Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade the minimum supported Go version to fix security alerts #461

Closed
2 tasks done
dxsup opened this issue Feb 23, 2023 · 1 comment
Closed
2 tasks done

Upgrade the minimum supported Go version to fix security alerts #461

dxsup opened this issue Feb 23, 2023 · 1 comment
Labels
go Pull requests that update Go code security

Comments

@dxsup
Copy link
Member

dxsup commented Feb 23, 2023

There are two dependabot alerts #4 #5 that can't raise PRs automatically because they need to upgrade the go packages. But the packages are dependencies of github.com/mdlayher/netlink.

github.com/Kindling-project/kindling/collector/pkg/metadata/conntracker/internal imports
        github.com/mdlayher/netlink imports
        github.com/mdlayher/socket imports
        golang.org/x/sync/errgroup loaded from golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c,
        but go 1.16 would select v0.0.0-20220722155255-886fb9371eb4

To fix these alerts, we have to upgrade the Go version to at least 1.18 since the version of github.com/mdlayher/netlink we need requests Go 1.18+.

There are several components that we need to upgrade:

  • The minimum version specified in go.mod.
  • The Go version pre-installed in the builder image.
@dxsup dxsup added go Pull requests that update Go code security labels Feb 23, 2023
@dxsup
Copy link
Member Author

dxsup commented Mar 1, 2023

Closed via #463

@dxsup dxsup closed this as completed Mar 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
go Pull requests that update Go code security
Projects
None yet
Development

No branches or pull requests

1 participant