update dependencies to address CVE-2023-45142 - Githubissues

operator-framework / ansible-operator-plugins

Experimental extraction/refactoring of the Operator SDK's ansible operator plugin

Apache License 2.0

7 stars 17 forks source link

update dependencies to address CVE-2023-45142 #46

Closed everettraven closed 6 months ago

everettraven commented 6 months ago

Description of the change:

Updates dependencies as necessary to ensure a remediated version of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is used. Verified by running cat go.sum | grep -i otelhttp which returned go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 h1:KfYpVmrjI7JuToy5k8XV3nkapjWx48k4E4JOtVstzQI=

Motivation for the change:

Ensure that we are unaffected by CVE-2023-45142

[!NOTE] We may not actually be affected by this CVE as doing a go mod vendor results in this package not being vendored (although it does show up in the go.sum), likely meaning we don't use it. That being said, I don't think it hurts to perform these updates.