Skip to content

CVE fixes of High priority #525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 19, 2024
Merged

CVE fixes of High priority #525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bfbdc16
CVE fixes of High priority
ChristianZaccaria Apr 16, 2024
7f7a9a2
Replace pgx/v4 for pgx/v5
ChristianZaccaria Apr 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ require (

replace sigs.k8s.io/custom-metrics-apiserver => sigs.k8s.io/custom-metrics-apiserver v1.25.1-0.20230306170449-63d8c93851f3

replace go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0

replace github.com/jackc/pgx/v4 => github.com/jackc/pgx/v5 v5.5.4
Copy link
Contributor

@KPostOffice KPostOffice Apr 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this be change to v5.5.5?

Copy link
Contributor Author

@ChristianZaccaria ChristianZaccaria Apr 17, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is a strange one, I tried doing that but go doesn't like it. I.e.,

  • With v5.5.4, a go mod tidy successfully replaces the v4 module in go.mod and go.sum.
  • With v5.5.5 a go mod tidy fails.

I even performed a git reset --hard to previous commit to ensure a fresh state to test getting and replacing the module for v5.5.5, but still failed on go mod tidy.

[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/[email protected]
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/[email protected]
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
go: finding module for package github.com/jackc/pgx/v5/pgxpool
go: finding module for package github.com/jackc/pgx/v5/pgconn
go: finding module for package github.com/jackc/pgx/v5/pgtype
go: finding module for package github.com/jackc/pgx/v5
go: found github.com/jackc/pgx/v5 in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgconn in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgtype in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgxpool in github.com/jackc/pgx/v5 v5.5.5
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)


require (
github.com/aymerick/douceur v0.2.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
Expand Down Expand Up @@ -51,29 +55,30 @@ require (
github.com/google/uuid v1.3.0 // indirect
github.com/gorilla/css v1.0.0 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/jackc/pgx/v5 v5.5.5 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/microcosm-cc/bluemonday v1.0.18 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/openshift-online/ocm-sdk-go v0.1.368 // indirect
github.com/openshift-online/ocm-sdk-go v0.1.411 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/project-codeflare/multi-cluster-app-dispatcher v1.37.0 // indirect
github.com/prometheus/client_golang v1.18.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.46.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stretchr/testify v1.8.4 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
golang.org/x/net v0.20.0 // indirect
golang.org/x/net v0.23.0 // indirect
golang.org/x/oauth2 v0.16.0 // indirect
golang.org/x/sys v0.16.0 // indirect
golang.org/x/term v0.16.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.18.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect
Expand Down
Loading