Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0. #2586

Closed
wants to merge 1 commit into from
Closed

build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0. #2586

wants to merge 1 commit into from

Conversation

liangyuanpeng
Copy link
Contributor

@liangyuanpeng liangyuanpeng commented Jan 7, 2025 •
edited
Loading

What this PR does / why we need it:

bump golang.org/x/net from 0.32.0 to 0.33.0 for address CVE-2024-45337 CVE-2024-45338

golang.org/x/crypto had bump to 0.31.0

/cc @mrueg @dashpole

How does this change affect the cardinality of KSM: (increases, decreases or does not change cardinality)

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #2585

@k8s-ci-robot k8s-ci-robot requested review from dashpole and mrueg January 7, 2025 08:07
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jan 7, 2025
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If kube-state-metrics contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: liangyuanpeng
Once this PR has been reviewed and has the lgtm label, please assign mrueg for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jan 7, 2025
@liangyuanpeng liangyuanpeng changed the title bump golang.org/x/net from 0.32.0 to 0.33.0. build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0. Jan 7, 2025
@mrueg
Copy link
Member

mrueg commented Jan 8, 2025

How is x/net affected by it? the GHSA only lists x/crypto

@liangyuanpeng
Copy link
Contributor Author

liangyuanpeng commented Jan 13, 2025 •
edited
Loading

@mrueg
I put the wrong CVE here and i have update it, PTAL,Thanks.

@mrueg
Copy link
Member

mrueg commented Jan 13, 2025

@mrueg I put the wrong CVE here and i have update it, PTAL,Thanks.

Thanks for the clarification. It doesn't look like ksm is affected though. See: https://github.com/kubernetes/kube-state-metrics/actions/runs/12738421282
I would treat this as a false positive then.

@liangyuanpeng
Copy link
Contributor Author

liangyuanpeng commented Jan 14, 2025 •
edited
Loading

Closing due to ksm are not affected.

@liangyuanpeng liangyuanpeng deleted the fix_cves branch January 14, 2025 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dashpole dashpole Awaiting requested review from dashpole

@mrueg mrueg Awaiting requested review from mrueg

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Bug] Critical and High vulnerability - CVE-2024-45337, CVE-2024-45338
3 participants
@liangyuanpeng @k8s-ci-robot @mrueg