Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Widespread dependencies update #226

Merged
merged 52 commits into from
Jan 31, 2025
Merged

Widespread dependencies update #226

merged 52 commits into from
Jan 31, 2025

Conversation

eldang
Copy link
Contributor

@eldang eldang commented Jan 29, 2025

I needed to update some dependencies to get this project through a client's automated security scans, so decided to do a broad round of updates while I was at it. I figure this might be useful to merge back to the original repository, though it may also be worth testing it more than I have done.

Testing I have done:

  • Building and running locally on my mac
  • Building the Alpine Docker image and running that on my mac
  • Having the client's CI build a slightly customised version of the Alpine Docker image in their infrastructure (Azure DevOps), which is now backing https://eldang.github.io/evs2scale/

eldang and others added 30 commits November 14, 2023 16:31
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)

replace golang.org/x/crypto => golang.org/x/crypto v0.32.0
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the specific dependency that was originally triggering static code analysis alerts because of https://nvd.nist.gov/vuln/detail/CVE-2024-45337 . I had to add the explicit replace because the static code analysis tool would alert on any mention of an affected version in go.sum. It may make sense to remove it for general purposes; I think the analysis tool raising alerts on those is bad behaviour.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the replace you mean?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I don't know if it does any harm, but I just figure you probably don't want a random assortment of these starting to accumulate because of one very specific use case that I already have a fork for.

@pramsey pramsey merged commit 2730910 into CrunchyData:master Jan 31, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants