fix protobuf vulnerability #245
Conversation
cdlliuy
force-pushed
the
dev_updateprotobufversion
branch
from
9a153a2 to
4a2999e
Compare
Codecov Report
@@ Coverage Diff @@
## master #245 +/- ##
=======================================
Coverage 92.07% 92.07%
=======================================
Files 6 6
Lines 757 757
=======================================
Hits 697 697
Misses 39 39
Partials 21 21 Continue to review full report at Codecov.
|
go.mod
Outdated
| @@ -24,3 +24,5 @@ require ( | |||
| k8s.io/client-go v0.17.17 | |||
| sigs.k8s.io/controller-runtime v0.5.0 | |||
| ) | |||
|
|
|||
| replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2 | |||
There was a problem hiding this comment.
Let's pull this in as an indirect dependency. Replaces can have issues when upgrading deps later on, so I'd prefer to avoid them.
Running this command pulled in the new version to go.mod for me:
go get github.com/gogo/protobuf@latestThere was a problem hiding this comment.
@JohnStarich , fixed per comment, Also, the softlayer-go package is updated along with the go mod tidy cmd
There was a problem hiding this comment.
@JohnStarich , can you review again?
cdlliuy
force-pushed
the
dev_updateprotobufversion
branch
from
0244c2a to
b265b1c
Compare
Signed-off-by: Liu Ying <[email protected]>
cdlliuy
force-pushed
the
dev_updateprotobufversion
branch
from
b265b1c to
5b8282d
Compare
|
@JohnStarich thanks , updated :-) |
To fix the golang/protobuf vulnerability
Given it is not explicitly required, I tend to use replace to pin the correct version.