Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Use a forked version of go-task for security #1549

Merged
merged 1 commit into from
Jan 18, 2024

Conversation

akim-newrelic
Copy link
Contributor

@akim-newrelic akim-newrelic commented Jan 18, 2024

Description

Replaces the go-task/task module with a forked version frozen at v3.11.0, the version we are currently using as of 1/18/24.

Link to the forked go-task repo in the newrelic-forks GH organization: https://github.com/newrelic-forks/task

Motivation

Since task allows execution of shell commands on client machines, this will protect users in case a malicious third-party actor tampers with the dependency in the future.

JIRA

https://new-relic.atlassian.net/browse/NR-178270

Copy link

codecov bot commented Jan 18, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (9fe11fb) 47.83% compared to head (56a6898) 47.83%.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1549   +/-   ##
=======================================
  Coverage   47.83%   47.83%           
=======================================
  Files         125      125           
  Lines        7825     7825           
=======================================
  Hits         3743     3743           
  Misses       3939     3939           
  Partials      143      143           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@akim-newrelic akim-newrelic merged commit 75b4826 into main Jan 18, 2024
26 of 27 checks passed
@akim-newrelic akim-newrelic deleted the use-go-task-fork branch January 18, 2024 20:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants