Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update github.com/hashicorp/go-retryablehttp for CVE-2024-6104 #5945

Merged
merged 1 commit into from
Jul 8, 2024

Conversation

joelsmith
Copy link
Contributor

This library is only used (indirectly) by the New Relic scaler. It's unclear if KEDA is even affected by the issue (unsanitized logging) but it's good code hygiene to fix it either way.

$ go get -u github.com/hashicorp/go-retryablehttp
go: downloading github.com/hashicorp/go-retryablehttp v0.7.7
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: upgraded github.com/hashicorp/go-hclog v1.6.2 => v1.6.3
go: upgraded github.com/hashicorp/go-retryablehttp v0.7.5 => v0.7.7
$ go mod tidy
go: downloading github.com/jstemmer/go-junit-report/v2 v2.1.0
$ go mod vendor

Checklist

Fixes #5944

Signed-off-by: Joel Smith <joelsmith@redhat.com>
@joelsmith joelsmith requested a review from a team as a code owner July 3, 2024 16:57
@zroubalik
Copy link
Member

zroubalik commented Jul 4, 2024

/run-e2e relic
Update: You can check the progress here

@tomkerkhove tomkerkhove merged commit 52bce3c into kedacore:main Jul 8, 2024
20 of 21 checks passed
uucloud pushed a commit to uucloud/keda that referenced this pull request Jul 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

github.com/hashicorp/go-retryablehttp update needed for CVE-2024-6104
3 participants