Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use latest patch release of Go toolchain #1152

Merged
merged 1 commit into from
Jan 25, 2024
Merged

Use latest patch release of Go toolchain #1152

merged 1 commit into from
Jan 25, 2024

Conversation

pietern
Copy link
Contributor

@pietern pietern commented Jan 25, 2024

Changes

This was pinned to 1.21.0 and included a vulnerability as reported in #1150. The vulnerability does not affect the prior CLI releases as it requires a user to execute Go commands from within compromised module directories.

Fixes #1150.

@pietern pietern requested a review from andrewnester January 25, 2024 12:11
@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (ce8cfef) 50.38% compared to head (d39256a) 51.29%.
Report is 5 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1152      +/-   ##
==========================================
+ Coverage   50.38%   51.29%   +0.91%     
==========================================
  Files         288      292       +4     
  Lines       10945    16322    +5377     
==========================================
+ Hits         5515     8373    +2858     
- Misses       4861     7340    +2479     
- Partials      569      609      +40     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@pietern pietern enabled auto-merge January 25, 2024 12:14
@pietern pietern added this pull request to the merge queue Jan 25, 2024
Merged via the queue into main with commit 2d38d14 Jan 25, 2024
4 checks passed
@pietern pietern deleted the go-unpin branch January 25, 2024 12:25
pietern added a commit that referenced this pull request Jan 25, 2024
CLI:
 * Prompt for account profile only for account-level command execution instead of during `databricks labs install` flow ([#1128](#1128)).
 * Bring back `--json` flag for workspace-conf set-status command ([#1151](#1151)).

Bundles:
 * Set `run_as` permissions after variable interpolation ([#1141](#1141)).
 * Add functionality to visit values in `dyn.Value` tree ([#1142](#1142)).
 * Add `dynvar` package for variable resolution with a `dyn.Value` tree ([#1143](#1143)).
 * Add support for `anyOf` to `skip_prompt_if` ([#1133](#1133)).
 * Added `bundle generate pipeline` command ([#1139](#1139)).

Internal:
 * Use MockWorkspaceClient from SDK instead of WithImpl mocking ([#1134](#1134)).

Dependency updates:
 * Bump github.com/databricks/databricks-sdk-go from 0.29.0 to 0.29.1 ([#1137](#1137)).
 * Bump github.com/hashicorp/terraform-json from 0.20.0 to 0.21.0 ([#1138](#1138)).
 * Update actions/setup-go to v5 ([#1148](#1148)).
 * Update codecov/codecov-action to v3 ([#1149](#1149)).
 * Use latest patch release of Go toolchain ([#1152](#1152)).
@pietern pietern mentioned this pull request Jan 25, 2024
github-merge-queue bot pushed a commit that referenced this pull request Jan 25, 2024
CLI:
* Prompt for account profile only for account-level command execution
instead of during `databricks labs install` flow
([#1128](#1128)).
* Bring back `--json` flag for workspace-conf set-status command
([#1151](#1151)).

Bundles:
* Set `run_as` permissions after variable interpolation
([#1141](#1141)).
* Add functionality to visit values in `dyn.Value` tree
([#1142](#1142)).
* Add `dynvar` package for variable resolution with a `dyn.Value` tree
([#1143](#1143)).
* Add support for `anyOf` to `skip_prompt_if`
([#1133](#1133)).
* Added `bundle generate pipeline` command
([#1139](#1139)).

Internal:
* Use MockWorkspaceClient from SDK instead of WithImpl mocking
([#1134](#1134)).

Dependency updates:
* Bump github.com/databricks/databricks-sdk-go from 0.29.0 to 0.29.1
([#1137](#1137)).
* Bump github.com/hashicorp/terraform-json from 0.20.0 to 0.21.0
([#1138](#1138)).
* Update actions/setup-go to v5
([#1148](#1148)).
* Update codecov/codecov-action to v3
([#1149](#1149)).
* Use latest patch release of Go toolchain
([#1152](#1152)).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Critical CVE in databricks cli due to go stdlib 1.21.0
3 participants