Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dep: update deps that were reported in OSV issues #319

Merged
merged 7 commits into from
Feb 1, 2023

Conversation

j75689
Copy link
Collaborator

@j75689 j75689 commented Jan 12, 2023

Description

This pr updates some dependencies to newer versions.

Rationale

Some dependency was found in OSV-reported issues. update them for security.
refer: https://github.com/google/osv-scanner

╭───────────────────────────────────────────────────┬───────────┬─────────────────────────────────────┬─────────────┬────────╮ ≈
│ OSV URL (ID IN BOLD)                              │ ECOSYSTEM │ PACKAGE                             │ VERSION     │ SOURCE │
├───────────────────────────────────────────────────┼───────────┼─────────────────────────────────────┼─────────────┼────────┤ ≈
│ https://osv.dev/vulnerability/GHSA-2chg-86hq-7w38 │ Go        │ github.com/btcsuite/btcd            │ 0.20.1-beta │ go.mod │
│ https://osv.dev/vulnerability/GO-2022-1098        │           │                                     │             │        │
│ https://osv.dev/vulnerability/GHSA-c3h9-896r-86jm │ Go        │ github.com/gogo/protobuf            │ 1.3.1       │ go.mod │
│ https://osv.dev/vulnerability/GO-2021-0053        │           │                                     │             │        │
│ https://osv.dev/vulnerability/GHSA-3xh2-74w9-5vxm │ Go        │ github.com/gorilla/websocket        │ 1.4.0       │ go.mod │
│ https://osv.dev/vulnerability/GO-2020-0019        │           │                                     │             │        │
│ https://osv.dev/vulnerability/GO-2022-0322        │ Go        │ github.com/prometheus/client_golang │ 1.1.0       │ go.mod │
│ https://osv.dev/vulnerability/GO-2022-1144        │ Go        │ golang.org/x/net                    │ 0.3.0       │ go.mod │
│ https://osv.dev/vulnerability/GHSA-wxc4-f4m6-wwqv │ Go        │ gopkg.in/yaml.v2                    │ 2.2.4       │ go.mod │
│ https://osv.dev/vulnerability/GO-2020-0036        │           │                                     │             │        │
╰───────────────────────────────────────────────────┴───────────┴─────────────────────────────────────┴─────────────┴────────╯ 

Example

NA

Changes

Notable changes:

  • go.mod
  • crypto/secp256k1

@j75689 j75689 changed the title [WIP] dep: update deps that were reported in OSV issues dep: update deps that were reported in OSV issues Feb 1, 2023
@j75689 j75689 merged commit 5b60d2c into bnb-chain:develop Feb 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants