fix: upgrade golang.org/x/net to v0.26.0 to fix CVE-2023-39325#333
fix: upgrade golang.org/x/net to v0.26.0 to fix CVE-2023-39325#333AdeshDeshmukh wants to merge 1 commit intoopenkruise:masterfrom
Conversation
|
@AdeshDeshmukh: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @AdeshDeshmukh! It looks like this is your first PR to openkruise/rollouts 🎉 |
Upgraded golang.org/x/net from v0.24.0 to v0.26.0 to address the HTTP/2 Rapid Reset vulnerability (CVE-2023-39325). The vulnerability was fixed in v0.17.0, and this upgrade ensures we have the latest security patches while maintaining compatibility with Go 1.20. Related dependencies upgraded: - golang.org/x/sys: v0.19.0 -> v0.21.0 - golang.org/x/term: v0.19.0 -> v0.21.0 - golang.org/x/text: v0.14.0 -> v0.16.0 Fixes openkruise#284 Signed-off-by: AdeshDeshmukh <adeshkd123@gmail.com>
edd6989 to
688c909
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #333 +/- ##
=======================================
Coverage 51.38% 51.38%
=======================================
Files 66 66
Lines 8559 8559
=======================================
Hits 4398 4398
Misses 3575 3575
Partials 586 586
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
What type of PR is this?
/kind bug
/area security
What this PR does / why we need it
Upgrades
golang.org/x/netfrom v0.24.0 to v0.26.0 to address the HTTP/2 Rapid Reset vulnerability (CVE-2023-39325).The vulnerability was fixed in v0.17.0, and this upgrade ensures we have the latest security patches while maintaining compatibility with Go 1.20.
Which issue(s) this PR fixes
Fixes #284
Changes made
golang.org/x/net: v0.24.0 → v0.26.0golang.org/x/sys: v0.19.0 → v0.21.0golang.org/x/term: v0.19.0 → v0.21.0golang.org/x/text: v0.14.0 → v0.16.0Testing done
go build)Does this PR introduce a user-facing change?