Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

outdated replace directive in go.mod #417

Closed
Morty-luo opened this issue Feb 8, 2023 · 1 comment · Fixed by #419
Closed

outdated replace directive in go.mod #417

Morty-luo opened this issue Feb 8, 2023 · 1 comment · Fixed by #419

Comments

@Morty-luo
Copy link

Morty-luo commented Feb 8, 2023

It seems that nginxinc/nginx-kubernetes-gateway at now indirectly depends on newer version of golang.org/x/text and golang.org/x/net which has fixed related vulnerability.
So, it makes no sense to keep according replace directive in go.mod. Should them be dropped?

golang.org/x/net v0.5.0 // indirect
golang.org/x/text v0.6.0 // indirect
replace (
	// temporary fix for CVE-2022-27664
	golang.org/x/net v0.0.0-20220722155237-a158d28d115b => golang.org/x/net v0.0.0-20220906165146-f3363e06e74c
	//temporary fix for CVE-2022-27664
	golang.org/x/text v0.3.7 => golang.org/x/text v0.3.8
)

Aha! Link: https://nginx.aha.io/features/NKG-48

@lucacome
Copy link
Member

lucacome commented Feb 8, 2023

Hi @Morty-luo thanks for catching this! We should indeed remove the replace 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

2 participants