Skip to content

Conversation

kysucix
Copy link
Contributor

@kysucix kysucix commented Mar 26, 2025

What this PR does / why we need it:
Upgrade go crypto module to fix CVE-2025-22869

@Wwwsylvia
Copy link
Member

@kysucix Thanks for the PR. Could you follow the instruction to fix the DCO?

Copy link

codecov bot commented Mar 26, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.56%. Comparing base (eccaaa9) to head (a4081cb).
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1671   +/-   ##
=======================================
  Coverage   84.56%   84.56%           
=======================================
  Files         126      126           
  Lines        5682     5682           
=======================================
  Hits         4805     4805           
  Misses        623      623           
  Partials      254      254           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

kysucix added 2 commits March 26, 2025 14:56
Signed-off-by: Silvano Galliani <sigallia@microsoft.com>
Signed-off-by: Silvano Galliani <sigallia@microsoft.com>
@kysucix kysucix force-pushed the user/kysucix/upgrade-crypto branch from a7b3236 to 5d9765a Compare March 26, 2025 13:57
Signed-off-by: Silvano Galliani <sigallia@microsoft.com>
@kysucix
Copy link
Contributor Author

kysucix commented Mar 26, 2025

@kysucix Thanks for the PR. Could you follow the instruction to fix the DCO?

I followed the instruction and fixed the pr.

@TerryHowe
Copy link
Member

I guess no assessment on this CVE yet, so no dependabot?

@Wwwsylvia
Copy link
Member

I guess no assessment on this CVE yet, so no dependabot?

Maybe because this is an indirect dependency? I can see versions prior to v0.35.0 are associated with some vulnerabilities.
image

Copy link
Member

@Wwwsylvia Wwwsylvia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Wwwsylvia Wwwsylvia changed the title Upgrade go crypto module to fix CVE-2025-22869 build(deps): upgrade go crypto module to v0.36.0 Mar 27, 2025
@Wwwsylvia Wwwsylvia merged commit 26551f7 into oras-project:main Mar 27, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants