-
Notifications
You must be signed in to change notification settings - Fork 53
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): Update deps due to CVEs #194
Conversation
c15a117
to
c309622
Compare
This PR addresses some of the findings leaving out
Reason for this is that bumping x/net bumps also x/sys to at least v0.1.0 that has fixes backported to go 1.17 and not further down, it also introduces the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like a no-brainer to me, thanks.
Agreed, thanks @merkata. The test failure looks unrelated, but nonetheless concerning - looks like Pebble panicked! |
Yeah, I've seen this intermittent test failure. Pebble is panicking, but it's due to a test ordering / race condition. There are a bunch of other test-failures issues open as well that need to be looked at when someone has time (this is probably one of those; not sure). I'll re-run the Go 1.14 failed tests now. |
Is there a reason we cannot merge this? Some of these came up in a vulnerability scan for a container we're likely to be distributing soon? cc: @niemeyer |
Has anyone looked over the list to see if anything there actually affects us? We should be updating dependencies anyway every once in a while, but I don't want to make a routine of updating dependencies because there are CVEs in unrelated areas, even more because it's a bad idea to be updating several things at once and then not knowing why unrelated things are broken. A CVE in a dependency is not a CVE in Pebble. |
@merkata There are a few conflicts. I could fix them, but I don't want to screw up the work you've already done. Can you please have a look to make sure things are as they should before we can merge it? Thanks for the research there, btw. |
Should be all good now, thanks a lot! |
@merkata looks like you've accidentally pulled in content from some recent commits which makes this a little messy. |
Should be all good now, thank you all for the feedback! |
Security tools such as
trivy
report known CVEs against the dependencies in thego.mod
that can be fixed. This PR updates the deps to the suggested patched version. Below is the report of the found vulnerabilities and a successfulgo test ./...
afterwards.