[release/1.7] Update x/net to 0.13 #9134
Conversation
|
Hi @Kern--. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
This silences govulncheck detecting https://pkg.go.dev/vuln/GO-2023-1988. containerd only uses x/net for context and httpcontext which do not render html. Signed-off-by: Kern Walster <walster@amazon.com>
| golang.org/x/crypto v0.11.0 // indirect | ||
| golang.org/x/mod v0.9.0 // indirect | ||
| golang.org/x/net v0.8.0 // indirect | ||
| golang.org/x/net v0.13.0 // indirect |
There was a problem hiding this comment.
this moves the 1.7 branch ahead of main; do we need 0.13 or is 0.12 enough for the cve? (potentially backporting from main)
Otherwise if we really need v0.13 we should make sure main is updated first
Line 127 in e1655fe
There was a problem hiding this comment.
➕ If we want 0.13.0, let's update main first.
There was a problem hiding this comment.
Sure. I created #9184. 0.13.0 is the version that fixes this issue.
This silences govulncheck detecting
https://pkg.go.dev/vuln/GO-2023-1988.
containerd only uses x/net for context and httpcontext which do not render html.
Before this change:
After this change:
Equivalent release/1.6 change #9130