Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address CVE-2022-41721 #2545

Merged
merged 2 commits into from
Jan 30, 2023
Merged

Address CVE-2022-41721 #2545

merged 2 commits into from
Jan 30, 2023

Conversation

VeronikaSolovei9
Copy link
Contributor

updated version of golang.org/x/net to v0.4.0

mansinahar
mansinahar reviewed Jan 26, 2023
View reviewed changes
go.mod Outdated
golang.org/x/net v0.0.0-20220909164309-bea034e7d591
golang.org/x/text v0.3.7
golang.org/x/net v0.4.0
golang.org/x/text v0.5.0
Copy link
Contributor

@mansinahar mansinahar Jan 26, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much @VeronikaSolovei9 for putting out this fix PR! This definitely works but just curious, any reason for pinning the text package version to v0.5.0? I see that the latest version for this package is 0.6.0. Should we/can we move to the latest?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, please move to the latest version available.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same for the /net package, the latest version is v0.5.0. Can we please pin it to that?

@bsardo bsardo self-requested a review January 26, 2023 17:01
bsardo
bsardo reviewed Jan 26, 2023
View reviewed changes
Copy link
Collaborator

@bsardo bsardo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM though I'm also curious about https://github.com/prebid/prebid-server/pull/2545/files#r1088081338.

@SyntaxNode SyntaxNode changed the title Possible Trivy fix Address CVE-2022-41721 Jan 26, 2023
@VeronikaSolovei9
Copy link
Contributor Author

VeronikaSolovei9 commented Jan 30, 2023 •
edited
Loading

I put v0.4.0 because Trivy suggested to put this as a fixed version. I agree latest would be better. I checked it works with v0.5.0

Here I see latest version is 0.5.0, do I miss something?

bsardo
bsardo approved these changes Jan 30, 2023
View reviewed changes
Copy link
Collaborator

@bsardo bsardo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. The latest version of net is v0.5.0 and the latest version of text is v0.6.0.

@SyntaxNode SyntaxNode merged commit e63f9a1 into master Jan 30, 2023
@cross-repo-issue-creation cross-repo-issue-creation bot mentioned this pull request Jan 30, 2023
Closed
shunj-nb pushed a commit to ParticleMedia/prebid-server that referenced this pull request Jan 31, 2023
@VeronikaSolovei9 @shunj-nb
Address CVE-2022-41721 (prebid#2545)
455aef9
@SyntaxNode SyntaxNode deleted the possible_trivy_fix branch March 13, 2023 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SyntaxNode SyntaxNode SyntaxNode left review comments

@bsardo bsardo bsardo approved these changes

@mansinahar mansinahar mansinahar approved these changes

Assignees

@bsardo bsardo

@mansinahar mansinahar

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@VeronikaSolovei9 @bsardo @SyntaxNode @mansinahar