-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[TT-13485] update dependencies with vulnerabilities reported #6711
Conversation
Knock Knock! 🔍 Just thought I'd let you know that your PR title and story title look quite different. PR titles that closely resemble the story title make it easier for reviewers to understand the context of the PR. An easy-to-understand PR title a day makes the reviewer review away! 😛⚡️
Check out this guide to learn more about PR best-practices. |
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
PR Code Suggestions ✨No code suggestions found for the PR. |
45de719
to
268e4fa
Compare
API Changes no api changes detected |
Quality Gate failedFailed conditions |
/release to release-5.7 |
Working on it! Note that it can take a few minutes. |
/release to release-5.7.0 |
Still working... |
Working on it! Note that it can take a few minutes. |
Still working... |
### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-13485" title="TT-13485" target="_blank">TT-13485</a></summary> <br /> <table> <tr> <th>Summary</th> <td>Run CVE scan for v5.7.0</td> </tr> <tr> <th>Type</th> <td> <img alt="Sub-task" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10316?size=medium" /> Sub-task </td> </tr> <tr> <th>Status</th> <td>In Code Review</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td>-</td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- <!-- Provide a general summary of your changes in the Title above --> ## Description Update dependencies to fix reported vulnerabilities ## Related Issue https://tyktech.atlassian.net/browse/TT-13485 ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why ___ ### **PR Type** enhancement, dependencies ___ ### **Description** - Updated several Go module dependencies to address vulnerabilities and ensure compatibility with the latest versions. - Specifically updated `github.com/golang-jwt/jwt/v4` to v4.5.1, `github.com/hashicorp/consul/api` to v1.30.0, and `github.com/hashicorp/vault/api` to v1.16.0 in `go.mod`. - Updated `go.sum` to include new checksums for the updated dependencies. ___ ### **Changes walkthrough** 📝 <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Dependencies</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Update Go module dependencies to latest versions</code> </dd></summary> <hr> go.mod <li>Updated <code>github.com/golang-jwt/jwt/v4</code> from v4.5.0 to v4.5.1.<br> <li> Updated <code>github.com/hashicorp/consul/api</code> from v1.29.4 to v1.30.0.<br> <li> Updated <code>github.com/hashicorp/vault/api</code> from v1.15.0 to v1.16.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+3/-3</a> </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Go sum file with new dependency checksums</code> </dd></summary> <hr> go.sum <li>Added checksums for <code>github.com/golang-jwt/jwt/v4</code> version v4.5.1.<br> <li> Added checksums for <code>github.com/hashicorp/consul/api</code> version v1.30.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+4/-0</a> </td> </tr> </table></td></tr></tr></tbody></table> ___ > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull request to receive relevant information (cherry picked from commit cb62825)
### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-13485" title="TT-13485" target="_blank">TT-13485</a></summary> <br /> <table> <tr> <th>Summary</th> <td>Run CVE scan for v5.7.0</td> </tr> <tr> <th>Type</th> <td> <img alt="Sub-task" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10316?size=medium" /> Sub-task </td> </tr> <tr> <th>Status</th> <td>In Code Review</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td>-</td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- <!-- Provide a general summary of your changes in the Title above --> ## Description Update dependencies to fix reported vulnerabilities ## Related Issue https://tyktech.atlassian.net/browse/TT-13485 ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why ___ ### **PR Type** enhancement, dependencies ___ ### **Description** - Updated several Go module dependencies to address vulnerabilities and ensure compatibility with the latest versions. - Specifically updated `github.com/golang-jwt/jwt/v4` to v4.5.1, `github.com/hashicorp/consul/api` to v1.30.0, and `github.com/hashicorp/vault/api` to v1.16.0 in `go.mod`. - Updated `go.sum` to include new checksums for the updated dependencies. ___ ### **Changes walkthrough** 📝 <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Dependencies</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Update Go module dependencies to latest versions</code> </dd></summary> <hr> go.mod <li>Updated <code>github.com/golang-jwt/jwt/v4</code> from v4.5.0 to v4.5.1.<br> <li> Updated <code>github.com/hashicorp/consul/api</code> from v1.29.4 to v1.30.0.<br> <li> Updated <code>github.com/hashicorp/vault/api</code> from v1.15.0 to v1.16.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+3/-3</a> </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Go sum file with new dependency checksums</code> </dd></summary> <hr> go.sum <li>Added checksums for <code>github.com/golang-jwt/jwt/v4</code> version v4.5.1.<br> <li> Added checksums for <code>github.com/hashicorp/consul/api</code> version v1.30.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+4/-0</a> </td> </tr> </table></td></tr></tr></tbody></table> ___ > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull request to receive relevant information (cherry picked from commit cb62825)
…bilities reported (#6711) (#6714) ### **User description** [TT-13485] update dependencies with vulnerabilities reported (#6711) ### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-13485" title="TT-13485" target="_blank">TT-13485</a></summary> <br /> <table> <tr> <th>Summary</th> <td>Run CVE scan for v5.7.0</td> </tr> <tr> <th>Type</th> <td> <img alt="Sub-task" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10316?size=medium" /> Sub-task </td> </tr> <tr> <th>Status</th> <td>In Code Review</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td>-</td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- <!-- Provide a general summary of your changes in the Title above --> ## Description Update dependencies to fix reported vulnerabilities ## Related Issue https://tyktech.atlassian.net/browse/TT-13485 ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why ___ ### **PR Type** enhancement, dependencies ___ ### **Description** - Updated several Go module dependencies to address vulnerabilities and ensure compatibility with the latest versions. - Specifically updated `github.com/golang-jwt/jwt/v4` to v4.5.1, `github.com/hashicorp/consul/api` to v1.30.0, and `github.com/hashicorp/vault/api` to v1.16.0 in `go.mod`. - Updated `go.sum` to include new checksums for the updated dependencies. ___ ### **Changes walkthrough** 📝 <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Dependencies</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Update Go module dependencies to latest versions</code> </dd></summary> <hr> go.mod <li>Updated <code>github.com/golang-jwt/jwt/v4</code> from v4.5.0 to v4.5.1.<br> <li> Updated <code>github.com/hashicorp/consul/api</code> from v1.29.4 to v1.30.0.<br> <li> Updated <code>github.com/hashicorp/vault/api</code> from v1.15.0 to v1.16.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+3/-3</a> </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Go sum file with new dependency checksums</code> </dd></summary> <hr> go.sum <li>Added checksums for <code>github.com/golang-jwt/jwt/v4</code> version v4.5.1.<br> <li> Added checksums for <code>github.com/hashicorp/consul/api</code> version v1.30.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+4/-0</a> </td> </tr> </table></td></tr></tr></tbody></table> ___ > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull request to receive relevant information [TT-13485]: https://tyktech.atlassian.net/browse/TT-13485?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ ___ ### **PR Type** Enhancement, Dependencies ___ ### **Description** - Updated several Go module dependencies to address vulnerabilities and ensure compatibility with the latest versions. - Specifically updated `github.com/golang-jwt/jwt/v4` to v4.5.1, `github.com/hashicorp/consul/api` to v1.30.0, and `github.com/hashicorp/vault/api` to v1.16.0 in `go.mod`. - Updated `go.sum` to include new checksums for the updated dependencies. ___ ### **Changes walkthrough** 📝 <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Dependencies</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Update Go module dependencies to latest versions</code> </dd></summary> <hr> go.mod <li>Updated <code>github.com/golang-jwt/jwt/v4</code> from v4.5.0 to v4.5.1.<br> <li> Updated <code>github.com/hashicorp/consul/api</code> from v1.29.4 to v1.30.0.<br> <li> Updated <code>github.com/hashicorp/vault/api</code> from v1.15.0 to v1.16.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6714/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+2/-2</a> </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Go sum file with new dependency checksums</code> </dd></summary> <hr> go.sum <li>Added checksums for <code>github.com/golang-jwt/jwt/v4</code> version v4.5.1.<br> <li> Added checksums for <code>github.com/hashicorp/consul/api</code> version v1.30.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6714/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+4/-6</a> </td> </tr> </table></td></tr></tr></tbody></table> ___ > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull request to receive relevant information Co-authored-by: Jeffy Mathew <[email protected]>
