mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-19 14:34:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bump google.golang.org/protobuf to v1.33.0 for CVE-2024-24786

Browse Source
This commit is contained in:
Joshua Casey
2024-03-08 11:19:15 -06:00
parent ab0682917a
commit 8a40dda3ab
2 changed files with 7 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+5 -3
View File
@@ -7,7 +7,7 @@ toolchain go1.22.0
// This version taken from https://github.com/kubernetes/apiserver/blob/v0.29.2/go.mod#L14 to avoid compile failures.
replace github.com/google/cel-go => github.com/google/cel-go v0.17.7
// Fostite depends on ory/x which depends on opentelemetry. kubernetes/apiserver also depends on opentelemetry.
// ory/fosite depends on ory/x which depends on opentelemetry. kubernetes/apiserver also depends on opentelemetry.
// Where they clash and cause "go mod tidy" to fail, use replace directives to make it work.
// Copied from https://github.com/kubernetes/apiserver/blob/v0.29.2/go.mod#L28-L33.
replace (
@@ -23,10 +23,12 @@ replace (
// to resolve the clashes with ory/x, so use the same version that kubernetes/apiserver chooses for opentelemetry.
replace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0
// This is an indirect dep which is currently at v0.42.0 (see below), but scanners report that version
// has CVE-2023-45142, so replace it with the fixed version.
// This is an indirect dep which has CVE-2023-45142, so replace it with the fixed version.
replace go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace => go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.44.0
// This is an indirect dep which has CVE-2024-24786, so replace it with a fixed version
replace google.golang.org/protobuf => google.golang.org/protobuf v1.33.0
require (
github.com/MakeNowJust/heredoc/v2 v2.0.1
github.com/chromedp/cdproto v0.0.0-20240304214822-eeb3d13057c9