Skip to content

CVE fixes of High priority #525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 19, 2024
Merged

CVE fixes of High priority #525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bfbdc16
CVE fixes of High priority
ChristianZaccaria Apr 16, 2024
7f7a9a2
Replace pgx/v4 for pgx/v5
ChristianZaccaria Apr 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ require (

replace sigs.k8s.io/custom-metrics-apiserver => sigs.k8s.io/custom-metrics-apiserver v1.25.1-0.20230306170449-63d8c93851f3

replace go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0

replace github.com/jackc/pgx/v4 => github.com/jackc/pgx/v5 v5.5.4
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this be change to v5.5.5?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is a strange one, I tried doing that but go doesn't like it. I.e.,

  • With v5.5.4, a go mod tidy successfully replaces the v4 module in go.mod and go.sum.
  • With v5.5.5 a go mod tidy fails.

I even performed a git reset --hard to previous commit to ensure a fresh state to test getting and replacing the module for v5.5.5, but still failed on go mod tidy.

[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/[email protected]
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/[email protected]
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
go: finding module for package github.com/jackc/pgx/v5/pgxpool
go: finding module for package github.com/jackc/pgx/v5/pgconn
go: finding module for package github.com/jackc/pgx/v5/pgtype
go: finding module for package github.com/jackc/pgx/v5
go: found github.com/jackc/pgx/v5 in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgconn in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgtype in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgxpool in github.com/jackc/pgx/v5 v5.5.5
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)


require (
github.com/aymerick/douceur v0.2.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
Expand Down Expand Up @@ -51,29 +55,30 @@ require (
github.com/google/uuid v1.3.0 // indirect
github.com/gorilla/css v1.0.0 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/jackc/pgx/v5 v5.5.5 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/microcosm-cc/bluemonday v1.0.18 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/openshift-online/ocm-sdk-go v0.1.368 // indirect
github.com/openshift-online/ocm-sdk-go v0.1.411 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/project-codeflare/multi-cluster-app-dispatcher v1.37.0 // indirect
github.com/prometheus/client_golang v1.18.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.46.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stretchr/testify v1.8.4 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
golang.org/x/net v0.20.0 // indirect
golang.org/x/net v0.23.0 // indirect
golang.org/x/oauth2 v0.16.0 // indirect
golang.org/x/sys v0.16.0 // indirect
golang.org/x/term v0.16.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.18.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect
Expand Down
Loading