Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module golang.org/x/net to v0.23.0 [SECURITY] #192

Merged
merged 1 commit into from Apr 19, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 19, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
golang.org/x/net v0.22.0 -> v0.23.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45288

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Copy link

codecov bot commented Apr 19, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.01%. Comparing base (15fc147) to head (02d781d).

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #192      +/-   ##
==========================================
- Coverage   67.47%   67.01%   -0.46%     
==========================================
  Files           1        1              
  Lines         661      661              
==========================================
- Hits          446      443       -3     
- Misses        138      140       +2     
- Partials       77       78       +1     
Flag Coverage Δ
go 67.01% <ø> (-0.46%) ⬇️
wasm 0.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@renovate renovate bot merged commit 34e3ffb into master Apr 19, 2024
13 checks passed
@renovate renovate bot deleted the renovate/go-golang.org/x/net-vulnerability branch April 19, 2024 15:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants