKLA (ashish) · 2.9.2_2
all: Bump PORTREVISION after lang/go* update

PR:		276530
7e5aa2085f
Ashish SHUKLA (ashish) · 2.9.2_1
all: Bump PORTREVISION after lang/go* update

PR:		274405
0505b712df
Fernando Apesteguía (fernape) · 2.9.2
sysutils/loki: Update to 2.9.2

Also, add dedicated group for promtail user.

PR:		275124
Reported by:	freebsd@funzi.org (maintainer)
43d3d6830f
Robert Clausecker (fuz) · 2.9.1
sysutils/loki: add promtail rc.d script

Promtail is a log reader and it can be run as a service to gather the
logs to be sent to remote loki server. For nodes that need to send logs
only, promtail service and configuration file is needed

PR:		274194, 274473
Signed-off-by:	Christopher Beppler <freebsd@funzi.org>
Approved by:	Chirstopher Beppler <freebsd@funzi.org> (maintainer)
b16c0ca7d0
Robert Clausecker (fuz) · 2.9.1
sysutils/loki: Update to 2.9.1

Changelog: https://github.com/grafana/loki/releases/tag/v2.9.1

PR:		274473
ccbf8b7a16
Dmitri Goutnik (dmgk) · 2.8.1_2
all: Bump PORTREVISION after lang/go* update
8e4bc57934
Dmitri Goutnik (dmgk) · 2.8.1_1
all: Bump PORTREVISION after lang/go{119,120} update
09b993031a
Robert Clausecker (fuz) · 2.8.1
sysutils/loki: Update to 2.8.1

Changelog: https://github.com/grafana/loki/releases/tag/v2.8.1

PR:		271138
1f7ef2465f
Dmitri Goutnik (dmgk) · 2.7.4_2
all: Bump PORTREVISION after lang/go{119,120} update
ff40d94c1d
Dmitri Goutnik (dmgk) · 2.7.4_1
all: Bump PORTREVISION after Go ports update
09079730e9
Fernando Apesteguía (fernape) · 2.7.4
sysutils/loki: Update to 2.7.4

ChangeLog: https://github.com/grafana/loki/releases/tag/v2.7.4

PR:		269926
Reported by:	freebsd@funzi.org (maintainer)
dff69ac2a3
Dmitri Goutnik (dmgk) · 2.7.0_5
sysutils/loki: Leave a comment that Go version pinning is required
f93748e97f
Dmitri Goutnik (dmgk) · 2.7.0_5
sysutils/loki: Pin to go1.19

When built with go1.20, loki fails at runtime:

panic: Something in this program imports
go4.org/unsafe/assume-no-moving-gc to declare that it assumes a
non-moving garbage collector, but your version of
go4.org/unsafe/assume-no-moving-gc hasn't been updated to assert that
it's safe against the go1.20 runtime. If you want to risk it, run with
environment variable ASSUME_NO_MOVING_GC_UNSAFE_RISK_IT_WITH=go1.20 set.
Notably, if go1.20 adds a moving garbage collector, this program is
unsafe to use.

Pin this port to go1.19 until this is resolved upstream.

Reported by:	cation (via #freebsd-ports)
Approved by:	portmgr (blanket, just fix it)
628a88d9dc
Dmitri Goutnik (dmgk) · 2.7.0_4
all: Bump PORTREVISION after lang/go{119,120} update
56b5ec772f
Dmitri Goutnik (dmgk) · 2.7.0_3
all: Bump PORTREVISION after GO_DEFAULT update.
2297efc51b
Dmitri Goutnik (dmgk) · 2.7.0_2
all: Bump PORTVERSION after lang/go{118,119} update
3b383d833a