Skip to content

build(deps): upgrade go crypto module to v0.36.0#1671

Merged
Wwwsylvia merged 3 commits into
oras-project:mainfrom
kysucix:user/kysucix/upgrade-crypto
Mar 27, 2025
Merged

build(deps): upgrade go crypto module to v0.36.0#1671
Wwwsylvia merged 3 commits into
oras-project:mainfrom
kysucix:user/kysucix/upgrade-crypto

Conversation

@kysucix

@kysucix kysucix commented Mar 26, 2025

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:
Upgrade go crypto module to fix CVE-2025-22869

@Wwwsylvia

Copy link
Copy Markdown
Member

@kysucix Thanks for the PR. Could you follow the instruction to fix the DCO?

Comment thread go.mod Outdated
@codecov

codecov Bot commented Mar 26, 2025

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.56%. Comparing base (eccaaa9) to head (a4081cb).
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1671   +/-   ##
=======================================
  Coverage   84.56%   84.56%           
=======================================
  Files         126      126           
  Lines        5682     5682           
=======================================
  Hits         4805     4805           
  Misses        623      623           
  Partials      254      254           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

kysucix added 2 commits March 26, 2025 14:56
Signed-off-by: Silvano Galliani <sigallia@microsoft.com>
Signed-off-by: Silvano Galliani <sigallia@microsoft.com>
@kysucix kysucix force-pushed the user/kysucix/upgrade-crypto branch from a7b3236 to 5d9765a Compare March 26, 2025 13:57
Signed-off-by: Silvano Galliani <sigallia@microsoft.com>
@kysucix

kysucix commented Mar 26, 2025

Copy link
Copy Markdown
Contributor Author

@kysucix Thanks for the PR. Could you follow the instruction to fix the DCO?

I followed the instruction and fixed the pr.

@TerryHowe

Copy link
Copy Markdown
Member

I guess no assessment on this CVE yet, so no dependabot?

@Wwwsylvia

Copy link
Copy Markdown
Member

I guess no assessment on this CVE yet, so no dependabot?

Maybe because this is an indirect dependency? I can see versions prior to v0.35.0 are associated with some vulnerabilities.
image

@Wwwsylvia Wwwsylvia left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Wwwsylvia Wwwsylvia changed the title Upgrade go crypto module to fix CVE-2025-22869 build(deps): upgrade go crypto module to v0.36.0 Mar 27, 2025
@Wwwsylvia Wwwsylvia merged commit 26551f7 into oras-project:main Mar 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants