Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address Snyk issues #68

Merged
merged 1 commit into from
May 26, 2023
Merged

Address Snyk issues #68

merged 1 commit into from
May 26, 2023

Conversation

juniortaeza
Copy link
Contributor

Desired Outcome

This pull request addresses the Snyk issues outlined in this repository.

Implemented Changes

  • upgrades Go to 1.20
  • upgrades golang.org/x/net to v0.10.0
  • upgrades golang.org/x/text to v0.9.0
  • upgrades golang.org/x/sys to v0.8.0

Changelog

  • The CHANGELOG has been updated, or
  • This PR does not include user-facing changes and doesn't require a
    CHANGELOG update

Test coverage

  • This PR includes new unit and integration tests to go with the code
    changes, or
  • The changes in this PR do not require tests

Documentation

  • Docs (e.g. READMEs) were updated in this PR
  • A follow-up issue to update official docs has been filed here: [insert issue ID]
  • This PR does not require updating any documentation

Behavior

  • This PR changes product behavior and has been reviewed by a PO, or
  • These changes are part of a larger initiative that will be reviewed later, or
  • No behavior was changed with this PR

Security

  • Security architect has reviewed the changes in this PR,
  • These changes are part of a larger initiative with a separate security review, or
  • There are no security aspects to these changes

@juniortaeza juniortaeza requested a review from a team as a code owner May 19, 2023 18:59
john-odonnell
john-odonnell reviewed May 24, 2023
View reviewed changes
go.mod Outdated Show resolved Hide resolved
john-odonnell
john-odonnell reviewed May 24, 2023
View reviewed changes
go.mod
Comment on lines +43 to +49
replace golang.org/x/text v0.3.0 => golang.org/x/text v0.9.0

replace golang.org/x/text v0.3.3 => golang.org/x/text v0.9.0

replace golang.org/x/text v0.7.0 => golang.org/x/text v0.9.0

replace golang.org/x/text v0.3.7 => golang.org/x/text v0.9.0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently only v0.3.7 of golang.org/x/text is listed in go.sum. Why do we need all these replacements?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same goes for x/sys and x/net, I guess.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like after adding these replace statements the go.sum was condensed – the old list showed these versions. Should I remove these replace statements after updating go.sum?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure you weren't looking at an amended list? If you look at the go.sum file on the main branch, only v0.3.7 of golang.org/x/text is listed. I wonder if we could get away with only one of these replace statements.

Copy link
Contributor Author

@juniortaeza juniortaeza May 25, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After replacing the ones shown on the main branch, the following pops up in go.sum:

image

This is where all my other replace statements came from -- not quite sure why the above gets generated

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call - makes sense.

john-odonnell
john-odonnell approved these changes May 26, 2023
View reviewed changes
Copy link
Contributor

@john-odonnell john-odonnell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@juniortaeza juniortaeza merged commit c619782 into main May 26, 2023
@juniortaeza juniortaeza deleted the snyk-issues-branch branch May 26, 2023 16:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@john-odonnell john-odonnell john-odonnell approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@juniortaeza @john-odonnell