Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Fixing git-urls dependency using another fork of the repo #17715

Closed
wants to merge 14 commits into from
Closed

fix: Fixing git-urls dependency using another fork of the repo #17715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
6ba068f
chore: Update USERS.md (#17683)
suhas-chikkanna Apr 1, 2024
5316331
docs: clarify multiple sources example (#17698)
kostis-codefresh Apr 2, 2024
6137fa2
Replacing git-urls plugin from a new repo (fork)
Apr 2, 2024
c2c9b9d
Replacing git-urls plugin from a new repo (fork)
Apr 3, 2024
48dc019
Replacing git-urls plugin from a new repo (fork)
Apr 3, 2024
7d90eb2
Replacing git-urls plugin from a new repo (fork)
Apr 3, 2024
468d47b
Replacing git-urls plugin from a new repo (fork)
Apr 4, 2024
c08f49d
Replacing git-urls plugin from a new repo (fork)
Apr 4, 2024
c0a04f3
Replacing git-urls plugin from a new repo (fork)
Apr 4, 2024
b686045
Replacing git-urls plugin from a new repo (fork)
Apr 4, 2024
97c547a
Replacing git-urls plugin from a new repo (fork)
Apr 4, 2024
5fbabbd
Replacing git-urls plugin from a new repo (fork) Signed-off-by: Boyan…
Apr 4, 2024
6e06100
Replacing git-urls plugin from a new repo (fork) Signed-off-by: Boyan…
Apr 4, 2024
ca24672
Merge branch 'master' into fix-git-urls
BKirov Apr 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions USERS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,3 +344,4 @@ Currently, the following organizations are **officially** using Argo CD:
1. [ZDF](https://www.zdf.de/)
1. [Zimpler](https://www.zimpler.com/)
1. [ZOZO](https://corp.zozo.com/)
1. [ITGix](https://itgix.com/)
6 changes: 5 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ require (
github.com/bradleyfalzon/ghinstallation/v2 v2.6.0
github.com/casbin/casbin/v2 v2.77.2
github.com/cespare/xxhash/v2 v2.2.0
github.com/chainguard-dev/git-urls v1.0.2
github.com/coreos/go-oidc/v3 v3.6.0
github.com/cyphar/filepath-securejoin v0.2.4
github.com/dustin/go-humanize v1.0.1
Expand Down Expand Up @@ -75,7 +76,6 @@ require (
github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.8.4
github.com/valyala/fasttemplate v1.2.2
github.com/whilp/git-urls v1.0.0
github.com/xanzy/go-gitlab v0.91.1
github.com/yuin/gopher-lua v1.1.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0
Expand Down Expand Up @@ -138,6 +138,7 @@ require (
github.com/tidwall/gjson v1.14.4 // indirect
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.0 // indirect
github.com/whilp/git-urls v0.0.0-20191001220047-6db9661140c0 // indirect
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was wondering if we should use a replace rule to get rid of all the instances in github.com/whilp/git-urls across our dependencies.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah good idea, come to think of it @BKirov that's the only way to be sure we clear up your image scanners.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed , can you please approve

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm. The vunlerable version is still showing up as an indirect dependency. Do you need two replaces?

github.com/whilp/git-urls v0.0.0-20191001220047-6db9661140c0 // indirect

go.opencensus.io v0.24.0 // indirect
google.golang.org/api v0.132.0 // indirect
google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
Expand Down Expand Up @@ -298,6 +299,9 @@ replace (
github.com/golang/protobuf => github.com/golang/protobuf v1.4.2
github.com/grpc-ecosystem/grpc-gateway => github.com/grpc-ecosystem/grpc-gateway v1.16.0

// Avoid CVE-2023-46402
github.com/whilp/git-urls => github.com/chainguard-dev/git-urls v1.0.2

// Avoid CVE-2022-3064
gopkg.in/yaml.v2 => gopkg.in/yaml.v2 v2.4.0

Expand Down
6 changes: 4 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -786,6 +786,8 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
github.com/chainguard-dev/git-urls v1.0.2 h1:pSpT7ifrpc5X55n4aTTm7FFUE+ZQHKiqpiwNkJrVcKQ=
github.com/chainguard-dev/git-urls v1.0.2/go.mod h1:rbGgj10OS7UgZlbzdUQIQpT0k/D4+An04HJY7Ol+Y/o=
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
Expand Down Expand Up @@ -1699,8 +1701,8 @@ github.com/vmihailenco/msgpack/v5 v5.3.4 h1:qMKAwOV+meBw2Y8k9cVwAy7qErtYCwBzZ2el
github.com/vmihailenco/msgpack/v5 v5.3.4/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q/V5KbhBonMG9jc=
github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
github.com/whilp/git-urls v1.0.0 h1:95f6UMWN5FKW71ECsXRUd3FVYiXdrE7aX4NZKcPmIjU=
github.com/whilp/git-urls v1.0.0/go.mod h1:J16SAmobsqc3Qcy98brfl5f5+e0clUvg1krgwk/qCfE=
github.com/whilp/git-urls v0.0.0-20191001220047-6db9661140c0 h1:qqllXPzXh+So+mmANlX/gCJrgo+1kQyshMoQ+NASzm0=
github.com/whilp/git-urls v0.0.0-20191001220047-6db9661140c0/go.mod h1:2rx5KE5FLD0HRfkkpyn8JwbVLBdhgeiOb2D2D9LLKM4=
github.com/xanzy/go-gitlab v0.91.1 h1:gnV57IPGYywWer32oXKBcdmc8dVxeKl3AauV8Bu17rw=
github.com/xanzy/go-gitlab v0.91.1/go.mod h1:5ryv+MnpZStBH8I/77HuQBsMbBGANtVpLWC15qOjWAw=
github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
Expand Down
2 changes: 1 addition & 1 deletion util/notification/expression/repo/repo.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import (
"github.com/argoproj/argo-cd/v2/util/notification/expression/shared"

"github.com/argoproj/notifications-engine/pkg/util/text"
giturls "github.com/whilp/git-urls"
giturls "github.com/chainguard-dev/git-urls"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"

"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
Expand Down
Loading