Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update gosu package as its having vulnerabilities #97

Merged
merged 2 commits into from
Dec 11, 2023

Conversation

amir272
Copy link
Contributor

@amir272 amir272 commented Nov 28, 2023

We have gosu version as 1.14 currently. This is in turn uses go version 1.16.7 . Using this version has resulted in a few vulnerabilities. We are upgrading gosu package to 1.16 to fix these vulnerabilities

Discussion for the issue: https://wiremock-community.slack.com/archives/C03NAEH5LVA/p1700000714509919
Latest gosu version 1.17: https://github.com/tianon/gosu/releases/tag/1.16

image

Submitter checklist

  • Recommended: Join WireMock Slack to get any help in #help-contributing or a project-specific channel like #wiremock-java
  • Recommended: If you participate in Hacktoberfest 2023, make sure you're signed up there and in the WireMock form
  • The PR request is well described and justified, including the body and the references
  • The PR title represents the desired changelog entry
  • The repository's code style is followed (see the contributing guide)
  • Test coverage that demonstrates that the change works as expected
  • For new features, there's necessary documentation in this pull request or in a subsequent PR to wiremock.org

Copy link
Member

@oleg-nenashev oleg-nenashev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please note that none of these vulnerabilities are really related to gosu
NPE: All CVEs point to Golang/Go . I do not mind updating, but I do not see a reproducible issue as of now

@oleg-nenashev oleg-nenashev added the dependencies Dependency updates label Nov 28, 2023
Change version from 1.17 to 1.16 as tests are failing.
@amir272 amir272 requested a review from oleg-nenashev December 6, 2023 09:30
Copy link
Member

@oleg-nenashev oleg-nenashev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested it locally, works on the recent Linux/Docker engine

@amir272
Copy link
Contributor Author

amir272 commented Dec 11, 2023

I tested it locally, works on the recent Linux/Docker engine

Thanks.I wonder why docker-build is failing. Could you please have a look

@oleg-nenashev
Copy link
Member

It is not related to the PR AFAICT, looks like a regression in the CI pipeline. I will merge it and resolve the CI issues in the main branch

@oleg-nenashev oleg-nenashev merged commit 9b1b9ac into wiremock:main Dec 11, 2023
0 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Dependency updates
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants