Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: CVE-2023-45288 ensure golang/x/net is 0.23+ #59

Merged

Conversation

subbarao-meduri
Copy link

@subbarao-meduri subbarao-meduri commented Jun 18, 2024

What this PR does / why we need it:
Part of ACM-12257

How does this change affect the cardinality of KSM: (increases, decreases or does not change cardinality)

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Signed-off-by: Subbarao Meduri <smeduri@redhat.com>
@subbarao-meduri subbarao-meduri changed the title CVE-2023-45288 ensure golang/x/net is 0.23+ fix: CVE-2023-45288 ensure golang/x/net is 0.23+ Jun 18, 2024
Copy link

sonarcloud bot commented Jun 18, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

Copy link

@thibaultmg thibaultmg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

Copy link

openshift-ci bot commented Jun 19, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: subbarao-meduri, thibaultmg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [subbarao-meduri,thibaultmg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@subbarao-meduri
Copy link
Author

ci-benchmark-tests failed due to an unfortunate side-effect of overlap in branch names used by upstream OSS and stolostron forks. Ignore the failure and merging.

### Testing release-2.12
error: pathspec 'release-2.12' did not match any file(s) known to git
make: *** [Makefile:101: test-benchmark-compare] Error 1

The contents of the forks are the same between upstream and stolostron fork except for the build meta-data files shown below:

# git diff v2.12.0 --stat
.tekton/kube-state-metrics-acm-211-pull-request.yaml | 447 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 .tekton/kube-state-metrics-acm-211-push.yaml         | 444 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 COMPONENT_NAME                                       |   1 +
 COMPONENT_VERSION                                    |   1 +
 Containerfile.operator                               |  21 ++++
 DCO                                                  |  37 +++++++
 Dockerfile.prow                                      |  20 ++++
 Makefile.prow                                        |   5 +
 OWNERS                                               |  32 +++---
 go.mod                                               |  12 +-
 go.sum                                               |  28 ++---
 sonar-project.properties                             |  10 ++
 12 files changed, 1022 insertions(+), 36 deletions(-)

@subbarao-meduri subbarao-meduri merged commit 6e13503 into stolostron:release-2.11 Jun 20, 2024
16 of 20 checks passed
@subbarao-meduri subbarao-meduri deleted the fix-CVE-2023-45288 branch June 20, 2024 17:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants