Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): upgrade deps to address reported vulnerabilities #5708

Merged
merged 11 commits into from
Feb 4, 2025
Merged

chore(deps): upgrade deps to address reported vulnerabilities #5708

merged 11 commits into from
Feb 4, 2025

Conversation

thisislawatts
Copy link
Member

@thisislawatts thisislawatts commented Feb 3, 2025 •
edited
Loading

Pull Request Submission Checklist

  • Follows CONTRIBUTING guidelines
  • Includes detailed description of changes
  • Contains risk assessment (medium)
  • Highlights breaking API changes (if applicable)
  • Links to automated tests covering new functionality
  • Includes manual testing instructions (if necessary)
  • Updates relevant GitBook documentation (PR link: ___)

What does this PR do?

  • Reintroduces the IaC dependency upgrades
  • Switches the CLI the stripe/goproxy fork

Reference: CLI-658

thisislawatts and others added 11 commits January 23, 2025 12:05
@thisislawatts
Merge pull request #5680 from snyk/release-candidate
36ee374 
fix: upgrade dependencies to address vulnerabilities
@thisislawatts
Revert "chore(deps): upgrade go proxy 1.5"
bcfd635 
This reverts commit fa3c622.
@thisislawatts
Revert "fix: upgrade cli-extension-iac-rules to address vulns [IAC-31…
ac4a721 
…95]"

This reverts commit faff294.
@thisislawatts
Revert "fix: fix CVE-2025-21614 and CVE-2025-21614 (iac)"
6d91ae1 
This reverts commit dddf8b3.
@thisislawatts
chore: ignore SNYK-GOLANG-GITHUBCOMELAZARLGOPROXY-5783247 vulnerability
67f71fe 
This is not exploitable in our current application.
@thisislawatts
Merge pull request #5688 from snyk/fix/revert-dependency-upgrades
d2068d5 
fix: revert dependency upgrades
@thisislawatts
fix: empty commit to bump publication machinery
843d643
@thisislawatts
Merge pull request #5690 from snyk/chore/hotfix-cli
f6668a3 
fix: empty commit to bump publication machinery
@andreeaneata @thisislawatts
fix: upgrade cli-extension-iac-rules to address vulns [IAC-3195]
9671ebf
@thisislawatts
chore(deps): switch to stripe/goproxy
a82f04e
@alina-d-m @thisislawatts
fix: fix CVE-2025-21614 and CVE-2025-21614 (iac)
616ee71
@thisislawatts thisislawatts changed the base branch from main to release-candidate February 3, 2025 19:15
@thisislawatts thisislawatts changed the title chore(deps): upgrade deps to upgrade reported vulnerabilities chore(deps): upgrade deps to address reported vulnerabilities Feb 3, 2025
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Feb 3, 2025 •
edited
Loading

Warnings
⚠️ There are multiple commits on your branch, please squash them locally before merging!
⚠️

"Revert "fix: upgrade cli-extension-iac-rules to address vulns [IAC-3195]"" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 616ee71

@thisislawatts thisislawatts marked this pull request as ready for review February 4, 2025 09:15
@thisislawatts thisislawatts requested a review from a team as a code owner February 4, 2025 09:15
@thisislawatts thisislawatts merged commit f7a5e89 into release-candidate Feb 4, 2025
12 checks passed
@thisislawatts thisislawatts deleted the hotfix/1.1295.3 branch February 4, 2025 11:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sandor-trombitas sandor-trombitas sandor-trombitas approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@thisislawatts @sandor-trombitas @andreeaneata @alina-d-m