search

sirupsen / logrus

Structured, pluggable logging for Go.
MIT License
24.3k stars 2.26k forks source link

Bump version of stretchr/testify? #1419

Closed amaciejk closed 2 months ago

amaciejk commented 4 months ago

It looks like the go.mod/sum for sirupsen/logrus hasn't been updated in a while. This is causing a security hit for https://nvd.nist.gov/vuln/detail/CVE-2022-28948 in yaml.v3 via the following dep tree:

github.com/sirupsen/logrus
github.com/sirupsen/logrus.test
github.com/stretchr/testify/assert
gopkg.in/yaml.v3

You are currently using v1.7.0 of testify/assert: https://github.com/sirupsen/logrus/blob/master/go.mod#L5

But there are more recent versions which will fix the yaml vul (looks like v1.7.2 or higher): https://github.com/stretchr/testify/releases

dolmen commented 3 months ago

Would be fixed by #1344.

github-actions[bot] commented 2 months ago

This issue is stale because it has been open for 30 days with no activity.

github-actions[bot] commented 2 months ago

This issue was closed because it has been inactive for 14 days since being marked as stale.