build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.1

[dependabot]

Bumps github.com/sirupsen/logrus from 1.9.4 to 1.10.1.

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.10.1

Logrus v1.10.1

This patch release fixes two issues in field formatting and handling:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed values implementing error to be used with WithError, WithField, and WithFields.

Dependency Changes

• update github.com/stretchr/testify to v1.12.0

Full Changelog: sirupsen/logrus@v1.10.0...v1.10.1

v1.10.0

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

• ~17% lower geomean runtime across the benchmark suite
• ~27% higher geomean formatter throughput
• Common enabled logging paths are ~30–44% faster
• WithError is ~40% faster
• Chained fields are ~46% faster
• TextFormatter paths are up to ~40% faster
• Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

• Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
• Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

JSONFormatter itself remains largely unchanged in runtime performance, with small allocation reductions.

🔄 log/slog interoperability

v1.10 adds bidirectional interoperability between Logrus and Go's log/slog:

• A Logrus slog hook can forward existing Logrus entries to an slog logger.
• hooks/slog.NewHandler implements slog.Handler, allowing log/slog records to use an existing Logrus logger and its hooks, formatter, and output.
• The handler preserves levels, fields, groups, context, record timestamps, and optionally caller information.
• Caller reporting is configured per handler, without requiring Logrus's logger-wide ReportCaller option.
• Custom slog levels can be mapped to Logrus levels.

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.10.1

Fixes:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed implementations of error as field values.

1.10.0

Fixes:

• Fix reentrant logging deadlocks in formatter paths.
• Fix race conditions in formatter and entry handling.
• Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel. Use the corresponding Panic methods when panic behavior is desired.
• Improve concurrency safety around formatter and hook access.

Features:

• Add slog hook for forwarding Logrus entries to log/slog.
• Add slog.Handler for forwarding log/slog records to a Logrus logger, including levels, fields, groups, context, time, and optional caller reporting. The hook and handler can also be combined to help migrate between Logrus and log/slog.
• Add minimal, composable logging interfaces for each log level. This enables consumers to depend on narrower interfaces, making it easier to substitute or adapt logging implementations.
• Allow Entry.Caller to be set explicitly and preserve it across derived entries, enabling custom caller detection without Logrus overwriting caller information when ReportCaller is enabled.

Changed:

• Raise minimum supported Go version to 1.23.
• TextFormatter now renders []byte values as raw/quoted strings instead of slice-of-ints.
• TextFormatter now uses distinct dimmed colors for debug and trace output.
• TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching the behavior on other platforms.
• Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly.
• Deprecated MutexWrap, which was unintentionally exposed as public API. It remains available as an alias for compatibility but should not be used directly.

Performance:

• Significantly improve TextFormatter performance and reduce allocations.
• Optimize common Entry and Logger hot paths.
• Reduce allocations in caller reporting.

... (truncated)

Commits

• 8b673a9 Merge pull request #1583 from thaJeztah/release_1.10.1
• 0b920ad Merge pull request #1584 from thaJeztah/more_coverage
• 5e20694 TextFormatter: cover nil pointer method receivers
• 8312732 update changelog for v1.10.1
• e987a40 Merge pull request #1582 from thaJeztah/panic_handler
• 17d574b TextFormatter: recover panics from Error and String methods
• 134c80f Merge pull request #1579 from thaJeztah/err_handling
• 7350f42 logger: WithError: wrap logger.WithError for consistency
• b3369d2 entry: allow function-backed error fields
• 1080083 Merge pull request #1578 from thaJeztah/err_handling_tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The dependency updates to logrus (1.10.1) and testify (1.12.0) are correctly implemented and meet the project's quality standards. However, two critical issues must be addressed: \n\n1. Security Risk: The project's current Go toolchain (v1.23) contains several high-severity security vulnerabilities in the standard library, including CVE-2026-27145 and CVE-2026-42504, which could lead to Denial of Service or memory exhaustion.\n2. Breaking Change: The update to Logrus v1.10.x introduces a breaking change in TextFormatter where []byte values are now rendered as strings instead of integer slices. This may break downstream log ingestion or monitoring pipelines that rely on the previous format.\n\nVerification of the Go environment compatibility and log output formatting is required before merging.

About this PR

• The update to Logrus v1.10.1 includes a breaking change in the TextFormatter logic: []byte values are now rendered as strings rather than slice-of-ints. If your log ingestion pipelines (e.g., ELK, Splunk) or parsers expect the previous integer slice format, they will likely fail to parse these logs correctly.

Test suggestions

• Verify successful build and test execution using Go 1.23 or higher, as required by Logrus v1.10.0\n- [ ] Verify that TextFormatter's change in []byte rendering (from int slices to strings) does not break downstream log consumers or parsers

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify successful build and test execution using Go 1.23 or higher, as required by Logrus v1.10.0\n- [ ] Verify that TextFormatter's change in []byte rendering (from int slices to strings) does not break downstream log consumers or parsers

Low confidence findings

• Logrus v1.10.0 has increased the minimum supported Go version to 1.23. Although the current toolchain meets this, ensure that the build environment and any shared CI runners are fully compatible with this requirement to prevent build failures.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

The project toolchain (Go 1.23) is affected by multiple known security vulnerabilities in the standard library, including CVE-2026-27145 (DoS in crypto/x509) and CVE-2026-42504 (DoS in MIME header processing). It is highly recommended to update the Go version in go.mod to a patched release to mitigate these risks.

See Issue in Codacy
See Issue in Codacy
See Issue in Codacy