grafana/loki: technical due diligence, read from its repository

The median source file here is 142 lines. 11 files exceed 1,420 lines, the largest being 2,919. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

The newest release, v3.7.9, is not on the branch this survey read; the newest release on it is v2.1.0. The shipped product may differ from what this report describes. Survey the release branch too.

3 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

4 HTTP calls use a client with no timeout (Python `requests` without `timeout=`, or Go's default client). When a dependency slows down, each one holds a worker until the connection gives up, and enough of them take the service down with the dependency.

Third-party code is committed into this repository without any statement of the terms it arrived under. Unknown terms are harder to deal with than inconvenient ones: an awkward licence can be complied with, an absent one cannot. Each of these needs its origin established before the code changes hands.

The root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.

The newest was published on 2026-10-15. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 4 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 2.1.0. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 1 record names loki with nothing tying it to this repository (CVE-2005-1943).

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

6 images in the deployment configuration are named without a version or as `latest`. A redeploy can change the software without a commit, a rollback has nothing to roll back to, and nobody can say from the repository what is running.