Skip to content

Update golang.org/x/text to v0.3.3#3458

Merged
jmrodri merged 1 commit intooperator-framework:masterfrom
jmrodri:update-golang-text
Jul 22, 2020
Merged

Update golang.org/x/text to v0.3.3#3458
jmrodri merged 1 commit intooperator-framework:masterfrom
jmrodri:update-golang-text

Conversation

@jmrodri
Copy link
Copy Markdown
Member

@jmrodri jmrodri commented Jul 18, 2020

Description of the change:
Pull in CVE-2020-14040 fixed by golang.org/x/text v0.3.3.

Motivation for the change:

Checklist

If the pull request includes user-facing changes, extra documentation is required:

Copy link
Copy Markdown
Contributor

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catcher 👍

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 18, 2020
@camilamacedo86 camilamacedo86 removed the lgtm Indicates that a PR is ready to be merged. label Jul 18, 2020
Copy link
Copy Markdown
Contributor

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cather 👍 . we need here to use the replace because it is added indirectly by others deps that we cannot upgrade now just to solve the CEV. (go mod graph | grep golang.org/x/text)

Comment thread go.mod Outdated
replace (
github.com/Azure/go-autorest => github.com/Azure/go-autorest v13.3.2+incompatible // Required by OLM
github.com/mattn/go-sqlite3 => github.com/mattn/go-sqlite3 v1.10.0
golang.org/x/text => golang.org/x/text v0.3.3
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
golang.org/x/text => golang.org/x/text v0.3.3
golang.org/x/text => golang.org/x/text v0.3.3 // Required to fix CVE-2020-14040

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a nit ^ for we know why we are adding it.

Copy link
Copy Markdown
Contributor

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 18, 2020
Copy link
Copy Markdown
Contributor

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

However, it just solves the CEV in the SDK project and not for the project which is built with, So, if the same needs be done for the end-user projects that we need update the go.mod that is generated by the tool.

@openshift-ci-robot
Copy link
Copy Markdown

New changes are detected. LGTM label has been removed.

@openshift-ci-robot openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Jul 21, 2020
Copy link
Copy Markdown
Member

@estroz estroz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@jmrodri jmrodri force-pushed the update-golang-text branch from 1309365 to dec6810 Compare July 22, 2020 16:27
@jmrodri jmrodri merged commit 0d4ba1b into operator-framework:master Jul 22, 2020
@jmrodri jmrodri deleted the update-golang-text branch August 17, 2020 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants