fix: update dependencies to resolve known CVEs#1472
Open
henriklt wants to merge 3 commits intoapache:masterfrom
Open
fix: update dependencies to resolve known CVEs#1472henriklt wants to merge 3 commits intoapache:masterfrom
henriklt wants to merge 3 commits intoapache:masterfrom
Conversation
- go-viper/mapstructure/v2: v2.4.0 → v2.5.0 - go.opentelemetry.io/otel/sdk: v1.21.0 → v1.41.0 - dvsekhvalnov/jose2go: v1.7.0 → v1.8.0 - golang.org/x/crypto: v0.45.0 → v0.48.0 Signed-off-by: Henrik Thorsgaard <hlt@scopito.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Go module dependencies to patched versions to address known CVEs, and adjusts a producer test to avoid concurrent access to a mocked connection’s buffer slice.
Changes:
- Bumped multiple direct/indirect dependencies (notably OpenTelemetry, x/crypto, mapstructure, testify, x/mod).
- Updated
TestSendBufferRetainWhenConnectionStuckto read mock connection buffers via a lock-protected snapshot helper. - Cleaned up module metadata (
go.mod/go.sum) by removing no-longer-needed dependencies.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pulsar/producer_test.go | Adds a lock-protected buffer snapshot accessor to avoid data races in tests. |
| go.mod | Updates and removes dependencies to pick up CVE fixes and tidy the module graph. |
| go.sum | Refreshes checksums to match the updated/tidied dependency set. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Rename the method to communicate that it returns a point-in-time copy of the buffer slice, not a live reference.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Update transitive dependencies with known CVEs to their patched versions.
Modifications
Verifying this change
This change is already covered by existing tests, such as the full unit and integration test suites.
Does this pull request potentially affect one of the following parts:
Documentation