dancefinder/dancefetcher
5
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Activity

Chore(deps): [security] bump golang.org/x/net from 0.0.0-20200602114024-627f9648deb9 to 0.7.0 #36

Merged
argoyle merged 1 commits from dependabot-go_modules-golang.org-x-net-0.7.0 into master 2023-05-23 17:45:39 +00:00
Conversation 5 Commits 1 Files Changed 2
+6 -5
argoyle commented 2023-05-23 17:35:04 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

Bumps golang.org/x/net from 0.0.0-20200602114024-627f9648deb9 to 0.7.0. This update includes security fixes.

Vulnerabilities fixed

Uncontrolled Resource Consumption A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Patched versions: 0.7.0 Affected versions: < 0.7.0

golang.org/x/net/http2 Denial of Service vulnerability In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Patched versions: 0.0.0-20220906165146-f3363e06e74c Affected versions: < 0.0.0-20220906165146-f3363e06e74c

golang.org/x/net/html Infinite Loop vulnerability Go through 1.15.12 and 1.16.x through 1.16.4 has a golang.org/x/net/html infinite loop via crafted ParseFragment input.

Patched versions: 0.0.0-20210520170846-37e1c6afe023 Affected versions: < 0.0.0-20210520170846-37e1c6afe023

golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Patched versions: 0.0.0-20210428140749-89ef3d95e781 Affected versions: < 0.0.0-20210428140749-89ef3d95e781

Commits

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR. Deprecated, use GitLab's native /rebase instead
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20200602114024-627f9648deb9 to 0.7.0. **This update includes security fixes.** <details> <summary>Vulnerabilities fixed</summary> <blockquote> <p><strong>Uncontrolled Resource Consumption</strong> A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.</p> <p>Patched versions: 0.7.0 Affected versions: &lt; 0.7.0</p> </blockquote> <blockquote> <p><strong>golang.org/x/net/http2 Denial of Service vulnerability</strong> In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.</p> <p>Patched versions: 0.0.0-20220906165146-f3363e06e74c Affected versions: &lt; 0.0.0-20220906165146-f3363e06e74c</p> </blockquote> <blockquote> <p><strong>golang.org/x/net/html Infinite Loop vulnerability</strong> Go through 1.15.12 and 1.16.x through 1.16.4 has a golang.org/x/net/html infinite loop via crafted ParseFragment input.</p> <p>Patched versions: 0.0.0-20210520170846-37e1c6afe023 Affected versions: &lt; 0.0.0-20210520170846-37e1c6afe023</p> </blockquote> <blockquote> <p><strong>golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion</strong> net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.</p> <p>Patched versions: 0.0.0-20210428140749-89ef3d95e781 Affected versions: &lt; 0.0.0-20210428140749-89ef3d95e781</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/golang/net/commits/v0.7.0">compare view</a></li> </ul> </details> <br /> --- <details> <summary>Dependabot commands</summary> <br /> You can trigger Dependabot actions by commenting on this MR - `$dependabot rebase` will rebase this MR. Deprecated, use GitLab's native /rebase instead - `$dependabot recreate` will recreate this MR rewriting all the manual changes and resolving conflicts </details>
argoyle commented 2023-05-23 17:40:34 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

$dependabot recreate

$dependabot recreate
argoyle commented 2023-05-23 17:40:35 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

⚠️ dependabot-gitlab is recreating merge request. All changes will be overwritten! ⚠️

:warning: `dependabot-gitlab` is recreating merge request. All changes will be overwritten! :warning:
argoyle commented 2023-05-23 17:42:09 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

✅ dependabot-gitlab successfully recreated merge request!

:white_check_mark: `dependabot-gitlab` successfully recreated merge request!
argoyle commented 2023-05-23 17:42:10 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

resolved all threads

resolved all threads
argoyle commented 2023-05-23 17:42:10 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

added 2 commits

  • b41d2ddc - 1 commit from branch master
  • 0b143317 - Chore(deps): [security] bump golang.org/x/net

Compare with previous version

added 2 commits <ul><li>b41d2ddc - 1 commit from branch <code>master</code></li><li>0b143317 - Chore(deps): [security] bump golang.org/x/net</li></ul> [Compare with previous version](/unboundsoftware/dancefinder/dancefetcher/-/merge_requests/33/diffs?diff_id=688863070&start_sha=379155a53e40b5b44dbe035130f21bdc12ad4717)
argoyle (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2023-05-23 17:43:13 +00:00
argoyle (Migrated from gitlab.com) merged commit into master 2023-05-23 17:45:39 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
security
Pull requests that address a security vulnerability
 severity:moderate
No Label dependencies go security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dancefinder/dancefetcher#36
Delete Branch "dependabot-go_modules-golang.org-x-net-0.7.0"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?