[3.5] CVE-2023-47108: Backport go.opentelemetry.io/[email protected] and go.open… #16946
Conversation
…telemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected] Signed-off-by: sharath sivakumar <[email protected]>
|
Hi @sharathsivakumar. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
sharathsivakumar
changed the title
| @@ -188,6 +206,15 @@ | |||
| } | |||
| ] | |||
| }, | |||
| { | |||
| "project": "github.com/grpc-ecosystem/grpc-gateway/v2", | |||
There was a problem hiding this comment.
We don't bump grpc-gateway in 3.5. It's a big change.
There was a problem hiding this comment.
It should be fine to just introduce an indirect dependency on grpc-gateway/v2. It means we are still using grpc-gateway v1 in 3.5
|
Please refer to 40c7f72 to resolve the workflow failure in |
|
@ahrtr thanks for the inputs. I will work on the fixes and push the changes. |
ahrtr
changed the title
…apis/api,google.golang.org/grpc to make it consistent Signed-off-by: sharath sivakumar <[email protected]>
|
We still need changelog's change in main branch after merging this one :) |
Yes, @sharathsivakumar Please feel free to raise a separate PR to change the changelog. thx |
This PR addresses the #16926 by bumping dependencies: