Need upgraded versions of "golang.org/x/net","jinja2","requests" packages to resolve security vulnerabilities

[sivani01]

Hi, we are currently using operator-sdk v1.37.0 as the base image to build our operator. During our Security scan, below vulnerabilities were found.

Package	CVE	Current version	Required upgraded version
golang.org/x/net	CVE-2024-45338	v0.29.0	v0.33.0
jinja2	CVE-2024-56201, CVE-2024-56326	v3.1.4	v3.1.5
requests	CVE-2024-35195		v2.32.0

Can we know by when the new version of operator-sdk will be released with the upgraded versions of these packages?

[acornett21]

• Relates: CVE-2024-8775: Security vulnerability in ansible-core library #109

[acornett21]

Hi @sivani01 I've opened a PR to address the net and jinja2 issues, however the requests issue cannot be fixed at this time, since the protocol http+unix is not available in the fix version.

More info in this comment, and the linked slack discussion.

When the linked PR is merged I'm going to close this, and open an issue just for requests.