…lities reported (#6711) (#6713) ### **User description** [TT-13485] update dependencies with vulnerabilities reported (#6711) ### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-13485" title="TT-13485" target="_blank">TT-13485</a></summary> <br /> <table> <tr> <th>Summary</th> <td>Run CVE scan for v5.7.0</td> </tr> <tr> <th>Type</th> <td> <img alt="Sub-task" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10316?size=medium" /> Sub-task </td> </tr> <tr> <th>Status</th> <td>In Code Review</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td>-</td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- <!-- Provide a general summary of your changes in the Title above --> ## Description Update dependencies to fix reported vulnerabilities ## Related Issue https://tyktech.atlassian.net/browse/TT-13485 ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why ___ ### **PR Type** enhancement, dependencies ___ ### **Description** - Updated several Go module dependencies to address vulnerabilities and ensure compatibility with the latest versions. - Specifically updated `github.com/golang-jwt/jwt/v4` to v4.5.1, `github.com/hashicorp/consul/api` to v1.30.0, and `github.com/hashicorp/vault/api` to v1.16.0 in `go.mod`. - Updated `go.sum` to include new checksums for the updated dependencies. ___ ### **Changes walkthrough** 📝 <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Dependencies</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Update Go module dependencies to latest versions</code> </dd></summary> <hr> go.mod <li>Updated <code>github.com/golang-jwt/jwt/v4</code> from v4.5.0 to v4.5.1.<br> <li> Updated <code>github.com/hashicorp/consul/api</code> from v1.29.4 to v1.30.0.<br> <li> Updated <code>github.com/hashicorp/vault/api</code> from v1.15.0 to v1.16.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+3/-3</a> </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Go sum file with new dependency checksums</code> </dd></summary> <hr> go.sum <li>Added checksums for <code>github.com/golang-jwt/jwt/v4</code> version v4.5.1.<br> <li> Added checksums for <code>github.com/hashicorp/consul/api</code> version v1.30.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6711/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+4/-0</a> </td> </tr> </table></td></tr></tr></tbody></table> ___ > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull request to receive relevant information [TT-13485]: https://tyktech.atlassian.net/browse/TT-13485?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ ___ ### **PR Type** Enhancement, Dependencies ___ ### **Description** - Updated several Go module dependencies to address vulnerabilities and ensure compatibility with the latest versions. - Specifically updated `github.com/golang-jwt/jwt/v4` to v4.5.1, `github.com/hashicorp/consul/api` to v1.30.0, and `github.com/hashicorp/vault/api` to v1.16.0 in `go.mod`. - Updated `go.sum` to include new checksums for the updated dependencies. ___ ### **Changes walkthrough** 📝 <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Dependencies</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Update Go module dependencies to latest versions</code> </dd></summary> <hr> go.mod <li>Updated <code>github.com/golang-jwt/jwt/v4</code> from v4.5.0 to v4.5.1.<br> <li> Updated <code>github.com/hashicorp/consul/api</code> from v1.29.4 to v1.30.0.<br> <li> Updated <code>github.com/hashicorp/vault/api</code> from v1.15.0 to v1.16.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6713/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+2/-2</a> </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Go sum file with new dependency checksums</code> </dd></summary> <hr> go.sum <li>Added checksums for <code>github.com/golang-jwt/jwt/v4</code> version v4.5.1.<br> <li> Added checksums for <code>github.com/hashicorp/consul/api</code> version v1.30.0.<br> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6713/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+4/-6</a> </td> </tr> </table></td></tr></tr></tbody></table> ___ > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull request to receive relevant information Co-authored-by: Jeffy Mathew <[email protected]>
User description
TT-13485
Description
Update dependencies to fix reported vulnerabilities
Related Issue
https://tyktech.atlassian.net/browse/TT-13485
Motivation and Context
How This Has Been Tested
Screenshots (if appropriate)
Types of changes
Checklist
PR Type
enhancement, dependencies
Description
github.com/golang-jwt/jwt/v4
to v4.5.1,github.com/hashicorp/consul/api
to v1.30.0, andgithub.com/hashicorp/vault/api
to v1.16.0 ingo.mod
.go.sum
to include new checksums for the updated dependencies.Changes walkthrough 📝
go.mod
Update Go module dependencies to latest versions
go.mod
github.com/golang-jwt/jwt/v4
from v4.5.0 to v4.5.1.github.com/hashicorp/consul/api
from v1.29.4 to v1.30.0.github.com/hashicorp/vault/api
from v1.15.0 to v1.16.0.go.sum
Update Go sum file with new dependency checksums
go.sum
github.com/golang-jwt/jwt/v4
version v4.5.1.github.com/hashicorp/consul/api
version v1.30.0.