Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump oauth2 package version to the latest in master #715

Merged
merged 3 commits into from
Jan 21, 2022
Merged

Bump oauth2 package version to the latest in master #715

merged 3 commits into from
Jan 21, 2022

Conversation

iorvd
Copy link
Contributor

@iorvd iorvd commented Jan 19, 2022

Motivation

  1. github.com/dgrijalva/jwt-go contains a known CVE vulnerability
  2. This dependency was replaced with another jwt package.
  3. But oauth2 package version wasn't updated in master, so github.com/apache/pulsar-client-go still depends on it at the moment:

image

Modifications

Update the version of oauth2 to the latest commit to that package

Verifying this change

  • Make sure that the change passes the CI checks.

This change is a trivial rework / code cleanup without any test coverage.

$ go get github.com/apache/pulsar-client-go/oauth2@fe3b7c4e445b
$ cd $(go env GOPATH)/pkg/mod/github.com/apache/pulsar-client-go/oauth2@v0.0.0-20211108044248-fe3b7c4e445b/
$ go mod why github.com/dgrijalva/jwt-go

image

Does this pull request potentially affect one of the following parts:

If yes was chosen, please highlight the changes

  • Dependencies (does it add or upgrade a dependency): yes, upgrades oauth2 package version to the latest in master
  • The public API: no
  • The schema: no
  • The default values of configurations: no
  • The wire protocol: no

Documentation

  • Does this pull request introduce a new feature? no
  • If yes, how is the feature documented? not applicable
  • If a feature is not applicable for documentation, explain why? version update
  • If a feature is not documented yet in this PR, please create a followup issue for adding the documentation

@wolfstudy wolfstudy assigned wolfstudy and iorvd and unassigned wolfstudy Jan 20, 2022
@wolfstudy wolfstudy added this to the v0.8.0 milestone Jan 20, 2022
@wolfstudy wolfstudy self-requested a review January 20, 2022 09:10
@wolfstudy
Copy link
Member

Nice work!!

@wolfstudy
Copy link
Member

wolfstudy commented Jan 20, 2022

It looks like #713 is dealing with this, is this sufficeable? Looks like some incompatibility is happening.

@iorvd
Copy link
Contributor Author

iorvd commented Jan 20, 2022

It looks like #713 is dealing with this

@wolfstudy Looks like it's not. But that's still a valid point, l'll update the version to the latest :)

@wolfstudy wolfstudy merged commit ddacb92 into apache:master Jan 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants