-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update gRPC dependency to fix CVE-2023-32731 vulnerability #44
Conversation
Signed-off-by: Michael Valdron <mvaldron@redhat.com>
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: michael-valdron The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
google.golang.org/grpc v1.49.0 // indirect | ||
google.golang.org/protobuf v1.28.1 // indirect | ||
google.golang.org/genproto/googleapis/rpc v0.0.0-20230717213848-3f92550aa753 // indirect | ||
google.golang.org/grpc v1.56.2 // indirect |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we should be updating these indirect dependencies since there may be unforeseen side effects. We should be updating the main dependencies that pick up the latest grpc module. If you run a go mod graph | grep google.golang.org/grpc
on the module, you'll see that it's the registry index generator and registry library that are pulling in grpc. If you run the same command on the registry generator and registry library modules, you can determine that the main dependency k8s.io/apiextensions-apiserver v0.26.1
is the problem. We need to update this module but it doesn't seem like a patch update is available yet: https://github.com/kubernetes/apiextensions-apiserver/blob/release-1.27/go.mod#L23
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch, I'll put a hold on all of these PRs until a patch on the direct dependency is available. Also, will change the status of the issue to blocked.
Codecov ReportPatch and project coverage have no change.
Additional details and impacted files@@ Coverage Diff @@
## main #44 +/- ##
=======================================
Coverage 22.11% 22.11%
=======================================
Files 23 23
Lines 1307 1307
=======================================
Hits 289 289
Misses 1001 1001
Partials 17 17 ☔ View full report in Codecov by Sentry. |
/hold |
/unhold |
These changes are no longer needed. |
Please specify the area for this PR
What does does this PR do / why we need it:
Fixes the high risk vulnerability CVE-2023-32731 by updating the
google.golang.org/grpc
.Which issue(s) this PR fixes:
Fixes #?
part of devfile/api#1180
PR acceptance criteria:
Documentation
How to test changes / Special notes to the reviewer: