Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump several packages and go mod version for cve fixes #402

Merged
merged 2 commits into from
Feb 19, 2025

Conversation

lubronzhan
Copy link
Contributor

@lubronzhan lubronzhan commented Feb 14, 2025

What this PR does / why we need it:
Fix CVEs like below

CVE ID Severity Score Package Name Fix version
CVE-2024-45339 high 7.1 github.com/golang/glog v1.2.4
CVE-2024-45338 high 7.5 golang.org/x/net v0.33.0
CVE-2024-34158 high 7.5 stdlib go1.23.1
CVE-2024-34156 high 7.5 stdlib go1.23.1
CVE-2024-24791 high 7.5 stdlib go1.22.5
CVE-2024-24790 critical 9.8 stdlib go1.22.4
CVE-2024-24789 high 7.5 stdlib go1.22.4

Which issue(s) this PR fixes:

Fixes #

Describe testing done for PR:

Special notes for your reviewer:

Release note:


New PR Checklist

  • Ensure PR contains only public links or terms
  • Use good commit messages
  • Squash the commits in this branch before merge to preserve our git history
  • If this PR is just an idea or POC, use a Draft PR instead of a full PR
  • Add appropriate labels according to what type of issue is being addressed.

@lubronzhan lubronzhan enabled auto-merge (squash) February 18, 2025 23:44
@lubronzhan lubronzhan merged commit f6e365f into vmware-tanzu:main Feb 19, 2025
4 checks passed
@lubronzhan lubronzhan deleted the topic/lubron/cve_fix branch February 19, 2025 18:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants