refactor: Replace @pyroscope/flamegraph dependency
yurishkuro opened this issue · 3 comments
The company behind this module has been acquired by Grafana. The repo moved there https://github.com/grafana/pyroscope, and they changed the license to AGPL, to match the rest of Grafana. AGPL is not allowed in CNCF projects.
We're currently on an old version, and no new versions are expected. It's not an issue right now, but eventually there may be security issues, if not in that module than in its dependencies.
- research possible replacements, present pros / cons
- make a decision with maintainers which replacement to use
- make code changes to replace the library
Hi @yurishkuro,
I noticed the use of Pyroscope in our codebase here and the corresponding test case here.
Considering Pyroscope's move to Grafana with AGPL licensing, I suggest exploring pprof as a potential replacement for our Jaeger UI project.
Steps:
- Research pprof's suitability.
- Discuss with maintainers.
- Decide and implement changes.
Ensuring project security and stability is crucial, and I believe pprof could align well with our needs.
pprof is a standalone tool, not a viz library.
react-flame-graph seems to be the most popular flame-graph visualisation library out there. It is developed by Brian Vaughn, a core React developer who amoung other things also worked on introducing the React Profiler. It seems like a great library that can be said to be the community's "go-to choice", but it hasn't received any updates since 4 years ago.
Also I couldn't find any other tools that allowed the direct conversion of a Jaegar trace to a flame graph, which could pose a problem for us. As a workaround, can we include this script for conversion from pyroscope/flamegraph into our codebase directly with proper attribution in a way that doesn't violate the licensing requirements?