Skip to content

CVE fixes of High priority #525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 19, 2024
Merged

CVE fixes of High priority #525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bfbdc16
CVE fixes of High priority
ChristianZaccaria Apr 16, 2024
7f7a9a2
Replace pgx/v4 for pgx/v5
ChristianZaccaria Apr 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ require (

replace sigs.k8s.io/custom-metrics-apiserver => sigs.k8s.io/custom-metrics-apiserver v1.25.1-0.20230306170449-63d8c93851f3

replace go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0

replace github.com/jackc/pgx/v4 => github.com/jackc/pgx/v5 v5.5.4
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this be change to v5.5.5?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is a strange one, I tried doing that but go doesn't like it. I.e.,

  • With v5.5.4, a go mod tidy successfully replaces the v4 module in go.mod and go.sum.
  • With v5.5.5 a go mod tidy fails.

I even performed a git reset --hard to previous commit to ensure a fresh state to test getting and replacing the module for v5.5.5, but still failed on go mod tidy.

[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/[email protected]
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/[email protected]
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
go: finding module for package github.com/jackc/pgx/v5/pgxpool
go: finding module for package github.com/jackc/pgx/v5/pgconn
go: finding module for package github.com/jackc/pgx/v5/pgtype
go: finding module for package github.com/jackc/pgx/v5
go: found github.com/jackc/pgx/v5 in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgconn in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgtype in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgxpool in github.com/jackc/pgx/v5 v5.5.5
go: github.com/jackc/pgx/[email protected] used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)


require (
github.com/aymerick/douceur v0.2.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
Expand Down Expand Up @@ -51,29 +55,30 @@ require (
github.com/google/uuid v1.3.0 // indirect
github.com/gorilla/css v1.0.0 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/jackc/pgx/v5 v5.5.5 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/microcosm-cc/bluemonday v1.0.18 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/openshift-online/ocm-sdk-go v0.1.368 // indirect
github.com/openshift-online/ocm-sdk-go v0.1.411 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/project-codeflare/multi-cluster-app-dispatcher v1.37.0 // indirect
github.com/prometheus/client_golang v1.18.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.46.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stretchr/testify v1.8.4 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
golang.org/x/net v0.20.0 // indirect
golang.org/x/net v0.23.0 // indirect
golang.org/x/oauth2 v0.16.0 // indirect
golang.org/x/sys v0.16.0 // indirect
golang.org/x/term v0.16.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.18.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect
Expand Down
Loading