Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update go.mod dependencies release-1.4 [SECURITY] #176

Merged
merged 1 commit into from
Dec 18, 2024
Merged

Update go.mod dependencies release-1.4 [SECURITY] #176

merged 1 commit into from
Dec 18, 2024

Conversation

turkenf
Copy link
Collaborator

@turkenf turkenf commented Dec 18, 2024 •
edited
Loading

Description of your changes

This PR updates go.mod dependencies to fix the following:

Name Change Type Vulnerability Severity
golang.org/x/crypto v0.21.0 -> v0.31.0 go-module GHSA-v778-237x-gjrc High
stdlib go1.22.4 -> go1.22.7 go-module CVE-2024-34158 High
stdlib go1.22.4 -> go1.22.7 go-module CVE-2024-34156 High
stdlib go1.22.4 -> go1.22.7 go-module go-module CVE-2024-24791 High
stdlib go1.22.4 -> go1.22.7 go-module CVE-2024-34155 Medium

I have:

  • Read and followed Crossplane's contribution process.
  • Run make reviewable to ensure this PR is ready for review.
  • Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

@turkenf
Update go.mod dependencies release-1.4 [SECURITY]
be9172d 
Signed-off-by: Fatih Türken <turkenf@gmail.com>
@turkenf
Copy link
Collaborator Author

turkenf commented Dec 18, 2024

/test-examples="examples/conditionalaccess/v1beta2/location.yaml"

@turkenf
Copy link
Collaborator Author

turkenf commented Dec 18, 2024

/test-examples="examples/applications/v1beta1/application.yaml"

@turkenf turkenf marked this pull request as ready for review December 18, 2024 09:01
sergenyalcin
sergenyalcin approved these changes Dec 18, 2024
View reviewed changes
Copy link
Collaborator

@sergenyalcin sergenyalcin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @turkenf LGTM!

@turkenf turkenf merged commit 57fd999 into crossplane-contrib:release-1.4 Dec 18, 2024
11 checks passed
@turkenf turkenf deleted the vulnerability-fix-1.4 branch December 18, 2024 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sergenyalcin sergenyalcin sergenyalcin approved these changes

@ulucinar ulucinar Awaiting requested review from ulucinar ulucinar is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@turkenf @sergenyalcin