hashicorp / go-getter

Package for downloading things from a string URL using a variety of protocols.
Mozilla Public License 2.0
1.62k stars 227 forks source link

gcs/v2: bump cloud.google.com/go/storage to 1.34.0 #488

Closed lbajolet-hashicorp closed 1 month ago

lbajolet-hashicorp commented 2 months ago

The storage library that gcs depends on transitively imports grpc in version 1.50.0, which is vulnerable to GHSA-m425-mq94-257g.

While this is a server-side vulnerability, therefore the package is not directly vulnerable (nor its clients), this dependency still causes advisories to be produced against this package, so we update those now.