Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating the dependency to fix the security issue reported by trivy #308

Merged
merged 2 commits into from Sep 7, 2021

Conversation

rohitagg2020
Copy link
Contributor

Updating the dependency to fix the security issue reported by trivy

Updating the dependency to fix the security issue reported by trivy
@100mik
Copy link
Contributor

100mik commented Sep 7, 2021

We seem to have bumped up versions for a number of dependencies instead of enforcing a certain version of gogo/protobuff as an indirect dependency. Would that have been the better approach? This seems to touch a lot of vendored dependencies.

Adopting the comments
@rohitagg2020
Copy link
Contributor Author

We seem to have bumped up versions for a number of dependencies instead of enforcing a certain version of gogo/protobuff as an indirect dependency. Would that have been the better approach? This seems to touch a lot of vendored dependencies.

it does work but we have taken a decision to bump the direct dependency rather than doing indirect way

@cppforlife cppforlife merged commit cb9ded3 into develop Sep 7, 2021
@rohitagg2020 rohitagg2020 deleted the update-dependency branch October 6, 2021 04:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants