Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat/webcypto and protobuf #3633

Merged
merged 2 commits into from Mar 12, 2024
Merged

Feat/webcypto and protobuf #3633

merged 2 commits into from Mar 12, 2024

Conversation

olegbespalov
Copy link
Collaborator

@olegbespalov olegbespalov commented Mar 11, 2024

What?

Updates web crypto and protobuf libraries to resolve security concerns.

Why?

govulncheck ./...
Scanning your code and 556 packages across 94 dependent modules for known vulnerabilities...

Vulnerability #1: GO-2024-2611
    Infinite loop in JSON unmarshaling in google.golang.org/protobuf
  More info: https://pkg.go.dev/vuln/GO-2024-2611
  Module: google.golang.org/protobuf
    Found in: google.golang.org/protobuf@v1.31.1-0.20231027082548-f4a6c1f6e5c1
    Fixed in: google.golang.org/protobuf@v1.33.0
    Example traces found:
      #1: lib/netext/grpcext/conn.go:118:31: grpcext.Conn.Invoke calls protojson.Unmarshal, which eventually calls json.Decoder.Peek
      #2: lib/netext/grpcext/conn.go:118:31: grpcext.Conn.Invoke calls protojson.Unmarshal, which eventually calls json.Decoder.Read
      #3: lib/netext/grpcext/conn.go:118:31: grpcext.Conn.Invoke calls protojson.Unmarshal

Your code is affected by 1 vulnerability from 1 module.

and https://github.com/grafana/k6/security/dependabot/29

Checklist

  • I have performed a self-review of my code.
  • I have added tests for my changes.
  • I have run linter locally (make lint) and all checks pass.
  • I have run tests locally (make tests) and all tests pass.
  • I have commented on my code, particularly in hard-to-understand areas.

Related PR(s)/Issue(s)

@olegbespalov olegbespalov added the dependencies Pull requests that update a dependency file label Mar 11, 2024
@olegbespalov olegbespalov added this to the v0.50.0 milestone Mar 11, 2024
@olegbespalov olegbespalov self-assigned this Mar 11, 2024
@olegbespalov olegbespalov requested a review from a team as a code owner March 11, 2024 15:18
@olegbespalov olegbespalov requested review from mstoykov and joanlopez and removed request for a team March 11, 2024 15:18
@codecov-commenter
Copy link

codecov-commenter commented Mar 11, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 73.57%. Comparing base (5709aa7) to head (4eb57fc).
Report is 1 commits behind head on master.

❗ Current head 4eb57fc differs from pull request most recent head 906019b. Consider uploading reports for the commit 906019b to get more accurate results

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3633      +/-   ##
==========================================
- Coverage   73.57%   73.57%   -0.01%     
==========================================
  Files         277      277              
  Lines       20244    20244              
==========================================
- Hits        14895    14894       -1     
- Misses       4401     4402       +1     
  Partials      948      948              
Flag Coverage Δ
macos 73.50% <ø> (+0.02%) ⬆️
ubuntu 73.51% <ø> (+<0.01%) ⬆️
windows 73.41% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

go.mod Show resolved Hide resolved
@olegbespalov olegbespalov merged commit 55256e6 into master Mar 12, 2024
24 checks passed
@olegbespalov olegbespalov deleted the feat/webcypto-and-protobuf branch March 12, 2024 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants