CVE-2024-45337 CVE-2024-45338

[kaovilai]

Replaces #8514

Signed-off-by: Tiger Kaovilai tkaovila@redhat.com

Thank you for contributing to Velero!

Please add a summary of your change

go: upgraded golang.org/x/net v0.31.0 => v0.33.0
go: upgraded golang.org/x/crypto v0.29.0 => v0.31.0
go: upgraded golang.org/x/sync v0.9.0 => v0.10.0
go: upgraded golang.org/x/sys v0.27.0 => v0.28.0
go: upgraded golang.org/x/term v0.26.0 => v0.27.0
go: upgraded golang.org/x/text v0.20.0 => v0.21.0

Does your change fix a particular issue?

Fixes #(issue)

Please indicate you've done the following:

• Accepted the DCO. Commits without the DCO will delay acceptance.
• Created a changelog file (make new-changelog) or comment /kind changelog-not-required on this PR.
• Updated the corresponding documentation in site/content/docs/main.

/kind changelog-not-required

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.17%. Comparing base (e85f18d) to head (8cb04bb).
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8541      +/-   ##
==========================================
- Coverage   59.18%   59.17%   -0.02%     
==========================================
  Files         369      369              
  Lines       39413    39413              
==========================================
- Hits        23327    23323       -4     
- Misses      14617    14620       +3     
- Partials     1469     1470       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[reasonerjt]

LGTM, thanks!

[gilrosenberg]

Do you plan to release patch version for this fix? If yes, when is this planed?

[blackpiglet]

@gilrosenberg
The v1.15.1 will include the CVE fixes.
The target is the beginning of next month.

[kaovilai]

An equivalent PR for 1.15 is #8526