Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release-3.6] depedency: bump golang.org/x/crypto from v0.32.0 to v0.35.0 #19480

Merged

Conversation

ivanvc
Copy link
Member

@ivanvc ivanvc commented Feb 25, 2025

To address CVE-2025-22869.

There's a change to go.mod's go directive setting the patch to 1.23.0. I know we had a conversation recently (#19429 (comment)). And we settled down on removing the patch version. However, because golang.org/x dependencies now specify up to the patch (refer to: https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.34.0:go.mod;bpv=1;bpt=0;drc=89ff08d67c4d79f9ac619aaf1f7388888798651f;dlc=9290511cd23ab9813a307b7f2615325e3ca98902), it rolls over to our go.mod. Therefore, go commands fail, complaining that we need to run a go mod tidy.. As stated in #19477 (comment). Refer to the failure of all jobs if we don't include the go directive set to 1.23.0: https://prow.k8s.io/pr-history/?org=etcd-io&repo=etcd&pr=19480

Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.

To address CVE-2025-22869.

Signed-off-by: Ivan Valdes <[email protected]>
@ivanvc ivanvc force-pushed the release-3.6-golang-x-crypto-bump-to-v0.35.0 branch from a971c6c to 60b46a3 Compare February 25, 2025 07:23
Copy link

codecov bot commented Feb 25, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 68.95%. Comparing base (3c83cd9) to head (60b46a3).
Report is 4 commits behind head on release-3.6.

Additional details and impacted files

see 19 files with indirect coverage changes

@@               Coverage Diff               @@
##           release-3.6   #19480      +/-   ##
===============================================
+ Coverage        68.86%   68.95%   +0.08%     
===============================================
  Files              420      420              
  Lines            35762    35762              
===============================================
+ Hits             24629    24660      +31     
+ Misses            9704     9682      -22     
+ Partials          1429     1420       -9     

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3c83cd9...60b46a3. Read the comment docs.

@k8s-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahrtr, ivanvc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ahrtr ahrtr merged commit efcf06a into etcd-io:release-3.6 Feb 25, 2025
39 checks passed
@ivanvc ivanvc deleted the release-3.6-golang-x-crypto-bump-to-v0.35.0 branch February 25, 2025 18:11
@ivanvc ivanvc mentioned this pull request Feb 25, 2025
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

3 participants