Skip to content

Upgrade vulnerable dependencies - #12638

Closed
dveeden wants to merge 1 commit into
pingcap:masterfrom
dveeden:vuln_fix
Closed

dveeden wants to merge 1 commit into
pingcap:masterfrom
dveeden:vuln_fix

Conversation

@dveeden

@dveeden dveeden commented May 15, 2026

Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: close #12637

What is changed and how it works?

Check List

Tests

  • No code

Questions

Will it cause performance regression or break compatibility?
Do you need to update user documentation, design documentation or monitoring documentation?

Release note

Dependencies were updated to avoid to address security vulnerabilities

@ti-chi-bot ti-chi-bot Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/needs-triage-completed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 15, 2026
@dveeden

dveeden commented May 15, 2026

Copy link
Copy Markdown
Contributor Author

/cc @OliverS929

@ti-chi-bot
ti-chi-bot Bot requested a review from OliverS929 May 15, 2026 08:20

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates several Go dependencies in go.mod and go.sum, including grpc-gateway, x/net, x/sys, x/text, and grpc. A critical issue was identified where the upgrade of golang.org/x/text to v0.37.0 is rendered ineffective by a replace directive that forces the version to v0.28.0, which may prevent the application of intended security fixes.

Comment thread go.mod
@dveeden

dveeden commented May 15, 2026

Copy link
Copy Markdown
Contributor Author

/retest

1 similar comment
@dveeden

dveeden commented May 15, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@ti-chi-bot

ti-chi-bot Bot commented May 15, 2026

Copy link
Copy Markdown
Contributor

@dveeden: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-dm-integration-test-next-gen f775d1b link false /test pull-dm-integration-test-next-gen

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ti-chi-bot

ti-chi-bot Bot commented May 16, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: asddongmen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ti-chi-bot ti-chi-bot Bot added the needs-1-more-lgtm Indicates a PR needs 1 more LGTM. label May 16, 2026
@ti-chi-bot

ti-chi-bot Bot commented May 16, 2026

Copy link
Copy Markdown
Contributor

[LGTM Timeline notifier]

Timeline:

  • 2026-05-16 01:49:42.895208001 +0000 UTC m=+59855.380611662: ☑️ agreed by asddongmen.

@ti-chi-bot ti-chi-bot Bot added the approved label May 16, 2026
@dveeden dveeden closed this May 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved needs-1-more-lgtm Indicates a PR needs 1 more LGTM. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vulnerable dependencies

2 participants