-
Notifications
You must be signed in to change notification settings - Fork 161
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Widespread dependencies update #226
Conversation
gopkg.in/ini.v1 v1.67.0 // indirect | ||
gopkg.in/yaml.v3 v3.0.1 // indirect | ||
) | ||
|
||
replace golang.org/x/crypto => golang.org/x/crypto v0.32.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is the specific dependency that was originally triggering static code analysis alerts because of https://nvd.nist.gov/vuln/detail/CVE-2024-45337 . I had to add the explicit replace
because the static code analysis tool would alert on any mention of an affected version in go.sum
. It may make sense to remove it for general purposes; I think the analysis tool raising alerts on those is bad behaviour.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove the replace you mean?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah. I don't know if it does any harm, but I just figure you probably don't want a random assortment of these starting to accumulate because of one very specific use case that I already have a fork for.
I needed to update some dependencies to get this project through a client's automated security scans, so decided to do a broad round of updates while I was at it. I figure this might be useful to merge back to the original repository, though it may also be worth testing it more than I have done.
Testing I have done: