Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cobra upgrade: transitive dependency vulnerability #13390

Closed
odacremolbap opened this issue Oct 6, 2021 · 1 comment · Fixed by #13571
Closed

Cobra upgrade: transitive dependency vulnerability #13390

odacremolbap opened this issue Oct 6, 2021 · 1 comment · Fixed by #13571
Labels
stale

Comments

@odacremolbap
Copy link

Current dependency on cobra imports a transitive dependency that has been flagged at GHSA-w73w-5m7g-f7qc

etcd/go.mod

Line 21 in b571ec5

github.com/spf13/cobra v1.1.3

etcd/go.sum

Line 70 in b571ec5

github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=

Cobra fixed the issue halfway this year, I would say it makes sense to update to https://github.com/spf13/cobra/releases/tag/v1.2.1 and see the transitive dependecy go away.
@odacremolbap odacremolbap mentioned this issue Oct 6, 2021
Merged
@antoineco antoineco mentioned this issue Oct 6, 2021
Closed
@yank1 yank1 mentioned this issue Dec 29, 2021
Merged
@stale
Copy link

stale bot commented Jan 5, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 21 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Jan 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
stale
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update Cobra version to 1.2.1 yank1/etcd
Update github.com/spf13/cobra to v1.2.1
1 participant
@odacremolbap