tektoncd / results

Long term storage of execution results.
Apache License 2.0
77 stars 73 forks source link

[v0.8.x] Bump GRPC Go to v1.57.2 #643

Closed khrm closed 11 months ago

khrm commented 11 months ago

This fixes CVE-2023-44487

Changes

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you review them:

Release Notes

This addresses CVE-2023-44487 by not allowing more server handlers to be run than the HTTP/2 MAX_CONCURRENT_STREAMS setting.
khrm commented 11 months ago

/kind security

tekton-robot commented 11 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enarha

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/tektoncd/results/blob/release-v0.8.x/OWNERS)~~ [enarha] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
khrm commented 11 months ago

@enarha Main will have a different version. So we can't cherry-pick that. And we need to do v0.8.1. So I raise this pr.

khrm commented 11 months ago

@vdemeester @avinal Can you give lgtm to this?

enarha commented 11 months ago

/lgtm